@promptowl/contextnest-community 1.15.0 → 1.17.0

package/README.md

@@ -1,169 +1,164 @@
-# ContextNest Community Edition
-
-**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
-
-> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
-
----
-
-## What it is
-
-ContextNest Community Edition is a self-hosted server that lets you:
-
-- Store, version, and govern markdown-based context documents ("nests")
-- Import an existing folder or vault of markdown files in one step
-- Export a nest as a portable bundle and re-import it on another self-hosted host
-- Apply stewardship workflows — draft, pending review, approved
-- Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP, HTTP, or CLI
-- Sync with the PromptOwl hosted platform for multi-user collaboration
-
-The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
-
-## Quickstart
-
-```bash
-# 1. Run the community server
-npx @promptowl/contextnest-community
-
-# 2. Open the server in your browser
-#    http://localhost:3838
-#    On first boot with no license, it lands on the License Setup Page.
-
-# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
-```
-
-The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
-
-> **Optional:** scaffold a local nest with the open-source CLI before connecting:
-> ```bash
-> npx @promptowl/contextnest-cli init
-> ```
-
-## License setup
-
-ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
-
-### 1. Create the key (free)
-
-1. Sign up or log in at <https://app.promptowl.ai>
-2. Open the **Overview** menu → **Community License**
-3. Click **Create a Community License key**
-4. Copy the generated key — it starts with `pk_`
-
-### 2. Activate the server
-
-Pick **one** of two ways:
-
-**A. Browser setup page (recommended for first run)**
-
-1. Start the server: `npx @promptowl/contextnest-community`
-2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
-3. Paste your `pk_...` key and submit
-4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
-
-**B. Environment variable (recommended for Docker / CI / scripted deploys)**
-
-```bash
-PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
-```
-
-The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
-
-### 3. How licensing behaves at runtime
-
-- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
-- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
-- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
-
-For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
-
-## System requirements
-
-- **Node.js** 20.x or later
-- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
-- **OS:** Windows, macOS, or Linux
-- **Disk:** ~200 MB for the server, plus storage for your nests
-
-## What you get
-
-| Feature | Community Edition | Enterprise |
-|---|:---:|:---:|
-| Self-hosted context server | ✅ | ✅ |
-| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
-| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
-| Markdown + YAML frontmatter vaults | ✅ | ✅ |
-| Import existing folder / vault | ✅ | ✅ |
-| Export nest as portable bundle (.zip) | ✅ | ✅ |
-| Markdown rendering + wiki cross-linking | ✅ | ✅ |
-| External-edit detection + version diff | ✅ | ✅ |
-| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
-| Per-nest sharing + collaborators | ✅ | ✅ |
-| Public read-only nests | ✅ | ✅ |
-| Custom logo / branding | ✅ | ✅ |
-| Admin password reset + user removal (in-platform) | ✅ | ✅ |
-| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
-| Steward version revert | ✅ | ✅ |
-| MCP server for AI agents | ✅ | ✅ |
-| Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
-| SAML / SCIM provisioning | — | ✅ |
-| Audit log streaming | — | ✅ |
-| Policy transforms (redaction, summarization) | — | ✅ |
-| Priority support and SLA | — | ✅ |
-
-For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
-
-## What's new
-
-Release notes live in [CHANGELOG.md](./CHANGELOG.md).
-
-## Licensing
-
-ContextNest Community Edition is **commercial software**. It is **not open source**.
-
-**You may:**
-- Install and run the Software on devices You own or control
-- Use the Software for internal business purposes, tied to a valid PromptOwl account
-- Make backup and archival copies
-
-**You may not:**
-- Redistribute, resell, rent, lease, or sublicense the Software
-- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
-- Reverse engineer, decompile, or create derivative works
-- Use the Software to build a competing product or service
-- Remove copyright, trademark, or license notices
-
-Full license text: [LICENSE.md](./LICENSE.md)
-
-**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
-
-## Platform terms
-
-Because the Software requires a PromptOwl account, the following terms also apply to Your use:
-
-- **End User License Agreement** — <https://promptowl.ai/eula/>
-- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
-- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
-- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
-- **Disclaimer** — <https://promptowl.ai/disclaimer/>
-- **Cookie Policy** — <https://promptowl.ai/cookies/>
-
-## Support
-
-- **Documentation:** <https://promptowl.ai/contextnest/>
-- **Product questions:** <https://promptowl.ai/contact-us/>
-- **Support & bugs:** `hoot@promptowl.ai`
-- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
-
-## AI output disclaimer
-
-The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
-
----
-
-**Copyright © 2026 Promptowl LLC.** All rights reserved.
-"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
-
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+# ContextNest Community Edition
+
+**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
+
+> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
+
+---
+
+## What it is
+
+ContextNest Community Edition is a self-hosted server that lets you:
+
+- Store, version, and govern markdown-based context documents ("nests")
+- Import an existing folder or vault of markdown files in one step
+- Export a nest as a portable bundle and re-import it on another self-hosted host
+- Apply stewardship workflows — draft, pending review, approved
+- Share nests with collaborators or publish them read-only to the public
+- Serve approved context to AI agents via MCP or HTTP
+- Sync with the PromptOwl hosted platform for multi-user collaboration
+
+The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
+
+## Quickstart
+
+```bash
+# 1. Run the community server
+npx @promptowl/contextnest-community
+
+# 2. Open the server in your browser
+#    http://localhost:3838
+#    On first boot with no license, it lands on the License Setup Page.
+
+# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
+```
+
+The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+## License setup
+
+ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
+
+### 1. Create the key (free)
+
+1. Sign up or log in at <https://app.promptowl.ai>
+2. Open the **Overview** menu → **Community License**
+3. Click **Create a Community License key**
+4. Copy the generated key — it starts with `pk_`
+
+### 2. Activate the server
+
+Pick **one** of two ways:
+
+**A. Browser setup page (recommended for first run)**
+
+1. Start the server: `npx @promptowl/contextnest-community`
+2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
+3. Paste your `pk_...` key and submit
+4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
+
+**B. Environment variable (recommended for Docker / CI / scripted deploys)**
+
+```bash
+PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
+```
+
+The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
+
+### 3. How licensing behaves at runtime
+
+- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
+- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
+- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
+
+For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
+
+## System requirements
+
+- **Node.js** 20.x or later
+- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
+- **OS:** Windows, macOS, or Linux
+- **Disk:** ~200 MB for the server, plus storage for your nests
+
+## What you get
+
+| Feature | Community Edition | Enterprise |
+|---|:---:|:---:|
+| Self-hosted context server | ✅ | ✅ |
+| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
+| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
+| Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Import existing folder / vault | ✅ | ✅ |
+| Export nest as portable bundle (.zip) | ✅ | ✅ |
+| Markdown rendering + wiki cross-linking | ✅ | ✅ |
+| External-edit detection + version diff | ✅ | ✅ |
+| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| Per-nest sharing + collaborators | ✅ | ✅ |
+| Public read-only nests | ✅ | ✅ |
+| Custom logo / branding | ✅ | ✅ |
+| Admin password reset + user removal (in-platform) | ✅ | ✅ |
+| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Steward version revert | ✅ | ✅ |
+| MCP server for AI agents | ✅ | ✅ |
+| Centralized multi-tenant admin console | — | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| SAML / SCIM provisioning | — | ✅ |
+| Audit log streaming | — | ✅ |
+| Policy transforms (redaction, summarization) | — | ✅ |
+| Priority support and SLA | — | ✅ |
+
+For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
+
+## What's new
+
+Release notes live in [CHANGELOG.md](./CHANGELOG.md).
+
+## Licensing
+
+ContextNest Community Edition is **commercial software**. It is **not open source**.
+
+**You may:**
+- Install and run the Software on devices You own or control
+- Use the Software for internal business purposes, tied to a valid PromptOwl account
+- Make backup and archival copies
+
+**You may not:**
+- Redistribute, resell, rent, lease, or sublicense the Software
+- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
+- Reverse engineer, decompile, or create derivative works
+- Use the Software to build a competing product or service
+- Remove copyright, trademark, or license notices
+
+Full license text: [LICENSE.md](./LICENSE.md)
+
+**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
+
+## Platform terms
+
+Because the Software requires a PromptOwl account, the following terms also apply to Your use:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+## Support
+
+- **Documentation:** <https://promptowl.ai/contextnest/>
+- **Product questions:** <https://promptowl.ai/contact-us/>
+- **Support & bugs:** `hoot@promptowl.ai`
+- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
+
+## AI output disclaimer
+
+The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
+
+---
+
+**Copyright © 2026 Promptowl LLC.** All rights reserved.
+"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
+
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-C4U75IUR.js → chunk-4YGJSUJC.js}

@@ -2,22 +2,24 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-5IAKUUZF.js";
+} from "./chunk-HWDPCPYT.js";
 import {
   createVersion,
   getApprovedVersion,
+  getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-JWVZ3T35.js";
+} from "./chunk-UXJSO54R.js";
 import {
   canUserAccess,
   canUserApprove,
   resolveStewardsForNode
-} from "./chunk-GWDOLYFJ.js";
+} from "./chunk-YF4OFT2V.js";
 import {
   buildDocContext,
   buildTitleMap,
   describeNode,
+  engineApi,
   engineCache,
   insertOrReplace,
   isPublicReader,
@@ -25,10 +27,12 @@ import {
   nestName,
   notifyEmailForNest,
   nowExpr,
+  opContext,
   prettyFolderPath,
+  resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   ConflictError,
   NotFoundError,
@@ -37,7 +41,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -222,18 +226,31 @@ async function canReadNode(nestId, nodeId, userId, userEmail) {
   if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
   return await resolveNodeGrant(nestId, userId, nodeId) !== null;
 }
-async function filterAccessible(nestId, userId, userEmail, nodes) {
+async function canRequestDeletion(params) {
+  const { nestId, userId, userEmail, nodeId } = params;
+  const permission = params.permission ?? await resolveNestPermission(nestId, userId);
+  if (permission === "owner" || permission === "admin" || permission === "write") {
+    return true;
+  }
+  const resolved = await resolveStewardsForNode(nestId, nodeId);
+  const isEditorSteward = resolved.some(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && (nodeId !== "" || r.steward.scope === "nest")
+  );
+  if (isEditorSteward) return true;
+  if (nodeId === "") return false;
+  return await resolveNodeGrant(nestId, userId, nodeId) === "write";
+}
+async function filterAccessible(nestId, userId, userEmail, nodes, approvedVersions) {
   if (await isPublicReader(nestId, userId)) {
-    const filtered = [];
-    for (const n of nodes) {
-      if (await getApprovedVersion(nestId, n.id) !== null) {
-        filtered.push(n);
-      }
-    }
-    return filtered;
+    const approved = approvedVersions ?? await getApprovedVersions(nestId);
+    return nodes.filter((n) => approved.has(n.id));
   }
-  if (!await isStewardshipEnabled(nestId)) return nodes;
   const grants = await listUserGrants(nestId, userId);
+  if (!await isStewardshipEnabled(nestId)) {
+    if (grants.length === 0) return nodes;
+    if (await resolveNestPermission(nestId, userId) !== "none") return nodes;
+    return nodes.filter((n) => grantCoversNode(grants, n.id));
+  }
   const accessible = [];
   for (const n of nodes) {
     if ((await canUserAccess(nestId, n.id, userEmail)).allowed || grantCoversNode(grants, n.id)) {
@@ -834,39 +851,6 @@ function withNodeWriteLock(key, fn) {
   return run;
 }
 
-// src/governance/safe-publish.ts
-import {
-  publishDocument,
-  serializeDocument
-} from "@promptowl/contextnest-engine";
-async function safePublishDocument(storage, docId, options) {
-  const node = await storage.readDocument(docId);
-  const cleanedFrontmatter = stripUndefinedDeep(node.frontmatter);
-  const cleanedNode = { ...node, frontmatter: cleanedFrontmatter };
-  await storage.writeDocument(docId, serializeDocument(cleanedNode));
-  return publishDocument(storage, docId, options);
-}
-function serializeNodeSafe(node) {
-  return serializeDocument({
-    ...node,
-    frontmatter: stripUndefinedDeep(node.frontmatter)
-  });
-}
-function stripUndefinedDeep(value) {
-  if (Array.isArray(value)) {
-    return value.filter((v) => v !== void 0).map((v) => stripUndefinedDeep(v));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      if (v === void 0) continue;
-      out[k] = stripUndefinedDeep(v);
-    }
-    return out;
-  }
-  return value;
-}
-
 // src/governance/review-service.ts
 async function submitForReview(params) {
   const db = getDb();
@@ -1032,13 +1016,14 @@ async function approve(params) {
     );
     try {
       const { storage } = await engineCache.get(params.nestId);
-      const result = await safePublishDocument(storage, params.nodeId, {
-        editedBy: params.approvedBy,
-        note: params.note || `Approved review request ${pending.id}`
-      });
-      const engineVersion = result.versionEntry.version;
+      const note = params.note || `Approved review request ${pending.id}`;
+      const { version: engineVersion } = await engineApi.run(
+        "context_publish",
+        { id: params.nodeId, note },
+        await opContext(params.nestId, params.approvedBy)
+      );
       if (engineVersion !== version) {
-        const node = result.node;
+        const node = await storage.readDocument(params.nodeId);
         const tags = node.frontmatter.tags || [];
         await createVersion({
           nestId: params.nestId,
@@ -1048,7 +1033,7 @@ async function approve(params) {
           author: params.approvedBy,
           status: "published",
           tags,
-          changeNote: params.note || `Approved review request ${pending.id}`
+          changeNote: note
         });
         await setApprovedVersion(
           params.nestId,
@@ -1369,7 +1354,7 @@ async function notifyDeletionRequested(request, baseUrl) {
 async function notifyDeletionResolved(params) {
   try {
     const { outcome, resolvedBy, note } = params;
-    const verb = outcome === "deleted" ? "deleted" : "declined the deletion of";
+    const verb = outcome === "deleted" ? "deleted" : "rejected the deletion of";
     const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
     const recipient = params.requestedBy.toLowerCase();
     const canInbox = !(params.targetType === "nest" && outcome === "deleted");
@@ -1379,7 +1364,7 @@ async function notifyDeletionResolved(params) {
         [recipient],
         `deletion_${outcome}`,
         params.requestId,
-        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was declined by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
       );
     }
     void dispatchEvent({
@@ -1511,6 +1496,15 @@ async function listDeletionRequests(params) {
 async function dropDeletionRequest(id) {
   await getDb().run("DELETE FROM deletion_requests WHERE id = ?", [id]);
 }
+async function withdrawDeletionRequest(params) {
+  const db = getDb();
+  const pending = await getDeletionRequest(params.id);
+  if (!pending || pending.nestId !== params.nestId || pending.status !== "pending" || pending.requestedBy.toLowerCase() !== params.withdrawnBy.toLowerCase()) {
+    return null;
+  }
+  await db.run("DELETE FROM deletion_requests WHERE id = ?", [params.id]);
+  return pending;
+}
 async function declineDeletion(params) {
   const db = getDb();
   const pending = await getDeletionRequest(params.id);
@@ -1582,9 +1576,6 @@ function rowToReviewRequest(row) {
 }
 
 export {
-  safePublishDocument,
-  serializeNodeSafe,
-  stripUndefinedDeep,
   listWatchers,
   addWatcher,
   removeWatcher,
@@ -1593,6 +1584,7 @@ export {
   markNotificationsRead,
   resolveCallerEmail,
   canReadNode,
+  canRequestDeletion,
   filterAccessible,
   safeJson,
   requireWorkflowPlane,
@@ -1623,5 +1615,6 @@ export {
   getDeletionRequest,
   listDeletionRequests,
   dropDeletionRequest,
+  withdrawDeletionRequest,
   declineDeletion
 };

package/dist/{chunk-5IAKUUZF.js → chunk-HWDPCPYT.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";
@@ -22,14 +22,6 @@ async function resolveNodeGrant(nestId, userId, nodeId) {
   }
   return best;
 }
-async function hasAnyGrant(nestId, userId) {
-  if (!userId) return false;
-  const row = await getDb().get(
-    "SELECT 1 AS x FROM grants WHERE nest_id = ? AND user_id = ? LIMIT 1",
-    [nestId, userId]
-  );
-  return !!row;
-}
 async function listUserGrants(nestId, userId) {
   if (!userId) return [];
   return await getDb().all(
@@ -42,6 +34,15 @@ function grantCoversNode(grants, nodeId) {
     (g) => nodeId === g.target || nodeId.startsWith(g.target + "/")
   );
 }
+function grantRoleForNode(grants, nodeId) {
+  let best = null;
+  for (const g of grants) {
+    if (nodeId === g.target || nodeId.startsWith(g.target + "/")) {
+      if (!best || rank(g.role) > rank(best)) best = g.role;
+    }
+  }
+  return best;
+}
 async function createGrant(params) {
   const { nestId, targetType, target, userId, role, grantedBy } = params;
   if (!["document", "folder"].includes(targetType)) {
@@ -94,9 +95,9 @@ async function deleteGrant(nestId, id) {
 
 export {
   resolveNodeGrant,
-  hasAnyGrant,
   listUserGrants,
   grantCoversNode,
+  grantRoleForNode,
   createGrant,
   listGrants,
   deleteGrant

package/dist/{chunk-BCFKLY4H.js → chunk-JMJLNEXE.js}

@@ -512,6 +512,30 @@ var config = {
     if ((process.env.AUTH_MODE || "key") === "open") return "*";
     return ["http://localhost:5173", "http://localhost:3838"];
   },
+  /**
+   * Who may frame this server, as a CSP `frame-ancestors` source list.
+   *
+   * Defaults to `'self'`: no other site can embed the UI, which is what stops
+   * a hostile page from framing it invisibly and stealing clicks from a
+   * signed-in operator. Deployments that are *meant* to be embedded name the
+   * embedding origin — e.g. the PromptOwl Data Room iframes this server, so
+   * that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`.
+   *
+   * Comma-separated; `'self'` is always included. `*` allows any site to frame
+   * this server and disables the protection.
+   *
+   * Note we deliberately do NOT also send `X-Frame-Options` — it only
+   * understands "same origin", so it would block a sibling subdomain that
+   * `frame-ancestors` is configured to allow. Every browser that matters
+   * honours `frame-ancestors`, and it wins where both are present.
+   */
+  get FRAME_ANCESTORS() {
+    const raw = process.env.FRAME_ANCESTORS?.trim();
+    if (!raw) return "'self'";
+    if (raw === "*") return "*";
+    const sources = raw.split(",").map((s) => s.trim()).filter(Boolean);
+    return [.../* @__PURE__ */ new Set(["'self'", ...sources])].join(" ");
+  },
   /**
    * Max JSON body size in bytes. Prevents DoS via giant payloads.
    * Default: 10 MB. Override via MAX_BODY_BYTES env.