@promptowl/contextnest-community 1.15.0 → 1.17.0

package/dist/{chunk-7BOG3S5H.js → chunk-SNFGU5Q7.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
@@ -600,7 +600,7 @@ var STATUS_META = {
   },
   deletion_declined: {
     subjectWord: "kept",
-    label: "Deletion declined",
+    label: "Deletion rejected",
     color: "#d97706"
   },
   deletion_deleted: {
@@ -683,16 +683,16 @@ var TEMPLATES = {
     heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
     detailsHeader: "Document details",
     linkLabel: "Review the request",
-    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or decline the request from the nest.`,
-    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or decline the request from the nest.`,
+    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or reject the request from the nest.`,
+    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or reject the request from the nest.`,
     rows: governanceRows
   },
   deletion_declined: {
-    heading: (x) => `Your deletion request for ${x.title} was declined`,
+    heading: (x) => `Your deletion request for ${x.title} was rejected`,
     detailsHeader: "Document details",
     linkLabel: "Open document",
-    lineT: (x) => `Your request to delete ${x.title} was declined${x.byT}${x.noteT}. The document stays.`,
-    lineH: (x) => `Your request to delete ${x.doc} was declined${x.byH}${x.noteH}. The document stays.`,
+    lineT: (x) => `Your request to delete ${x.title} was rejected${x.byT}${x.noteT}. The document stays.`,
+    lineH: (x) => `Your request to delete ${x.doc} was rejected${x.byH}${x.noteH}. The document stays.`,
     rows: governanceRows
   },
   deletion_deleted: {
@@ -973,74 +973,17 @@ async function sendEmailToRecipient(to, details) {
 }
 
 // src/nests/service.ts
-import { rmSync as rmSync2, mkdirSync } from "fs";
+import { mkdirSync } from "fs";
 import { v4 as uuid2 } from "uuid";
 import { NestStorage as NestStorage3 } from "@promptowl/contextnest-engine";
 
-// src/fs/vault-import.ts
-import { rmSync } from "fs";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join2, dirname, isAbsolute } from "path";
-function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
-}
-var ALLOWED_DOT_DIRS = /* @__PURE__ */ new Set([".versions", ".context"]);
-function safeSegments(rel) {
-  if (!rel || isAbsolute(rel)) return null;
-  const segs = rel.split(/[\\/]/).filter(Boolean);
-  if (!segs.length) return null;
-  for (const s of segs) {
-    if (s === "..") return null;
-    if (!ALLOWED_DOT_DIRS.has(s) && isSkippedSegment(s)) return null;
-  }
-  return segs;
-}
-var WRITE_CONCURRENCY = 32;
-async function writeImportedFiles(dest, files) {
-  const targets = [];
-  const skipped = [];
-  for (const f of files) {
-    const segs = safeSegments(f?.path || "");
-    if (!segs) {
-      skipped.push(f?.path || "(empty)");
-      continue;
-    }
-    targets.push({ full: join2(dest, ...segs), content: f.content ?? "" });
-  }
-  const dirs = new Set(targets.map((t) => dirname(t.full)));
-  await Promise.all([...dirs].map((d) => mkdir(d, { recursive: true })));
-  let written = 0;
-  for (let i = 0; i < targets.length; i += WRITE_CONCURRENCY) {
-    const batch = targets.slice(i, i + WRITE_CONCURRENCY);
-    await Promise.all(
-      batch.map(async (t) => {
-        await writeFile(t.full, t.content, "utf-8");
-        written++;
-      })
-    );
-  }
-  console.log(
-    `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
-  );
-  if (skipped.length) {
-    console.log("[import] skipped (unsafe/hidden path):", skipped.join(", "));
-  }
-  return written;
-}
-function discardImportDir(dest) {
-  try {
-    rmSync(dest, { recursive: true, force: true });
-  } catch {
-  }
-}
-
 // src/shared/paths.ts
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 function nestStorageRoot() {
   return config.NEST_STORAGE_ROOT;
 }
 function resolveNestPath(nestId) {
-  return join3(nestStorageRoot(), nestId);
+  return join2(nestStorageRoot(), nestId);
 }
 
 // src/governance/teams-service.ts
@@ -1050,13 +993,32 @@ import { v4 as uuid } from "uuid";
 import {
   NestStorage as NestStorage2,
   GraphQueryEngine,
-  VersionManager
+  VersionManager,
+  DocumentNotFoundError
 } from "@promptowl/contextnest-engine";
+import { createEngineApi } from "@promptowl/contextnest-engine/api";
 
 // src/nodes/flat-storage.ts
-import { readdirSync } from "fs";
-import { join as join4, relative, sep } from "path";
+import { readdir } from "fs/promises";
+import { join as join3, relative, sep } from "path";
 import { NestStorage } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
+}
+
+// src/shared/batch.ts
+var IO_CONCURRENCY = 32;
+async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
+  const out = [];
+  for (let i = 0; i < items.length; i += concurrency) {
+    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
+  }
+  return out;
+}
+
+// src/nodes/flat-storage.ts
 var META_FILES = /* @__PURE__ */ new Set([
   "INDEX.md",
   "CONTEXT.md",
@@ -1070,7 +1032,7 @@ var FlatNestStorage = class extends NestStorage {
     const root = this.root;
     let entries;
     try {
-      entries = readdirSync(root, { recursive: true, withFileTypes: true });
+      entries = await readdir(root, { recursive: true, withFileTypes: true });
     } catch (err) {
       console.error("[FlatNestStorage] cannot read folder", root, err);
       return [];
@@ -1080,33 +1042,121 @@ var FlatNestStorage = class extends NestStorage {
       if (!e.isFile() || !e.name.endsWith(".md")) continue;
       if (META_FILES.has(e.name)) continue;
       const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
+      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
       if (rel.split("/").some(isSkippedSegment)) continue;
       ids.push(rel.replace(/\.md$/, ""));
     }
-    const nodes = [];
-    for (const id of ids.sort()) {
+    ids.sort();
+    const read = await mapBatched(ids, async (id) => {
       try {
-        nodes.push(await this.readDocument(id));
+        return await this.readDocument(id);
       } catch (err) {
         console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+        return null;
       }
-    }
-    return nodes;
+    });
+    return read.filter((n) => n !== null);
   }
 };
 
 // src/nodes/engine.ts
+var DISCOVERY_TTL_MS = 3e4;
+var isLive = (node) => node.frontmatter.status !== "rejected";
+var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "README.md"
+]);
+function withDiscoveryCache(storage) {
+  const entries = /* @__PURE__ */ new Map();
+  const discover = storage.discoverDocuments.bind(storage);
+  const readDoc = storage.readDocument.bind(storage);
+  const filtersRetired = !(storage instanceof FlatNestStorage);
+  let generation = 0;
+  storage.discoverDocuments = async (options = {}) => {
+    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
+    const hit = entries.get(key);
+    if (hit && Date.now() - hit.ts < DISCOVERY_TTL_MS) return hit.docs;
+    const all = entries.get("all");
+    if (all && Date.now() - all.ts < DISCOVERY_TTL_MS) {
+      const docs2 = filtersRetired ? all.docs.filter(isLive) : all.docs;
+      entries.set("live", { docs: docs2, ts: all.ts });
+      return docs2;
+    }
+    const startedAt = generation;
+    const crawled = await discover({ ...options, includeRetired: true });
+    const docs = key === "all" || !filtersRetired ? crawled : crawled.filter(isLive);
+    if (generation === startedAt) {
+      const ts = Date.now();
+      entries.set("all", { docs: crawled, ts });
+      entries.set(key, { docs, ts });
+    }
+    return docs;
+  };
+  const invalidate = () => {
+    generation++;
+    entries.clear();
+  };
+  const patch = async (id) => {
+    generation++;
+    let node = null;
+    try {
+      node = await readDoc(id);
+    } catch (err) {
+      if (!(err instanceof DocumentNotFoundError)) {
+        invalidate();
+        return;
+      }
+      node = null;
+    }
+    for (const [key, entry] of entries) {
+      const docs = entry.docs.filter((d) => d.id !== id);
+      if (node && (key === "all" || isLive(node))) {
+        const at = docs.findIndex((d) => d.id > id);
+        docs.splice(at === -1 ? docs.length : at, 0, node);
+      }
+      entry.docs = docs;
+    }
+  };
+  const wrap = (name, after) => {
+    const write = storage[name].bind(storage);
+    storage[name] = async (...args) => {
+      try {
+        return await write(...args);
+      } finally {
+        try {
+          await after(args);
+        } catch {
+          invalidate();
+        }
+      }
+    };
+  };
+  wrap("writeDocument", (args) => patch(String(args[0])));
+  wrap("deleteDocument", (args) => patch(String(args[0])));
+  wrap("init", () => invalidate());
+  wrap("writeVaultFile", (args) => {
+    const rel = String(args[0] ?? "");
+    const base = rel.split(/[/\\]/).pop() || "";
+    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) invalidate();
+  });
+  return { storage, invalidate };
+}
 var NestEngineCache = class {
   cache = /* @__PURE__ */ new Map();
   async get(nestId) {
     let engine = this.cache.get(nestId);
     if (!engine) {
       const nestPath = resolveNestPath(nestId);
-      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath);
+      const { storage, invalidate } = withDiscoveryCache(
+        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath)
+      );
       const query = new GraphQueryEngine(storage);
       const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
+      engine = { storage, query, versions, invalidateDiscovery: invalidate };
       this.cache.set(nestId, engine);
     }
     return engine;
@@ -1116,6 +1166,11 @@ var NestEngineCache = class {
   }
 };
 var engineCache = new NestEngineCache();
+var engineApi = createEngineApi();
+async function opContext(nestId, actor, onProgress) {
+  const { storage, query, versions } = await engineCache.get(nestId);
+  return { storage, query, versions, actor, onProgress };
+}
 
 // src/governance/title-resolver.ts
 async function buildTitleMap(nestId) {
@@ -1601,14 +1656,18 @@ async function removeTeamRefs(tx, teamId) {
 }
 async function resolveTeamRolesForUser(nestId, userId) {
   const refs = await listNestTeams(nestId).catch(() => []);
+  return resolveTeamRolesFromShared(refs, userId);
+}
+async function resolveTeamRolesFromShared(refs, userId) {
   if (refs.length === 0) return [];
-  const db = getDb();
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
   const roles = /* @__PURE__ */ new Set();
-  for (const ref of refs) {
-    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
-      ref.teamId
-    ]);
-    if (!row) continue;
+  for (const row of rows) {
     const member = parseMembers(row.members).find((m) => m.userId === userId);
     if (member) roles.add(member.role);
   }
@@ -1674,71 +1733,91 @@ var PERMISSION_LEVELS = {
   admin: 3,
   owner: 4
 };
-async function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
-    return "owner";
-  }
-  if (await isLicenseAdminUserId(userId)) return "admin";
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) {
-    return "admin";
-  }
-  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
-  let best = "none";
-  const directGrant = await db.get(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) best = higher(best, directGrant.permission);
-  if (best === "admin") return best;
-  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
-    best = higher(best, teamRoleToPermission(role));
-  }
-  if (best === "admin") return best;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
+var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
+async function resolveNestAccess(nestId, userId) {
+  const row = await getDb().get(
+    `SELECT n.user_id      AS owner_id,
+            n.visibility   AS visibility,
+            n.shared_teams AS shared_teams,
+            u.email        AS caller_email,
+            nc.permission  AS collab_permission,
+            (SELECT 1 FROM stewards s
+               WHERE s.nest_id = n.id AND s.is_active = 1
+                 AND LOWER(s.user_email) = LOWER(u.email)
+               LIMIT 1) AS steward_hit,
+            (SELECT 1 FROM grants g
+               WHERE g.nest_id = n.id AND g.user_id = ?
+               LIMIT 1) AS grant_hit
+       FROM nests n
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+      WHERE n.id = ?`,
+    [userId, userId, userId, nestId]
   );
-  if (stewardGrant) best = higher(best, "read");
-  if (nest.visibility === "public") best = higher(best, "read");
-  return best;
+  const absent = {
+    exists: false,
+    ownerId: null,
+    visibility: null,
+    callerEmail: null,
+    collaboratorPermission: null,
+    isSteward: false,
+    hasGrant: false,
+    permission: "none",
+    isPublicReader: false
+  };
+  if (!row) return absent;
+  const base = {
+    exists: true,
+    ownerId: row.owner_id,
+    visibility: row.visibility,
+    callerEmail: row.caller_email ?? null,
+    collaboratorPermission: row.collab_permission ?? null,
+    // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
+    // boolean, so normalize rather than leaking the driver's shape.
+    isSteward: !!row.steward_hit,
+    hasGrant: !!row.grant_hit
+  };
+  if (row.owner_id === userId) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  const email = row.caller_email ?? null;
+  const licenseAdmin = isLicenseAdminEmail(email);
+  if (row.owner_id === ANON_USER_ID && licenseAdmin) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  if (licenseAdmin || email && isSuperAdmin(email)) {
+    return { ...base, permission: "admin", isPublicReader: false };
+  }
+  let best = higher("none", row.collab_permission);
+  if (best !== "admin") {
+    const teamRoles = await resolveTeamRolesFromShared(
+      parseSharedTeams(row.shared_teams),
+      userId
+    );
+    for (const role of teamRoles) {
+      best = higher(best, teamRoleToPermission(role));
+    }
+    if (teamRoles.length > 0) {
+      return { ...base, permission: best, isPublicReader: false };
+    }
+  }
+  if (best === "admin") {
+    return { ...base, permission: best, isPublicReader: false };
+  }
+  if (base.isSteward) best = higher(best, "read");
+  if (row.visibility === "public") best = higher(best, "read");
+  const isPublicReader2 = row.visibility === "public" && !row.collab_permission && !base.isSteward;
+  return { ...base, permission: best, isPublicReader: isPublicReader2 };
+}
+async function resolveNestPermission(nestId, userId) {
+  return (await resolveNestAccess(nestId, userId)).permission;
 }
 function permissionLevel(p) {
   return PERMISSION_LEVELS[p] ?? 0;
 }
 async function isPublicReader(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return false;
-  if (nest.visibility !== "public") return false;
-  if (nest.user_id === userId) return false;
-  const directGrant = await db.get(
-    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) return false;
-  if (await isLicenseAdminUserId(userId)) return false;
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) return false;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
-  );
-  if (stewardGrant) return false;
-  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
-  return true;
+  return (await resolveNestAccess(nestId, userId)).isPublicReader;
 }
 
 // src/governance/tag-index-service.ts
@@ -1775,6 +1854,7 @@ async function removeNodeFromTagIndex(nestId, nodeId) {
 }
 
 // src/nests/service.ts
+import { rm } from "fs/promises";
 async function isImportedNest(nestId) {
   const row = await getDb().get(
     "SELECT is_imported FROM nests WHERE id = ?",
@@ -1954,27 +2034,16 @@ async function createNest(userId, name, description) {
   trackEvent("nest.create", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function importNest(userId, name, files) {
+async function importNest(userId, name) {
   const nm = (name || "").trim();
   if (!nm) {
     throw new ValidationError("name is required");
   }
-  if (!Array.isArray(files)) {
-    throw new ValidationError("files are required");
-  }
   const db = getDb();
   const id = uuid2();
   const slug = toSlug(nm);
   const visibility = userId === ANON_USER_ID ? "public" : "private";
-  const dest = resolveNestPath(id);
-  mkdirSync(dest, { recursive: true });
-  try {
-    await writeImportedFiles(dest, files);
-  } catch (err) {
-    console.error("[nests] import write failed", dest, err);
-    discardImportDir(dest);
-    throw new ValidationError("Failed to import folder");
-  }
+  mkdirSync(resolveNestPath(id), { recursive: true });
   await db.run(
     "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)",
     [id, userId, nm, slug, null, visibility]
@@ -2045,10 +2114,12 @@ async function listSharedNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       LEFT JOIN grants g
+         ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
-         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
+         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
-    [userId, userId, userId]
+    [userId, userId, userId, userId]
   );
   const seen = new Set(direct.map((n) => n.id));
   for (const n of await nestsSharedViaTeams(userId)) {
@@ -2074,10 +2145,16 @@ async function listSharedNests(userId) {
   );
   return direct;
 }
-async function listVisibleNests(userId) {
+async function listVisibleNests(userId, opts = {}) {
   const db = getDb();
   const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
-  const params = includeAnon ? [userId, userId, userId, ANON_USER_ID] : [userId, userId, userId];
+  const params = [
+    userId,
+    userId,
+    ...opts.readable ? [userId] : [],
+    userId,
+    ...includeAnon ? [ANON_USER_ID] : []
+  ];
   const rows = await db.all(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
@@ -2086,9 +2163,11 @@ async function listVisibleNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
       WHERE n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
+         ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
          ${includeAnon ? "OR n.user_id = ?" : ""}
       ORDER BY n.created_at DESC`,
     params
@@ -2138,7 +2217,7 @@ async function deleteNest(nestId) {
   });
   const path = resolveNestPath(nestId);
   try {
-    rmSync2(path, { recursive: true, force: true });
+    await rm(path, { recursive: true, force: true });
   } catch (err) {
     console.warn(`[nests] failed to remove nest directory ${path}:`, err);
   }
@@ -2194,6 +2273,8 @@ export {
   getNest,
   deleteNest,
   engineCache,
+  engineApi,
+  opContext,
   buildTitleMap,
   folderForNode,
   describeNode,
@@ -2223,6 +2304,7 @@ export {
   canApproveWith,
   primaryRole,
   isServerAdminUserId,
+  resolveNestAccess,
   resolveNestPermission,
   permissionLevel,
   isPublicReader

package/dist/{chunk-JWVZ3T35.js → chunk-UXJSO54R.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   getDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -100,6 +100,15 @@ async function getCurrentVersion(nestId, nodeId) {
   );
   return row?.v || 0;
 }
+async function getTrackedNodeIds(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT DISTINCT node_id FROM node_versions
+        WHERE nest_id = ? AND author NOT LIKE ?`,
+    [nestId, `${SYSTEM_AUTHOR_PREFIX}%`]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
 async function getApprovedVersion(nestId, nodeId) {
   const db = getDb();
   const row = await db.get(
@@ -108,6 +117,14 @@ async function getApprovedVersion(nestId, nodeId) {
   );
   return row?.approved_version ?? null;
 }
+async function getApprovedVersions(nestId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Map(rows.map((r) => [r.node_id, r.approved_version]));
+}
 async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   const db = getDb();
   const sql = insertOrReplace(
@@ -262,7 +279,9 @@ export {
   getVersions,
   getVersion,
   getCurrentVersion,
+  getTrackedNodeIds,
   getApprovedVersion,
+  getApprovedVersions,
   setApprovedVersion,
   checkConflict,
   getNodeTags,

package/dist/{chunk-GWDOLYFJ.js → chunk-YF4OFT2V.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-7BOG3S5H.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{client-NFUHPLLM.js → client-OBS5HOTA.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-BCFKLY4H.js";
+} from "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";
 export {
   getDb,