@promptowl/contextnest-community 1.14.0 → 1.16.1

package/dist/{chunk-JP67WXLA.js → chunk-D6HICFVW.js}

@@ -1,10 +1,11 @@
 import {
+  buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-XQ46F76G.js";
+} from "./chunk-L7UCMGWZ.js";
 import {
   getDb
-} from "./chunk-I5KYGMIT.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -99,6 +100,15 @@ async function getCurrentVersion(nestId, nodeId) {
   );
   return row?.v || 0;
 }
+async function getTrackedNodeIds(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT DISTINCT node_id FROM node_versions
+        WHERE nest_id = ? AND author NOT LIKE ?`,
+    [nestId, `${SYSTEM_AUTHOR_PREFIX}%`]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
 async function getApprovedVersion(nestId, nodeId) {
   const db = getDb();
   const row = await db.get(
@@ -107,6 +117,14 @@ async function getApprovedVersion(nestId, nodeId) {
   );
   return row?.approved_version ?? null;
 }
+async function getApprovedVersions(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Map(rows.map((r) => [r.node_id, r.approved_version]));
+}
 async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   const db = getDb();
   const sql = insertOrReplace(
@@ -187,6 +205,59 @@ async function getDisplayStatus(nestId, nodeId) {
   if (current.status === "rejected") return "rejected";
   return "draft";
 }
+async function listMyDrafts(params) {
+  if (params.nestIds.length === 0) return { drafts: [], total: 0 };
+  const db = getDb();
+  const nestPlaceholders = params.nestIds.map(() => "?").join(",");
+  const where = `
+      WHERE v.author = ?
+        AND v.status IN ('draft', 'rejected')
+        AND v.nest_id IN (${nestPlaceholders})
+        AND v.version = (
+          SELECT MAX(v2.version) FROM node_versions v2
+           WHERE v2.nest_id = v.nest_id AND v2.node_id = v.node_id)
+        AND NOT EXISTS (
+          SELECT 1 FROM review_requests r
+           WHERE r.nest_id = v.nest_id AND r.node_id = v.node_id
+             AND r.status = 'pending')`;
+  const args = [params.authorEmail.toLowerCase(), ...params.nestIds];
+  const total = Number(
+    (await db.get(
+      `SELECT COUNT(*) as c FROM node_versions v ${where}`,
+      args
+    )).c
+  );
+  const limit = Math.min(Math.max(params.limit ?? 25, 1), 100);
+  const offset = Math.max(params.offset ?? 0, 0);
+  const rows = await db.all(
+    `SELECT v.nest_id, v.node_id, v.status, v.version, v.created_at
+       FROM node_versions v ${where}
+      ORDER BY v.created_at DESC
+      LIMIT ? OFFSET ?`,
+    [...args, limit, offset]
+  );
+  const titlesByNest = new Map(
+    await Promise.all(
+      [...new Set(rows.map((r) => r.nest_id))].map(
+        async (nestId) => [
+          nestId,
+          await buildTitleMap(nestId)
+        ]
+      )
+    )
+  );
+  const drafts = rows.filter((r) => titlesByNest.get(r.nest_id)?.has(r.node_id)).map((r) => ({
+    nestId: r.nest_id,
+    nodeId: r.node_id,
+    title: titlesByNest.get(r.nest_id).get(r.node_id) || r.node_id,
+    status: r.status,
+    // Number(): Postgres returns INTEGER columns fine, but stay explicit —
+    // the modal renders this straight into copy.
+    version: Number(r.version),
+    updatedAt: r.created_at
+  }));
+  return { drafts, total };
+}
 function rowToVersion(row) {
   return {
     version: row.version,
@@ -208,9 +279,12 @@ export {
   getVersions,
   getVersion,
   getCurrentVersion,
+  getTrackedNodeIds,
   getApprovedVersion,
+  getApprovedVersions,
   setApprovedVersion,
   checkConflict,
   getNodeTags,
-  getDisplayStatus
+  getDisplayStatus,
+  listMyDrafts
 };

package/dist/{chunk-I5KYGMIT.js → chunk-JMJLNEXE.js}

@@ -512,6 +512,30 @@ var config = {
     if ((process.env.AUTH_MODE || "key") === "open") return "*";
     return ["http://localhost:5173", "http://localhost:3838"];
   },
+  /**
+   * Who may frame this server, as a CSP `frame-ancestors` source list.
+   *
+   * Defaults to `'self'`: no other site can embed the UI, which is what stops
+   * a hostile page from framing it invisibly and stealing clicks from a
+   * signed-in operator. Deployments that are *meant* to be embedded name the
+   * embedding origin — e.g. the PromptOwl Data Room iframes this server, so
+   * that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`.
+   *
+   * Comma-separated; `'self'` is always included. `*` allows any site to frame
+   * this server and disables the protection.
+   *
+   * Note we deliberately do NOT also send `X-Frame-Options` — it only
+   * understands "same origin", so it would block a sibling subdomain that
+   * `frame-ancestors` is configured to allow. Every browser that matters
+   * honours `frame-ancestors`, and it wins where both are present.
+   */
+  get FRAME_ANCESTORS() {
+    const raw = process.env.FRAME_ANCESTORS?.trim();
+    if (!raw) return "'self'";
+    if (raw === "*") return "*";
+    const sources = raw.split(",").map((s) => s.trim()).filter(Boolean);
+    return [.../* @__PURE__ */ new Set(["'self'", ...sources])].join(" ");
+  },
   /**
    * Max JSON body size in bytes. Prevents DoS via giant payloads.
    * Default: 10 MB. Override via MAX_BODY_BYTES env.
@@ -711,6 +735,12 @@ function runMigrations(db) {
   if (!nestCols.includes("allow_self_approve")) {
     db.exec("ALTER TABLE nests ADD COLUMN allow_self_approve INTEGER NOT NULL DEFAULT 0");
   }
+  if (!nestCols.includes("prime_only_review")) {
+    db.exec("ALTER TABLE nests ADD COLUMN prime_only_review INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("prime_tags")) {
+    db.exec("ALTER TABLE nests ADD COLUMN prime_tags TEXT NOT NULL DEFAULT 'prime-document'");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1454,6 +1484,53 @@ function runMigrations(db) {
     })();
     recordMigration("031_team_source");
   }
+  if (!hasMigration("032_deletion_requests")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS deletion_requests (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          requested_by TEXT NOT NULL,      -- email
+          reason TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'pending'
+            CHECK(status IN ('pending', 'declined')),
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          resolved_by TEXT,                -- email
+          resolved_at TEXT,
+          resolution_note TEXT
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deletion_requests_pending
+          ON deletion_requests(nest_id, node_id) WHERE status = 'pending';
+        CREATE INDEX IF NOT EXISTS idx_deletion_requests_nest
+          ON deletion_requests(nest_id, status);
+      `);
+    })();
+    recordMigration("032_deletion_requests");
+  }
+  if (!hasMigration("033_deletion_request_targets")) {
+    db.transaction(() => {
+      const cols = db.prepare("PRAGMA table_info(deletion_requests)").all().map((c) => c.name);
+      if (!cols.includes("target_type")) {
+        db.exec(
+          "ALTER TABLE deletion_requests ADD COLUMN target_type TEXT NOT NULL DEFAULT 'document'"
+        );
+      }
+      db.exec(`
+        DROP INDEX IF EXISTS idx_deletion_requests_pending;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deletion_requests_pending
+          ON deletion_requests(nest_id, target_type, node_id) WHERE status = 'pending';
+      `);
+    })();
+    recordMigration("033_deletion_request_targets");
+  }
+  if (!hasMigration("034_versions_author_status_index")) {
+    db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_versions_author_status
+        ON node_versions(author, status);
+    `);
+    recordMigration("034_versions_author_status_index");
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1671,7 +1748,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-BRXZY2GE.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-CYKO5CFV.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);