@promptowl/contextnest-community 1.14.0 → 1.15.0

package/dist/{chunk-I5KYGMIT.js → chunk-BCFKLY4H.js}

@@ -711,6 +711,12 @@ function runMigrations(db) {
   if (!nestCols.includes("allow_self_approve")) {
     db.exec("ALTER TABLE nests ADD COLUMN allow_self_approve INTEGER NOT NULL DEFAULT 0");
   }
+  if (!nestCols.includes("prime_only_review")) {
+    db.exec("ALTER TABLE nests ADD COLUMN prime_only_review INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("prime_tags")) {
+    db.exec("ALTER TABLE nests ADD COLUMN prime_tags TEXT NOT NULL DEFAULT 'prime-document'");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1454,6 +1460,53 @@ function runMigrations(db) {
     })();
     recordMigration("031_team_source");
   }
+  if (!hasMigration("032_deletion_requests")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS deletion_requests (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          requested_by TEXT NOT NULL,      -- email
+          reason TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'pending'
+            CHECK(status IN ('pending', 'declined')),
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          resolved_by TEXT,                -- email
+          resolved_at TEXT,
+          resolution_note TEXT
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deletion_requests_pending
+          ON deletion_requests(nest_id, node_id) WHERE status = 'pending';
+        CREATE INDEX IF NOT EXISTS idx_deletion_requests_nest
+          ON deletion_requests(nest_id, status);
+      `);
+    })();
+    recordMigration("032_deletion_requests");
+  }
+  if (!hasMigration("033_deletion_request_targets")) {
+    db.transaction(() => {
+      const cols = db.prepare("PRAGMA table_info(deletion_requests)").all().map((c) => c.name);
+      if (!cols.includes("target_type")) {
+        db.exec(
+          "ALTER TABLE deletion_requests ADD COLUMN target_type TEXT NOT NULL DEFAULT 'document'"
+        );
+      }
+      db.exec(`
+        DROP INDEX IF EXISTS idx_deletion_requests_pending;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deletion_requests_pending
+          ON deletion_requests(nest_id, target_type, node_id) WHERE status = 'pending';
+      `);
+    })();
+    recordMigration("033_deletion_request_targets");
+  }
+  if (!hasMigration("034_versions_author_status_index")) {
+    db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_versions_author_status
+        ON node_versions(author, status);
+    `);
+    recordMigration("034_versions_author_status_index");
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1671,7 +1724,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-BRXZY2GE.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-CYKO5CFV.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-MZ4IR5KH.js → chunk-C4U75IUR.js}

@@ -2,39 +2,42 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-IHGPZ6NY.js";
+} from "./chunk-5IAKUUZF.js";
 import {
   createVersion,
   getApprovedVersion,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-JP67WXLA.js";
+} from "./chunk-JWVZ3T35.js";
 import {
-  buildDocContext,
-  buildTitleMap,
   canUserAccess,
   canUserApprove,
+  resolveStewardsForNode
+} from "./chunk-GWDOLYFJ.js";
+import {
+  buildDocContext,
+  buildTitleMap,
   describeNode,
   engineCache,
+  insertOrReplace,
   isPublicReader,
   isStewardshipEnabled,
+  nestName,
   notifyEmailForNest,
-  resolveStewardsForNode,
-  sendEmailToRecipient
-} from "./chunk-KPK656BH.js";
+  nowExpr,
+  prettyFolderPath,
+  sendEmailToRecipient,
+  titleForNode
+} from "./chunk-7BOG3S5H.js";
 import {
   ConflictError,
   NotFoundError,
   ValidationError
 } from "./chunk-GUNJTORH.js";
-import {
-  insertOrReplace,
-  nowExpr
-} from "./chunk-XQ46F76G.js";
 import {
   config,
   getDb
-} from "./chunk-I5KYGMIT.js";
+} from "./chunk-BCFKLY4H.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -83,6 +86,7 @@ async function notifyReviewRequested(params) {
       [nestId, nodeId, nestId, nodeId]
     );
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const label = await describeNode(nestId, nodeId);
     let created = 0;
     for (const r of rows) {
       if (r.user_email.toLowerCase() === requestedBy.toLowerCase()) continue;
@@ -94,7 +98,7 @@ async function notifyReviewRequested(params) {
           nestId,
           r.user_email.toLowerCase(),
           reviewId,
-          r.via === nodeId ? `"${nodeId}" has a new version awaiting review (submitted by ${requestedBy})` : `Agent "${r.via}" produced output on "${nodeId}" \u2014 awaiting review`,
+          r.via === nodeId ? `"${label}" has a new version awaiting review (submitted by ${requestedBy})` : `Agent "${await describeNode(nestId, r.via)}" produced output on "${label}" \u2014 awaiting review`,
           now
         ]
       );
@@ -126,6 +130,7 @@ async function notifyReviewResolved(params) {
     recipients.add(requestedBy.toLowerCase());
     recipients.delete(resolvedBy.toLowerCase());
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const label = await describeNode(nestId, nodeId);
     let created = 0;
     for (const email of recipients) {
       await db.run(
@@ -137,7 +142,7 @@ async function notifyReviewResolved(params) {
           email,
           `review_${status}`,
           reviewId,
-          `"${nodeId}" was ${status} by ${resolvedBy}`,
+          `"${label}" was ${status} by ${resolvedBy}`,
           now
         ]
       );
@@ -150,7 +155,7 @@ async function notifyReviewResolved(params) {
   }
 }
 async function notifyNestInvite(params) {
-  const { nestId, inviteeEmail, permission, nestName } = params;
+  const { nestId, inviteeEmail, permission, nestName: nestName2 } = params;
   try {
     await getDb().run(
       `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
@@ -160,7 +165,7 @@ async function notifyNestInvite(params) {
         nestId,
         inviteeEmail.toLowerCase(),
         nestId,
-        `You were added to "${nestName}" as ${permission}`,
+        `You were added to "${nestName2}" as ${permission}`,
         (/* @__PURE__ */ new Date()).toISOString()
       ]
     );
@@ -628,8 +633,8 @@ function msTeamsPayload(title, message) {
 }
 async function notifyMsTeamsForNest(nestId, message) {
   if (!config.MSTEAMS_WEBHOOK_URL) return;
-  const nestName = await resolveNestName(nestId);
-  return notifyMsTeams(nestName, message);
+  const nestName2 = await resolveNestName(nestId);
+  return notifyMsTeams(nestName2, message);
 }
 async function notifyMsTeams(title, message) {
   const url = config.MSTEAMS_WEBHOOK_URL;
@@ -640,8 +645,8 @@ async function notifyMsTeams(title, message) {
 // src/notify/slack.ts
 async function notifySlackForNest(nestId, message) {
   if (!config.SLACK_WEBHOOK_URL) return;
-  const nestName = await resolveNestName(nestId);
-  return notifySlack(`*[${nestName}]* ${message}`);
+  const nestName2 = await resolveNestName(nestId);
+  return notifySlack(`*[${nestName2}]* ${message}`);
 }
 function escapeMrkdwn(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -657,25 +662,31 @@ var EVENT_EMOJI = {
   review_requested: ":memo:",
   review_approved: ":white_check_mark:",
   review_rejected: ":x:",
-  run_failed: ":rotating_light:"
+  run_failed: ":rotating_light:",
+  deletion_requested: ":wastebasket:",
+  deletion_deleted: ":wastebasket:",
+  deletion_declined: ":no_entry_sign:"
 };
 var DIGEST_DELIVERED_KINDS = /* @__PURE__ */ new Set([
   "review_requested",
   "review_approved",
-  "review_rejected"
+  "review_rejected",
+  "deletion_requested",
+  "deletion_deleted",
+  "deletion_declined"
 ]);
-function formatBody(channel, nestName, ev) {
-  const line = `[${nestName}] ${ev.message}`;
+function formatBody(channel, nestName2, ev) {
+  const line = `[${nestName2}] ${ev.message}`;
   if (channel === "slack") {
-    return { text: escapeMrkdwn(`${EVENT_EMOJI[ev.kind] ?? ""} *[${nestName}]* ${ev.message}`) };
+    return { text: escapeMrkdwn(`${EVENT_EMOJI[ev.kind] ?? ""} *[${nestName2}]* ${ev.message}`) };
   }
   if (channel === "teams") {
-    return msTeamsPayload(nestName, `${EVENT_EMOJI[ev.kind] ?? ""} ${ev.message}`.trim());
+    return msTeamsPayload(nestName2, `${EVENT_EMOJI[ev.kind] ?? ""} ${ev.message}`.trim());
   }
   return {
     kind: ev.kind,
     nest_id: ev.nestId,
-    nest_name: nestName,
+    nest_name: nestName2,
     message: ev.message,
     subject_id: ev.subjectId ?? null,
     actor: ev.actor ?? null,
@@ -716,18 +727,18 @@ async function resolveUrl(nestId, raw) {
 }
 async function dispatchEvent(ev) {
   const db = getDb();
-  const nestName = await resolveNestName(ev.nestId);
+  const nestName2 = await resolveNestName(ev.nestId);
   if (config.SLACK_WEBHOOK_URL && !DIGEST_DELIVERED_KINDS.has(ev.kind)) {
     void postWebhook(
       config.SLACK_WEBHOOK_URL,
-      formatBody("slack", nestName, ev),
+      formatBody("slack", nestName2, ev),
       "server-slack"
     );
   }
   if (config.MSTEAMS_WEBHOOK_URL && !DIGEST_DELIVERED_KINDS.has(ev.kind)) {
     void postWebhook(
       config.MSTEAMS_WEBHOOK_URL,
-      formatBody("teams", nestName, ev),
+      formatBody("teams", nestName2, ev),
       "server-msteams"
     );
   }
@@ -749,7 +760,7 @@ async function dispatchEvent(ev) {
     if (!kinds.includes("*") && !kinds.includes(ev.kind)) continue;
     const url = await resolveUrl(ev.nestId, r.url);
     if (!url) continue;
-    void postWebhook(url, formatBody(r.channel, nestName, ev), `connector:${r.id}`);
+    void postWebhook(url, formatBody(r.channel, nestName2, ev), `connector:${r.id}`);
   }
 }
 async function sendTestNotification(channel) {
@@ -835,6 +846,12 @@ async function safePublishDocument(storage, docId, options) {
   await storage.writeDocument(docId, serializeDocument(cleanedNode));
   return publishDocument(storage, docId, options);
 }
+function serializeNodeSafe(node) {
+  return serializeDocument({
+    ...node,
+    frontmatter: stripUndefinedDeep(node.frontmatter)
+  });
+}
 function stripUndefinedDeep(value) {
   if (Array.isArray(value)) {
     return value.filter((v) => v !== void 0).map((v) => stripUndefinedDeep(v));
@@ -1248,6 +1265,297 @@ async function getPendingReview(nestId, nodeId) {
   );
   return row ? rowToReviewRequest(row) : null;
 }
+async function deletionTargetTitle(request, titles) {
+  if (request.targetType === "folder") return prettyFolderPath(request.nodeId);
+  if (request.targetType === "nest") return await nestName(request.nestId);
+  return titles?.get(request.nodeId) ?? await titleForNode(request.nestId, request.nodeId);
+}
+async function nestAdminEmails(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT u.email FROM nests n JOIN users u ON u.id = n.user_id WHERE n.id = ?
+     UNION
+     SELECT u.email FROM nest_collaborators nc JOIN users u ON u.id = nc.user_id
+      WHERE nc.nest_id = ? AND nc.permission IN ('owner', 'admin')`,
+    [nestId, nestId]
+  );
+  return [...new Set(rows.map((r) => r.email.toLowerCase()))];
+}
+async function inboxInsert(nestId, recipients, kind, subjectId, message) {
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  for (const email of recipients) {
+    try {
+      await db.run(
+        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [uuid3(), nestId, email.toLowerCase(), kind, subjectId, message, now]
+      );
+    } catch (err) {
+      console.error("[notify] deletion inbox insert failed", nestId, email, err);
+    }
+  }
+}
+async function deletionTargetContext(request, baseUrl) {
+  if (request.targetType === "document") {
+    const ctx = await buildDocContext(request.nestId, request.nodeId, baseUrl);
+    return { noun: "document", ...ctx };
+  }
+  const name = await nestName(request.nestId);
+  const label = request.targetType === "folder" ? prettyFolderPath(request.nodeId) : name;
+  return {
+    noun: request.targetType,
+    label,
+    docTitle: label,
+    path: name,
+    link: baseUrl ? `${baseUrl}/?nest=${encodeURIComponent(request.nestId)}` : ""
+  };
+}
+async function notifyDeletionRequested(request, baseUrl) {
+  try {
+    const ctx = await deletionTargetContext(request, baseUrl);
+    const line = `Deletion requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"`;
+    const admins = (await nestAdminEmails(request.nestId)).filter(
+      (e) => e !== request.requestedBy.toLowerCase()
+    );
+    await inboxInsert(
+      request.nestId,
+      admins,
+      "deletion_requested",
+      request.id,
+      `${ctx.noun === "document" ? "" : `${ctx.noun} `}"${ctx.docTitle}" was flagged for deletion by ${request.requestedBy} \u2014 "${request.reason}"`
+    );
+    void dispatchEvent({
+      kind: "deletion_requested",
+      nestId: request.nestId,
+      subjectId: request.nodeId,
+      actor: request.requestedBy,
+      message: line
+    });
+    void notifyNestEvent(
+      request.nestId,
+      `:wastebasket: ${line}`,
+      {
+        status: "deletion_requested",
+        docTitle: ctx.docTitle,
+        path: ctx.path,
+        link: ctx.link,
+        actor: request.requestedBy,
+        note: request.reason
+      },
+      // The admins are emailed directly below; don't also hit the shared
+      // NOTIFY_EMAIL_TO team inbox with the same event.
+      { skipEmail: true }
+    );
+    if (admins.length > 0) {
+      void sendEmailToRecipient(admins, {
+        status: "deletion_requested",
+        docTitle: ctx.docTitle,
+        path: ctx.path,
+        link: ctx.link,
+        actor: request.requestedBy,
+        note: request.reason
+      });
+    }
+  } catch (err) {
+    console.error(
+      "[notify] deletion request fan-out failed",
+      request.nestId,
+      request.nodeId,
+      err
+    );
+  }
+}
+async function notifyDeletionResolved(params) {
+  try {
+    const { outcome, resolvedBy, note } = params;
+    const verb = outcome === "deleted" ? "deleted" : "declined the deletion of";
+    const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
+    const recipient = params.requestedBy.toLowerCase();
+    const canInbox = !(params.targetType === "nest" && outcome === "deleted");
+    if (canInbox && recipient !== resolvedBy.toLowerCase()) {
+      await inboxInsert(
+        params.nestId,
+        [recipient],
+        `deletion_${outcome}`,
+        params.requestId,
+        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was declined by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+      );
+    }
+    void dispatchEvent({
+      kind: `deletion_${outcome}`,
+      nestId: params.nestId,
+      subjectId: params.nodeId,
+      actor: resolvedBy,
+      message: line
+    });
+    void notifyNestEvent(
+      params.nestId,
+      `${outcome === "deleted" ? ":wastebasket:" : ":no_entry_sign:"} ${line}`,
+      void 0,
+      // Verdict emails the requester directly (below), not the team inbox.
+      { skipEmail: true }
+    );
+    if (recipient !== resolvedBy.toLowerCase()) {
+      const link = params.baseUrl ? `${params.baseUrl}/?nest=${encodeURIComponent(params.nestId)}` : "";
+      void sendEmailToRecipient(recipient, {
+        status: outcome === "deleted" ? "deletion_deleted" : "deletion_declined",
+        docTitle: params.docTitle,
+        path: params.nestId,
+        link: outcome === "deleted" ? link : void 0,
+        actor: resolvedBy,
+        note: note || null
+      });
+    }
+  } catch (err) {
+    console.error(
+      "[notify] deletion verdict fan-out failed",
+      params.nestId,
+      params.nodeId,
+      err
+    );
+  }
+}
+async function requestDeletion(params) {
+  const db = getDb();
+  const targetType = params.targetType || "document";
+  const noun = targetType === "document" ? "node" : targetType === "folder" ? "folder" : "nest";
+  const existing = await db.get(
+    "SELECT id FROM deletion_requests WHERE nest_id = ? AND node_id = ? AND target_type = ? AND status = 'pending'",
+    [params.nestId, params.nodeId, targetType]
+  );
+  if (existing) {
+    throw new ConflictError(`A deletion request is already pending for this ${noun}`);
+  }
+  const id = uuid3();
+  try {
+    await db.run(
+      `INSERT INTO deletion_requests (id, nest_id, node_id, target_type, requested_by, reason)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        params.nestId,
+        params.nodeId,
+        targetType,
+        params.requestedBy,
+        params.reason
+      ]
+    );
+  } catch (err) {
+    console.error(
+      "[deletion] request insert failed",
+      params.nestId,
+      params.nodeId,
+      err
+    );
+    throw new ConflictError(`A deletion request is already pending for this ${noun}`);
+  }
+  const request = await getDeletionRequest(id);
+  await notifyDeletionRequested(request, params.baseUrl);
+  return request;
+}
+async function getLatestDeletionRequest(nestId, nodeId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT * FROM deletion_requests WHERE nest_id = ? AND node_id = ?
+       ORDER BY created_at DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
+  return row ? rowToDeletionRequest(row) : null;
+}
+async function getDeletionRequest(id) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT * FROM deletion_requests WHERE id = ?",
+    [id]
+  );
+  return row ? rowToDeletionRequest(row) : null;
+}
+async function listDeletionRequests(params) {
+  const db = getDb();
+  const status = params.status || "pending";
+  const where = [];
+  const args = [];
+  if (params.nestId) {
+    where.push("nest_id = ?");
+    args.push(params.nestId);
+  }
+  if (params.nestIds) {
+    if (params.nestIds.length === 0) return [];
+    where.push(`nest_id IN (${params.nestIds.map(() => "?").join(",")})`);
+    args.push(...params.nestIds);
+  }
+  if (status !== "all") {
+    where.push("status = ?");
+    args.push(status);
+  }
+  const rows = await db.all(
+    `SELECT * FROM deletion_requests${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY created_at DESC`,
+    args
+  );
+  if (rows.length === 0) return [];
+  const titlesByNest = /* @__PURE__ */ new Map();
+  for (const nid of new Set(rows.map((r) => r.nest_id))) {
+    titlesByNest.set(nid, await buildTitleMap(nid));
+  }
+  const out = [];
+  for (const r of rows) {
+    const request = rowToDeletionRequest(r);
+    out.push({
+      ...request,
+      title: await deletionTargetTitle(request, titlesByNest.get(r.nest_id))
+    });
+  }
+  return out;
+}
+async function dropDeletionRequest(id) {
+  await getDb().run("DELETE FROM deletion_requests WHERE id = ?", [id]);
+}
+async function declineDeletion(params) {
+  const db = getDb();
+  const pending = await getDeletionRequest(params.id);
+  if (!pending || pending.nestId !== params.nestId || pending.status !== "pending") {
+    return null;
+  }
+  const { changes } = await db.run(
+    `UPDATE deletion_requests
+       SET status = 'declined', resolved_by = ?, resolved_at = ${nowExpr(db)},
+           resolution_note = ?
+     WHERE id = ? AND status = 'pending'`,
+    [params.declinedBy, params.note, params.id]
+  );
+  if (changes === 0) return null;
+  const declined = await getDeletionRequest(params.id);
+  if (declined) {
+    await notifyDeletionResolved({
+      nestId: params.nestId,
+      nodeId: declined.nodeId,
+      docTitle: await deletionTargetTitle(declined),
+      outcome: "declined",
+      requestedBy: declined.requestedBy,
+      resolvedBy: params.declinedBy,
+      requestId: declined.id,
+      note: params.note,
+      baseUrl: params.baseUrl
+    });
+  }
+  return declined;
+}
+function rowToDeletionRequest(row) {
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    targetType: row.target_type || "document",
+    requestedBy: row.requested_by,
+    reason: row.reason,
+    status: row.status,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by || void 0,
+    resolvedAt: row.resolved_at || void 0,
+    resolutionNote: row.resolution_note || void 0
+  };
+}
 async function getReviewRequest(id) {
   const db = getDb();
   const row = await db.get(
@@ -1275,6 +1583,7 @@ function rowToReviewRequest(row) {
 
 export {
   safePublishDocument,
+  serializeNodeSafe,
   stripUndefinedDeep,
   listWatchers,
   addWatcher,
@@ -1306,5 +1615,13 @@ export {
   cancelReview,
   getReviewQueue,
   getReviewHistory,
-  getPendingReview
+  getPendingReview,
+  deletionTargetTitle,
+  notifyDeletionResolved,
+  requestDeletion,
+  getLatestDeletionRequest,
+  getDeletionRequest,
+  listDeletionRequests,
+  dropDeletionRequest,
+  declineDeletion
 };