@promptowl/contextnest-community 1.15.0 → 1.16.1

package/CONFIGURATION.md

@@ -73,6 +73,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
+| `FRAME_ANCESTORS` | `'self'` | Which origins may embed this server in an iframe, sent as CSP `frame-ancestors`. The default lets nothing but this origin frame the UI, which blocks clickjacking. Deployments that are meant to be embedded list the embedding origin — e.g. the PromptOwl Data Room iframes ContextNest, so that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`. Comma-separated; `'self'` is always included; `*` allows any site and disables the protection. Note the embedding page must be **same-site** (a sibling subdomain) for the session cookie to survive inside the frame — a genuinely cross-domain embed will render the login page no matter what this is set to. |
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below. |
 | `VIDEO_MAX_MB` | `30` | Max size (in MB) of a video uploaded into a doc. Default `30` keeps it under Cloud Run's ~32 MiB HTTP/1 request-body limit, so an oversized video is rejected with a clear message instead of a bare `413` from the platform. Raise only where the deployment can actually accept larger request bodies (not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload). Images are fixed at 10 MB. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |

package/dist/{chunk-GWDOLYFJ.js → chunk-CLKZZZS2.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-L7UCMGWZ.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-JWVZ3T35.js → chunk-D6HICFVW.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-L7UCMGWZ.js";
 import {
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -100,6 +100,15 @@ async function getCurrentVersion(nestId, nodeId) {
   );
   return row?.v || 0;
 }
+async function getTrackedNodeIds(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT DISTINCT node_id FROM node_versions
+        WHERE nest_id = ? AND author NOT LIKE ?`,
+    [nestId, `${SYSTEM_AUTHOR_PREFIX}%`]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
 async function getApprovedVersion(nestId, nodeId) {
   const db = getDb();
   const row = await db.get(
@@ -108,6 +117,14 @@ async function getApprovedVersion(nestId, nodeId) {
   );
   return row?.approved_version ?? null;
 }
+async function getApprovedVersions(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Map(rows.map((r) => [r.node_id, r.approved_version]));
+}
 async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   const db = getDb();
   const sql = insertOrReplace(
@@ -262,7 +279,9 @@ export {
   getVersions,
   getVersion,
   getCurrentVersion,
+  getTrackedNodeIds,
   getApprovedVersion,
+  getApprovedVersions,
   setApprovedVersion,
   checkConflict,
   getNodeTags,

package/dist/{chunk-BCFKLY4H.js → chunk-JMJLNEXE.js}

@@ -512,6 +512,30 @@ var config = {
     if ((process.env.AUTH_MODE || "key") === "open") return "*";
     return ["http://localhost:5173", "http://localhost:3838"];
   },
+  /**
+   * Who may frame this server, as a CSP `frame-ancestors` source list.
+   *
+   * Defaults to `'self'`: no other site can embed the UI, which is what stops
+   * a hostile page from framing it invisibly and stealing clicks from a
+   * signed-in operator. Deployments that are *meant* to be embedded name the
+   * embedding origin — e.g. the PromptOwl Data Room iframes this server, so
+   * that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`.
+   *
+   * Comma-separated; `'self'` is always included. `*` allows any site to frame
+   * this server and disables the protection.
+   *
+   * Note we deliberately do NOT also send `X-Frame-Options` — it only
+   * understands "same origin", so it would block a sibling subdomain that
+   * `frame-ancestors` is configured to allow. Every browser that matters
+   * honours `frame-ancestors`, and it wins where both are present.
+   */
+  get FRAME_ANCESTORS() {
+    const raw = process.env.FRAME_ANCESTORS?.trim();
+    if (!raw) return "'self'";
+    if (raw === "*") return "*";
+    const sources = raw.split(",").map((s) => s.trim()).filter(Boolean);
+    return [.../* @__PURE__ */ new Set(["'self'", ...sources])].join(" ");
+  },
   /**
    * Max JSON body size in bytes. Prevents DoS via giant payloads.
    * Default: 10 MB. Override via MAX_BODY_BYTES env.

package/dist/{chunk-7BOG3S5H.js → chunk-L7UCMGWZ.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
@@ -600,7 +600,7 @@ var STATUS_META = {
   },
   deletion_declined: {
     subjectWord: "kept",
-    label: "Deletion declined",
+    label: "Deletion rejected",
     color: "#d97706"
   },
   deletion_deleted: {
@@ -683,16 +683,16 @@ var TEMPLATES = {
     heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
     detailsHeader: "Document details",
     linkLabel: "Review the request",
-    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or decline the request from the nest.`,
-    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or decline the request from the nest.`,
+    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or reject the request from the nest.`,
+    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or reject the request from the nest.`,
     rows: governanceRows
   },
   deletion_declined: {
-    heading: (x) => `Your deletion request for ${x.title} was declined`,
+    heading: (x) => `Your deletion request for ${x.title} was rejected`,
     detailsHeader: "Document details",
     linkLabel: "Open document",
-    lineT: (x) => `Your request to delete ${x.title} was declined${x.byT}${x.noteT}. The document stays.`,
-    lineH: (x) => `Your request to delete ${x.doc} was declined${x.byH}${x.noteH}. The document stays.`,
+    lineT: (x) => `Your request to delete ${x.title} was rejected${x.byT}${x.noteT}. The document stays.`,
+    lineH: (x) => `Your request to delete ${x.doc} was rejected${x.byH}${x.noteH}. The document stays.`,
     rows: governanceRows
   },
   deletion_deleted: {
@@ -973,74 +973,17 @@ async function sendEmailToRecipient(to, details) {
 }
 
 // src/nests/service.ts
-import { rmSync as rmSync2, mkdirSync } from "fs";
+import { mkdirSync } from "fs";
 import { v4 as uuid2 } from "uuid";
 import { NestStorage as NestStorage3 } from "@promptowl/contextnest-engine";
 
-// src/fs/vault-import.ts
-import { rmSync } from "fs";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join2, dirname, isAbsolute } from "path";
-function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
-}
-var ALLOWED_DOT_DIRS = /* @__PURE__ */ new Set([".versions", ".context"]);
-function safeSegments(rel) {
-  if (!rel || isAbsolute(rel)) return null;
-  const segs = rel.split(/[\\/]/).filter(Boolean);
-  if (!segs.length) return null;
-  for (const s of segs) {
-    if (s === "..") return null;
-    if (!ALLOWED_DOT_DIRS.has(s) && isSkippedSegment(s)) return null;
-  }
-  return segs;
-}
-var WRITE_CONCURRENCY = 32;
-async function writeImportedFiles(dest, files) {
-  const targets = [];
-  const skipped = [];
-  for (const f of files) {
-    const segs = safeSegments(f?.path || "");
-    if (!segs) {
-      skipped.push(f?.path || "(empty)");
-      continue;
-    }
-    targets.push({ full: join2(dest, ...segs), content: f.content ?? "" });
-  }
-  const dirs = new Set(targets.map((t) => dirname(t.full)));
-  await Promise.all([...dirs].map((d) => mkdir(d, { recursive: true })));
-  let written = 0;
-  for (let i = 0; i < targets.length; i += WRITE_CONCURRENCY) {
-    const batch = targets.slice(i, i + WRITE_CONCURRENCY);
-    await Promise.all(
-      batch.map(async (t) => {
-        await writeFile(t.full, t.content, "utf-8");
-        written++;
-      })
-    );
-  }
-  console.log(
-    `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
-  );
-  if (skipped.length) {
-    console.log("[import] skipped (unsafe/hidden path):", skipped.join(", "));
-  }
-  return written;
-}
-function discardImportDir(dest) {
-  try {
-    rmSync(dest, { recursive: true, force: true });
-  } catch {
-  }
-}
-
 // src/shared/paths.ts
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 function nestStorageRoot() {
   return config.NEST_STORAGE_ROOT;
 }
 function resolveNestPath(nestId) {
-  return join3(nestStorageRoot(), nestId);
+  return join2(nestStorageRoot(), nestId);
 }
 
 // src/governance/teams-service.ts
@@ -1052,11 +995,29 @@ import {
   GraphQueryEngine,
   VersionManager
 } from "@promptowl/contextnest-engine";
+import { createEngineApi } from "@promptowl/contextnest-engine/api";
 
 // src/nodes/flat-storage.ts
-import { readdirSync } from "fs";
-import { join as join4, relative, sep } from "path";
+import { readdir } from "fs/promises";
+import { join as join3, relative, sep } from "path";
 import { NestStorage } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
+}
+
+// src/shared/batch.ts
+var IO_CONCURRENCY = 32;
+async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
+  const out = [];
+  for (let i = 0; i < items.length; i += concurrency) {
+    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
+  }
+  return out;
+}
+
+// src/nodes/flat-storage.ts
 var META_FILES = /* @__PURE__ */ new Set([
   "INDEX.md",
   "CONTEXT.md",
@@ -1070,7 +1031,7 @@ var FlatNestStorage = class extends NestStorage {
     const root = this.root;
     let entries;
     try {
-      entries = readdirSync(root, { recursive: true, withFileTypes: true });
+      entries = await readdir(root, { recursive: true, withFileTypes: true });
     } catch (err) {
       console.error("[FlatNestStorage] cannot read folder", root, err);
       return [];
@@ -1080,33 +1041,72 @@ var FlatNestStorage = class extends NestStorage {
       if (!e.isFile() || !e.name.endsWith(".md")) continue;
       if (META_FILES.has(e.name)) continue;
       const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
+      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
       if (rel.split("/").some(isSkippedSegment)) continue;
       ids.push(rel.replace(/\.md$/, ""));
     }
-    const nodes = [];
-    for (const id of ids.sort()) {
+    ids.sort();
+    const read = await mapBatched(ids, async (id) => {
       try {
-        nodes.push(await this.readDocument(id));
+        return await this.readDocument(id);
       } catch (err) {
         console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+        return null;
       }
-    }
-    return nodes;
+    });
+    return read.filter((n) => n !== null);
   }
 };
 
 // src/nodes/engine.ts
+var DISCOVERY_TTL_MS = 3e4;
+var DOCUMENT_WRITERS = [
+  "writeDocument",
+  "deleteDocument",
+  "writeVaultFile",
+  "init"
+];
+function withDiscoveryCache(storage) {
+  const entries = /* @__PURE__ */ new Map();
+  const discover = storage.discoverDocuments.bind(storage);
+  let generation = 0;
+  storage.discoverDocuments = async (options = {}) => {
+    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
+    const hit = entries.get(key);
+    if (hit && Date.now() - hit.ts < DISCOVERY_TTL_MS) return hit.docs;
+    const startedAt = generation;
+    const docs = await discover(options);
+    if (generation === startedAt) entries.set(key, { docs, ts: Date.now() });
+    return docs;
+  };
+  const invalidate = () => {
+    generation++;
+    entries.clear();
+  };
+  for (const name of DOCUMENT_WRITERS) {
+    const write = storage[name].bind(storage);
+    storage[name] = async (...args) => {
+      try {
+        return await write(...args);
+      } finally {
+        invalidate();
+      }
+    };
+  }
+  return { storage, invalidate };
+}
 var NestEngineCache = class {
   cache = /* @__PURE__ */ new Map();
   async get(nestId) {
     let engine = this.cache.get(nestId);
     if (!engine) {
       const nestPath = resolveNestPath(nestId);
-      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath);
+      const { storage, invalidate } = withDiscoveryCache(
+        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath)
+      );
       const query = new GraphQueryEngine(storage);
       const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
+      engine = { storage, query, versions, invalidateDiscovery: invalidate };
       this.cache.set(nestId, engine);
     }
     return engine;
@@ -1116,6 +1116,11 @@ var NestEngineCache = class {
   }
 };
 var engineCache = new NestEngineCache();
+var engineApi = createEngineApi();
+async function opContext(nestId, actor, onProgress) {
+  const { storage, query, versions } = await engineCache.get(nestId);
+  return { storage, query, versions, actor, onProgress };
+}
 
 // src/governance/title-resolver.ts
 async function buildTitleMap(nestId) {
@@ -1775,6 +1780,7 @@ async function removeNodeFromTagIndex(nestId, nodeId) {
 }
 
 // src/nests/service.ts
+import { rm } from "fs/promises";
 async function isImportedNest(nestId) {
   const row = await getDb().get(
     "SELECT is_imported FROM nests WHERE id = ?",
@@ -1954,27 +1960,16 @@ async function createNest(userId, name, description) {
   trackEvent("nest.create", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function importNest(userId, name, files) {
+async function importNest(userId, name) {
   const nm = (name || "").trim();
   if (!nm) {
     throw new ValidationError("name is required");
   }
-  if (!Array.isArray(files)) {
-    throw new ValidationError("files are required");
-  }
   const db = getDb();
   const id = uuid2();
   const slug = toSlug(nm);
   const visibility = userId === ANON_USER_ID ? "public" : "private";
-  const dest = resolveNestPath(id);
-  mkdirSync(dest, { recursive: true });
-  try {
-    await writeImportedFiles(dest, files);
-  } catch (err) {
-    console.error("[nests] import write failed", dest, err);
-    discardImportDir(dest);
-    throw new ValidationError("Failed to import folder");
-  }
+  mkdirSync(resolveNestPath(id), { recursive: true });
   await db.run(
     "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)",
     [id, userId, nm, slug, null, visibility]
@@ -2138,7 +2133,7 @@ async function deleteNest(nestId) {
   });
   const path = resolveNestPath(nestId);
   try {
-    rmSync2(path, { recursive: true, force: true });
+    await rm(path, { recursive: true, force: true });
   } catch (err) {
     console.warn(`[nests] failed to remove nest directory ${path}:`, err);
   }
@@ -2194,6 +2189,8 @@ export {
   getNest,
   deleteNest,
   engineCache,
+  engineApi,
+  opContext,
   buildTitleMap,
   folderForNode,
   describeNode,

package/dist/{chunk-5IAKUUZF.js → chunk-OTGZQZKK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-C4U75IUR.js → chunk-QJVRZT6M.js}

@@ -2,22 +2,24 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-5IAKUUZF.js";
+} from "./chunk-OTGZQZKK.js";
 import {
   createVersion,
   getApprovedVersion,
+  getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-JWVZ3T35.js";
+} from "./chunk-D6HICFVW.js";
 import {
   canUserAccess,
   canUserApprove,
   resolveStewardsForNode
-} from "./chunk-GWDOLYFJ.js";
+} from "./chunk-CLKZZZS2.js";
 import {
   buildDocContext,
   buildTitleMap,
   describeNode,
+  engineApi,
   engineCache,
   insertOrReplace,
   isPublicReader,
@@ -25,10 +27,11 @@ import {
   nestName,
   notifyEmailForNest,
   nowExpr,
+  opContext,
   prettyFolderPath,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-L7UCMGWZ.js";
 import {
   ConflictError,
   NotFoundError,
@@ -37,7 +40,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -222,15 +225,10 @@ async function canReadNode(nestId, nodeId, userId, userEmail) {
   if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
   return await resolveNodeGrant(nestId, userId, nodeId) !== null;
 }
-async function filterAccessible(nestId, userId, userEmail, nodes) {
+async function filterAccessible(nestId, userId, userEmail, nodes, approvedVersions) {
   if (await isPublicReader(nestId, userId)) {
-    const filtered = [];
-    for (const n of nodes) {
-      if (await getApprovedVersion(nestId, n.id) !== null) {
-        filtered.push(n);
-      }
-    }
-    return filtered;
+    const approved = approvedVersions ?? await getApprovedVersions(nestId);
+    return nodes.filter((n) => approved.has(n.id));
   }
   if (!await isStewardshipEnabled(nestId)) return nodes;
   const grants = await listUserGrants(nestId, userId);
@@ -834,39 +832,6 @@ function withNodeWriteLock(key, fn) {
   return run;
 }
 
-// src/governance/safe-publish.ts
-import {
-  publishDocument,
-  serializeDocument
-} from "@promptowl/contextnest-engine";
-async function safePublishDocument(storage, docId, options) {
-  const node = await storage.readDocument(docId);
-  const cleanedFrontmatter = stripUndefinedDeep(node.frontmatter);
-  const cleanedNode = { ...node, frontmatter: cleanedFrontmatter };
-  await storage.writeDocument(docId, serializeDocument(cleanedNode));
-  return publishDocument(storage, docId, options);
-}
-function serializeNodeSafe(node) {
-  return serializeDocument({
-    ...node,
-    frontmatter: stripUndefinedDeep(node.frontmatter)
-  });
-}
-function stripUndefinedDeep(value) {
-  if (Array.isArray(value)) {
-    return value.filter((v) => v !== void 0).map((v) => stripUndefinedDeep(v));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      if (v === void 0) continue;
-      out[k] = stripUndefinedDeep(v);
-    }
-    return out;
-  }
-  return value;
-}
-
 // src/governance/review-service.ts
 async function submitForReview(params) {
   const db = getDb();
@@ -1032,13 +997,14 @@ async function approve(params) {
     );
     try {
       const { storage } = await engineCache.get(params.nestId);
-      const result = await safePublishDocument(storage, params.nodeId, {
-        editedBy: params.approvedBy,
-        note: params.note || `Approved review request ${pending.id}`
-      });
-      const engineVersion = result.versionEntry.version;
+      const note = params.note || `Approved review request ${pending.id}`;
+      const { version: engineVersion } = await engineApi.run(
+        "context_publish",
+        { id: params.nodeId, note },
+        await opContext(params.nestId, params.approvedBy)
+      );
       if (engineVersion !== version) {
-        const node = result.node;
+        const node = await storage.readDocument(params.nodeId);
         const tags = node.frontmatter.tags || [];
         await createVersion({
           nestId: params.nestId,
@@ -1048,7 +1014,7 @@ async function approve(params) {
           author: params.approvedBy,
           status: "published",
           tags,
-          changeNote: params.note || `Approved review request ${pending.id}`
+          changeNote: note
         });
         await setApprovedVersion(
           params.nestId,
@@ -1369,7 +1335,7 @@ async function notifyDeletionRequested(request, baseUrl) {
 async function notifyDeletionResolved(params) {
   try {
     const { outcome, resolvedBy, note } = params;
-    const verb = outcome === "deleted" ? "deleted" : "declined the deletion of";
+    const verb = outcome === "deleted" ? "deleted" : "rejected the deletion of";
     const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
     const recipient = params.requestedBy.toLowerCase();
     const canInbox = !(params.targetType === "nest" && outcome === "deleted");
@@ -1379,7 +1345,7 @@ async function notifyDeletionResolved(params) {
         [recipient],
         `deletion_${outcome}`,
         params.requestId,
-        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was declined by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
       );
     }
     void dispatchEvent({
@@ -1582,9 +1548,6 @@ function rowToReviewRequest(row) {
 }
 
 export {
-  safePublishDocument,
-  serializeNodeSafe,
-  stripUndefinedDeep,
   listWatchers,
   addWatcher,
   removeWatcher,

package/dist/{client-NFUHPLLM.js → client-OBS5HOTA.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";
 export {
   getDb,

package/dist/{grants-service-O4AO326A.js → grants-service-I535QVTW.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-5IAKUUZF.js";
+} from "./chunk-OTGZQZKK.js";
 import "./chunk-GUNJTORH.js";
-import "./chunk-BCFKLY4H.js";
+import "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";
 export {
   createGrant,