@promptowl/contextnest-community 1.16.1 → 1.17.0

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   addWatcher,
   approve,
   canReadNode,
+  canRequestDeletion,
   cancelReview,
   declineDeletion,
   deletionTargetTitle,
@@ -38,17 +39,18 @@ import {
   seedDefaultEdgeTypes,
   sendTestNotification,
   submitForReview,
-  withNodeWriteLock
-} from "./chunk-QJVRZT6M.js";
+  withNodeWriteLock,
+  withdrawDeletionRequest
+} from "./chunk-4YGJSUJC.js";
 import {
   createGrant,
   deleteGrant,
   grantCoversNode,
-  hasAnyGrant,
+  grantRoleForNode,
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-OTGZQZKK.js";
+} from "./chunk-HWDPCPYT.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -69,7 +71,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-D6HICFVW.js";
+} from "./chunk-UXJSO54R.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -89,7 +91,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-CLKZZZS2.js";
+} from "./chunk-YF4OFT2V.js";
 import {
   addMember,
   buildTitleMap,
@@ -145,6 +147,7 @@ import {
   renameTeam,
   replaceTeamRoster,
   resolveMemberIdentity,
+  resolveNestAccess,
   resolveNestPath,
   resolveNestPermission,
   sendEmailToRecipient,
@@ -162,7 +165,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   AppError,
   ConflictError,
@@ -1863,7 +1866,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion: upsertVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-V6K5SZ3P.js");
+  const { upsertVersion: upsertVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-EFZGGL3Y.js");
   await upsertVersion2({
     nestId: input.nestId,
     nodeId: input.documentId,
@@ -2199,10 +2202,7 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
     nodes,
     approvedVersions ?? void 0
   );
-  if (await resolveNestPermission(nestId, userId) === "none" && !await isStewardshipEnabled(nestId)) {
-    const grants = await listUserGrants(nestId, userId);
-    accessible = grants.length ? nodes.filter((d) => grantCoversNode(grants, d.id)) : accessible;
-  }
+  const myGrants = await listUserGrants(nestId, userId);
   if (approvedVersions && !publicReader) {
     accessible = accessible.filter((d) => approvedVersions.has(d.id));
   }
@@ -2222,6 +2222,9 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.author = people.author;
         r.collaborators = people.collaborators;
       }
+      if (myGrants.length) {
+        r.myGrant = grantRoleForNode(myGrants, doc.id);
+      }
       if (approvedVersions) {
         const approved = approvedVersions.get(doc.id);
         if (approved != null) {
@@ -3099,16 +3102,22 @@ async function deleteUnsyncedFolder(folderName) {
 }
 
 // src/nests/routes.ts
-async function effectivePermission(nestId, userId) {
-  if (config.AUTH_MODE === "open") {
-    const db = getDb();
-    const nest = await db.get(
-      "SELECT user_id FROM nests WHERE id = ?",
-      [nestId]
-    );
-    if (nest && nest.user_id === ANON_USER_ID) return "owner";
+async function effectiveAccess(nestId, userId) {
+  const access = await resolveNestAccess(nestId, userId);
+  if (config.AUTH_MODE === "open" && access.ownerId === ANON_USER_ID) {
+    return { permission: "owner", access };
   }
-  return resolveNestPermission(nestId, userId);
+  const permission = access.permission;
+  if (permission === "none" && access.hasGrant) {
+    return { permission: "read", access };
+  }
+  return { permission, access };
+}
+async function effectivePermission(nestId, userId) {
+  return (await effectiveAccess(nestId, userId)).permission;
+}
+function isGrantOnly(access) {
+  return access.permission === "none" && access.hasGrant;
 }
 var nestRoutes = new Hono3();
 nestRoutes.get("/", async (c) => {
@@ -3119,8 +3128,31 @@ nestRoutes.get("/", async (c) => {
   const db = getDb();
   const ownerEmailSql = "SELECT email FROM users WHERE id = ?";
   const callerEmail = await resolveCallerEmail(userId);
+  const myGrantRows = await db.all(
+    "SELECT nest_id, target FROM grants WHERE user_id = ?",
+    [userId]
+  );
+  const grantTargetsByNest = /* @__PURE__ */ new Map();
+  for (const r of myGrantRows) {
+    const arr = grantTargetsByNest.get(r.nest_id) ?? [];
+    arr.push({ target: r.target });
+    grantTargetsByNest.set(r.nest_id, arr);
+  }
   const annotate = async (n) => {
-    const permission = await effectivePermission(n.id, userId);
+    const { permission, access } = await effectiveAccess(n.id, userId);
+    if (permission !== "owner" && // open-mode commons promotion outranks a grant
+    isGrantOnly(access)) {
+      const owner_email2 = n.user_id === ANON_USER_ID ? null : (await db.get(ownerEmailSql, [n.user_id]))?.email ?? null;
+      return {
+        ...n,
+        permission: "read",
+        is_owner: false,
+        owner_email: owner_email2,
+        roles: ["viewer"],
+        grant_only: true,
+        stewardship_enabled: !!n.stewardship_enabled
+      };
+    }
     const is_owner = permission === "owner";
     const needOwnerEmail = !is_owner && n.user_id !== ANON_USER_ID;
     const [roles, owner_email] = await Promise.all([
@@ -3135,6 +3167,7 @@ nestRoutes.get("/", async (c) => {
       is_owner,
       owner_email,
       roles,
+      grant_only: false,
       stewardship_enabled: !!n.stewardship_enabled
     };
   };
@@ -3178,14 +3211,38 @@ nestRoutes.get("/", async (c) => {
     if (arr.length < 8) arr.push(r.email);
     collabEmailsByNest.set(r.nest_id, arr);
   }
-  const withMeta = out.map((n) => ({
-    ...n,
-    document_count: docByNest.get(n.id) ?? 0,
-    collaborator_count: collabByNest.get(n.id) ?? 0,
-    steward_count: stewardByNest.get(n.id) ?? 0,
-    steward_emails: stewardEmailsByNest.get(n.id) ?? [],
-    collaborator_emails: collabEmailsByNest.get(n.id) ?? []
-  }));
+  const grantOnlyIds = out.filter((n) => n.grant_only).map((n) => n.id);
+  const grantedDocsByNest = /* @__PURE__ */ new Map();
+  if (grantOnlyIds.length) {
+    const rows = await db.all(
+      `SELECT DISTINCT nest_id, node_id FROM node_versions
+        WHERE nest_id IN (${grantOnlyIds.map(() => "?").join(",")})`,
+      grantOnlyIds
+    );
+    for (const r of rows) {
+      const targets = grantTargetsByNest.get(r.nest_id) ?? [];
+      if (grantCoversNode(targets, r.node_id)) {
+        grantedDocsByNest.set(r.nest_id, (grantedDocsByNest.get(r.nest_id) ?? 0) + 1);
+      }
+    }
+  }
+  const withMeta = out.map(
+    (n) => n.grant_only ? {
+      ...n,
+      document_count: grantedDocsByNest.get(n.id) ?? 0,
+      collaborator_count: 0,
+      steward_count: 0,
+      steward_emails: [],
+      collaborator_emails: []
+    } : {
+      ...n,
+      document_count: docByNest.get(n.id) ?? 0,
+      collaborator_count: collabByNest.get(n.id) ?? 0,
+      steward_count: stewardByNest.get(n.id) ?? 0,
+      steward_emails: stewardEmailsByNest.get(n.id) ?? [],
+      collaborator_emails: collabEmailsByNest.get(n.id) ?? []
+    }
+  );
   return c.json({ nests: withMeta });
 });
 nestRoutes.post("/", async (c) => {
@@ -3291,7 +3348,7 @@ nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   if (nestId === "unsynced") return handleUnsyncedList(c);
   const userId = c.get("userId");
-  const permission = await effectivePermission(nestId, userId);
+  const { permission, access } = await effectiveAccess(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
@@ -3301,8 +3358,15 @@ nestRoutes.get("/:nestId", async (c) => {
     roles = ["owner", ...roles];
   }
   const myStewards = await getStewardsForUser(nestId, email);
+  const grant_only = roles.length === 0 && isGrantOnly(access);
   const nest = await getNest(nestId);
-  return c.json({ nest, permission, roles, myStewards });
+  return c.json({
+    nest,
+    permission,
+    roles: grant_only ? ["viewer"] : roles,
+    myStewards,
+    grant_only
+  });
 });
 nestRoutes.patch("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4002,6 +4066,25 @@ teamRoutes.delete("/:teamId/members/:userId", async (c) => {
 });
 
 // src/nodes/search.ts
+async function discoverForSearch(storage) {
+  return storage.discoverDocuments({ includeRetired: true });
+}
+function titleScore(title, query) {
+  const t = (title || "").toLowerCase();
+  const q = query.trim().toLowerCase();
+  if (!q) return 0;
+  if (t === q) return 4;
+  let midWord = false;
+  for (let i = t.indexOf(q); i !== -1; i = t.indexOf(q, i + 1)) {
+    if (i === 0) return 3;
+    if (!/[a-z0-9]/.test(t[i - 1])) return 2;
+    midWord = true;
+  }
+  if (midWord) return 1;
+  const terms = q.split(/\s+/).filter(Boolean);
+  if (terms.length > 1 && terms.every((term) => t.includes(term))) return 1;
+  return 0;
+}
 function matchDocuments(documents, query) {
   const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return [];
@@ -4013,15 +4096,25 @@ function matchDocuments(documents, query) {
       ...node.frontmatter.tags || []
     ].join(" ").toLowerCase();
     return terms.every((term) => haystack.includes(term));
-  });
+  }).sort(
+    (a, b) => titleScore(b.frontmatter.title, query) - titleScore(a.frontmatter.title, query)
+  );
 }
-function toSearchHit(node) {
+function bodySnippet(body, query) {
+  const flat = body.replace(/\s+/g, " ").trim();
+  const terms = (query || "").toLowerCase().split(/\s+/).filter(Boolean);
+  const at = terms.map((t) => flat.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0];
+  if (at === void 0 || at < 80) return flat.slice(0, 200);
+  const start = Math.max(0, at - 60);
+  return `\u2026${flat.slice(start, start + 200)}`;
+}
+function toSearchHit(node, query) {
   return {
     id: node.id,
     title: node.frontmatter.title,
     type: node.frontmatter.type || "document",
     tags: node.frontmatter.tags || [],
-    snippet: (node.body || "").slice(0, 200).replace(/\n/g, " ")
+    snippet: bodySnippet(node.body || "", query)
   };
 }
 
@@ -4153,7 +4246,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-LTREGVSJ.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-OHTTZFND.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4174,7 +4267,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-V2GR6VM3.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-3CCKDO5N.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -4298,6 +4391,7 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       response.collaborators = people.collaborators;
     }
   }
+  response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
   if (publicReader) {
     const approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
@@ -5785,15 +5879,14 @@ queryRoutes.get("/search", async (c) => {
   }
   const nestId = c.req.param("nestId");
   const { storage } = await engineCache.get(nestId);
-  const documents = await storage.discoverDocuments();
-  const matches = matchDocuments(documents, q);
+  const matches = matchDocuments(await discoverForSearch(storage), q);
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const accessible = await filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
-    nodes: accessible.map(toSearchHit)
+    nodes: accessible.map((n) => toSearchHit(n, q))
   });
 });
 queryRoutes.get("/overview", async (c) => {
@@ -5833,10 +5926,6 @@ queryRoutes.get("/context", async (c) => {
 queryRoutes.get("/export", async (c) => {
   const nestId = c.req.param("nestId");
   if (c.req.query("format") === "bundle") {
-    const perm = await resolveNestPermission(nestId, c.get("userId"));
-    if (perm !== "owner" && perm !== "admin") {
-      throw new ForbiddenError("Only the nest owner or an admin can export a bundle");
-    }
     const draftsParam = c.req.query("includeDrafts");
     const includeDrafts = draftsParam === "1" || draftsParam === "true";
     const zip = await exportNestBundle(nestId, includeDrafts);
@@ -7923,6 +8012,13 @@ ${sections}`;
           (n) => String(n.frontmatter.title ?? "").toLowerCase() === wanted
         );
         if (twin) {
+          const twinVersions = await getVersions(nestId, twin.id);
+          if (twinVersions.length === 0) {
+            return toolError(
+              `A node titled "${twin.frontmatter.title}" already exists (${twin.id}) but has no version history, which is why it doesn't show up in a read or a draft list. It may be an interrupted create or a document whose import never finished. Write into it with context_update "${twin.id}" to keep whatever is there, or remove it with context_delete "${twin.id}" and create again \u2014 check its content first.`,
+              "DOCUMENT_ALREADY_EXISTS"
+            );
+          }
           return toolError(
             `A node titled "${twin.frontmatter.title}" already exists (${twin.id}). Titles must be unique \u2014 MCP tools resolve documents by title, so a second one would be unreachable. Use context_update to change it, context_move to refile it, or create this one under a different title.`,
             "DOCUMENT_ALREADY_EXISTS"
@@ -8076,6 +8172,9 @@ ${sections}`;
         return "reason is required \u2014 say why it should be deleted; that is what the admin judges.";
       }
       if (args.nest === true) {
+        if (!await canRequestDeletion({ nestId, userId, userEmail, nodeId: "" })) {
+          return "Only an editor, a nest admin, or the nest owner can request the deletion of a nest.";
+        }
         const request2 = await requestDeletion({
           nestId,
           nodeId: nestId,
@@ -8088,6 +8187,9 @@ ${sections}`;
 Request id: \`${request2.id}\``;
       }
       if (typeof args.folder === "string" && args.folder.trim()) {
+        if (!await canRequestDeletion({ nestId, userId, userEmail, nodeId: "" })) {
+          return "Only an editor, a nest admin, or the nest owner can request the deletion of a folder.";
+        }
         const folder = args.folder.trim().replace(/^\/+|\/+$/g, "").replace(/^nodes\//, "");
         const docs = await storage.discoverDocuments();
         const inside = docs.filter((d) => isIdUnderFolder(d.id, folder));
@@ -8110,6 +8212,14 @@ Request id: \`${request2.id}\``;
       if (!await canReadNode(nestId, node.id, userId, userEmail)) {
         return `Node not found: ${node.id}`;
       }
+      if (!await canRequestDeletion({
+        nestId,
+        userId,
+        userEmail,
+        nodeId: node.id
+      })) {
+        return "Only an editor, a nest admin, or the nest owner can request the deletion of a document.";
+      }
       const request = await requestDeletion({
         nestId,
         nodeId: node.id,
@@ -8434,7 +8544,7 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-I535QVTW.js");
+        const { createGrant: createGrant2 } = await import("./grants-service-4NXPBYWD.js");
         const db = (await import("./client-OBS5HOTA.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
@@ -10024,6 +10134,11 @@ Streamable HTTP, stateless. Two endpoints:
   (new document in a writable nest; a \`folder\` path creates the folder).
 - \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, full toolset including writes and
   governance (create/update, submit/approve/reject, stewards, sharing).
+  Sharing a slice is one call: \`context_grant\` with
+  \`{ "email", "target_type": "document" | "folder", "target", "role": "read" | "write" }\`
+  \u2014 \`target\` is a node id (\`nodes/win-loss-log\`) or a folder prefix
+  (\`nodes/gtm/deals\`). The recipient reaches exactly that document, or
+  everything under that folder, and nothing else in the nest. Owner/admin only.
 
 Claude Code / Cursor / VS Code connect natively via HTTP with the
 \`Authorization: Bearer\` header. Claude Desktop needs the mcp-remote bridge:
@@ -10032,20 +10147,9 @@ Claude Code / Cursor / VS Code connect natively via HTTP with the
 npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
 \`\`\`
 
-## ctx CLI (npm: @promptowl/contextnest-cli)
-
-\`npm i -g @promptowl/contextnest-cli\`
-
-- \`ctx push --server ${B} --nest <nest-id> --key <api-key>\` \u2014 upload a local
-  vault into a nest (add \`--include-drafts\` for unpublished nodes).
-- All other ctx commands (\`query\`, \`add\`, \`search\`, \`checkpoint\`) operate on
-  a LOCAL vault directory only. For remote reads use the API or MCP above \u2014
-  there is currently no remote \`ctx query\`.
-
 ## npm packages
 
 - \`@promptowl/contextnest-community\` \u2014 this server
-- \`@promptowl/contextnest-cli\` \u2014 the ctx CLI
 - \`@promptowl/contextnest-engine\` \u2014 vault storage + selector/graph engine
 
 ## Conventions
@@ -10624,6 +10728,25 @@ function denyUnlessNestManager(c, what) {
     403
   );
 }
+async function mayRequestDeletion(c, nestId, nodeId) {
+  return canRequestDeletion({
+    nestId,
+    userId: c.get("userId"),
+    userEmail: await getUserEmail4(c),
+    nodeId,
+    // The middleware promotes open-mode callers; resolving fresh would miss it.
+    permission: c.get("nestPermission")
+  });
+}
+function denyUnlessEditor(allowed, c, what) {
+  if (allowed) return null;
+  return c.json(
+    {
+      error: `Only an editor, a nest admin, or the nest owner can request the deletion of ${what}.`
+    },
+    403
+  );
+}
 governanceRoutes.post("/delete-folder", async (c) => {
   const nestId = c.req.param("nestId");
   const denied = denyUnlessNestManager(c, "a folder");
@@ -10641,6 +10764,12 @@ governanceRoutes.post("/delete-folder", async (c) => {
 });
 governanceRoutes.post("/request-deletion", async (c) => {
   const nestId = c.req.param("nestId");
+  const denied = denyUnlessEditor(
+    await mayRequestDeletion(c, nestId, ""),
+    c,
+    "a folder or a nest"
+  );
+  if (denied) return denied;
   const body = await c.req.json().catch(() => ({}));
   const reason = body.reason?.trim();
   if (!reason) {
@@ -10731,6 +10860,16 @@ governanceRoutes.post("/deletion-requests/:id/decline", async (c) => {
   if (!request) return c.json({ error: "Deletion request not found" }, 404);
   return c.json({ request });
 });
+governanceRoutes.post("/deletion-requests/:id/withdraw", async (c) => {
+  const nestId = c.req.param("nestId");
+  const request = await withdrawDeletionRequest({
+    nestId,
+    id: c.req.param("id"),
+    withdrawnBy: await getUserEmail4(c)
+  });
+  if (!request) return c.json({ error: "Deletion request not found or not yours" }, 404);
+  return c.json({ withdrawn: true, request });
+});
 governanceRoutes.get("/feed", async (c) => {
   const nestId = c.req.param("nestId");
   const filterRaw = c.req.query("filter");
@@ -10988,6 +11127,12 @@ governanceNodeRoutes.post("/:nodeId{.+}/request-deletion", async (c) => {
   if (!await canReadNode(nestId, nodeId, c.get("userId"), userEmail)) {
     return c.json({ error: `Node not found: ${nodeId}` }, 404);
   }
+  const denied = denyUnlessEditor(
+    await mayRequestDeletion(c, nestId, nodeId),
+    c,
+    "a document"
+  );
+  if (denied) return denied;
   const { storage } = await engineCache.get(nestId);
   try {
     await storage.readDocument(nodeId);
@@ -12102,14 +12247,14 @@ function createApp() {
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
     const perNest = await Promise.all(
-      (await listVisibleNests(userId)).map(async (nest) => {
+      (await listVisibleNests(userId, { readable: true })).map(async (nest) => {
         try {
           const { storage } = await engineCache.get(nest.id);
-          const matches = matchDocuments(await storage.discoverDocuments(), q);
+          const matches = matchDocuments(await discoverForSearch(storage), q);
           if (matches.length === 0) return [];
           const accessible = await filterAccessible(nest.id, userId, userEmail, matches);
           return accessible.map((n) => ({
-            ...toSearchHit(n),
+            ...toSearchHit(n, q),
             nest_id: nest.id,
             nest_name: nest.name ?? nest.id
           }));
@@ -12119,7 +12264,7 @@ function createApp() {
         }
       })
     );
-    const hits = perNest.flat();
+    const hits = perNest.flat().sort((a, b) => titleScore(b.title, q) - titleScore(a.title, q));
     return c.json({
       query: q,
       count: hits.length,
@@ -12195,7 +12340,8 @@ function createApp() {
       c.set("nestPermission", "owner");
       return next();
     }
-    const permission = await resolveNestPermission(nestId, userId);
+    const access = await resolveNestAccess(nestId, userId);
+    const permission = access.permission;
     const isReadQuery = parts.length === 2 && ["context", "query", "search", "export"].includes(parts[1]);
     let grantRole = null;
     let grantNestVisible = false;
@@ -12208,11 +12354,13 @@ function createApp() {
         }
         grantRole = await resolveNodeGrant(nestId, userId, targetTail);
       } else if (parts.length === 1 && c.req.method === "GET") {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
       } else if (parts[1] === "nodes" && parts.length === 2 && c.req.method === "GET") {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
       } else if (isReadQuery) {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
+      } else if (parts[1] === "definitions" && parts.length === 2 && c.req.method === "GET") {
+        grantNestVisible = access.hasGrant;
       }
       if (!grantRole && !grantNestVisible) {
         return deny(404, "Nest not found", {
@@ -12225,7 +12373,7 @@ function createApp() {
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
-    const isDeletionRequestAction = /\/request-deletion$/.test(path);
+    const isDeletionRequestAction = /\/request-deletion$/.test(path) || /\/deletion-requests\/[^/]+\/withdraw$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
     if (isStewardRoster && permission !== "owner" && permission !== "admin") {
       return c.json(

package/dist/{review-service-V2GR6VM3.js → review-service-3CCKDO5N.js}

@@ -14,14 +14,15 @@ import {
   reject,
   repointPendingReview,
   requestDeletion,
-  submitForReview
-} from "./chunk-QJVRZT6M.js";
-import "./chunk-OTGZQZKK.js";
-import "./chunk-D6HICFVW.js";
+  submitForReview,
+  withdrawDeletionRequest
+} from "./chunk-4YGJSUJC.js";
+import "./chunk-HWDPCPYT.js";
+import "./chunk-UXJSO54R.js";
 import {
   canUserApprove
-} from "./chunk-CLKZZZS2.js";
-import "./chunk-L7UCMGWZ.js";
+} from "./chunk-YF4OFT2V.js";
+import "./chunk-SNFGU5Q7.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";
@@ -43,5 +44,6 @@ export {
   reject,
   repointPendingReview,
   requestDeletion,
-  submitForReview
+  submitForReview,
+  withdrawDeletionRequest
 };

package/dist/{stewardship-service-LTREGVSJ.js → stewardship-service-OHTTZFND.js}

@@ -21,8 +21,8 @@ import {
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-CLKZZZS2.js";
-import "./chunk-L7UCMGWZ.js";
+} from "./chunk-YF4OFT2V.js";
+import "./chunk-SNFGU5Q7.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";

package/dist/{version-service-V6K5SZ3P.js → version-service-EFZGGL3Y.js}

@@ -15,8 +15,8 @@ import {
   setApprovedVersion,
   systemAuthor,
   upsertVersion
-} from "./chunk-D6HICFVW.js";
-import "./chunk-L7UCMGWZ.js";
+} from "./chunk-UXJSO54R.js";
+import "./chunk-SNFGU5Q7.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-JMJLNEXE.js";
 import "./chunk-SLTQACJW.js";