@promptowl/contextnest-community 1.16.1 → 1.18.0

package/dist/{chunk-L7UCMGWZ.js → chunk-FUUJG6XP.js}

@@ -8,23 +8,35 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 import {
   ANON_USER_ID
-} from "./chunk-SLTQACJW.js";
+} from "./chunk-YB3LKF7U.js";
 import {
   normalizeEmail
 } from "./chunk-FRQJWGN3.js";
 
-// src/db/sql.ts
-function nowExpr(db) {
-  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
-}
-function insertOrIgnore(db, insertSql) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
+// src/nodes/engine.ts
+import {
+  NestStorage as NestStorage3,
+  GraphQueryEngine,
+  VersionManager,
+  DocumentNotFoundError
+} from "@promptowl/contextnest-engine";
+import { createEngineApi } from "@promptowl/contextnest-engine/api";
+
+// src/nests/service.ts
+import { mkdirSync } from "fs";
+import { v4 as uuid2 } from "uuid";
+import { NestStorage } from "@promptowl/contextnest-engine";
+
+// src/shared/paths.ts
+import { join } from "path";
+function nestStorageRoot() {
+  return config.NEST_STORAGE_ROOT;
 }
-function insertOrReplace(db, insertSql, conflictCols, set) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
+function resolveNestPath(nestId) {
+  return join(nestStorageRoot(), nestId);
 }
 
 // src/telemetry/tracker.ts
@@ -122,6 +134,17 @@ function startTelemetryLoop() {
   );
 }
 
+// src/db/sql.ts
+function nowExpr(db) {
+  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
+}
+function insertOrIgnore(db, insertSql) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
+}
+function insertOrReplace(db, insertSql, conflictCols, set) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
+}
+
 // src/db/settings.ts
 var deployBaseline = null;
 function norm(v) {
@@ -460,7 +483,7 @@ async function _validateLicenseImpl(forceFresh) {
 
 // src/governance/access-service.ts
 import { readFileSync, existsSync } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 var accessConfig = null;
 var grantedSuperAdmins = /* @__PURE__ */ new Set();
 async function loadGrantedSuperAdmins() {
@@ -471,8 +494,8 @@ async function loadGrantedSuperAdmins() {
 }
 function loadAccessConfig() {
   const candidates = [
-    join(config.DATA_ROOT, "access.yaml"),
-    join(config.DATA_ROOT, "access.yml")
+    join2(config.DATA_ROOT, "access.yaml"),
+    join2(config.DATA_ROOT, "access.yml")
   ];
   for (const path of candidates) {
     if (existsSync(path)) {
@@ -566,6 +589,56 @@ function parseAccessYaml(content) {
   return result;
 }
 
+// src/governance/teams-service.ts
+import { v4 as uuid } from "uuid";
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+function teamRoleToPermission(role) {
+  switch (role) {
+    case "admin":
+      return "admin";
+    case "editor":
+      return "write";
+    case "viewer":
+      return "read";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+function permissionLabel(permission) {
+  const role = collabPermToRole(permission);
+  return role ? role[0].toUpperCase() + role.slice(1) : "Collaborator";
+}
+
 // src/notify/email-render.ts
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -610,6 +683,7 @@ var STATUS_META = {
   }
 };
 var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+var shareRole = (permission) => permission ? permissionLabel(permission) : "collaborator";
 var detailRow = (label, valueHtml) => `<tr>
       <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
       <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
@@ -653,11 +727,11 @@ var TEMPLATES = {
     heading: (x) => `You've been added to ${x.title}`,
     detailsHeader: "Details",
     linkLabel: "Open nest",
-    lineT: (x) => `You've been given ${x.d.permission || "collaborator"} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
-    lineH: (x) => `You've been given <strong>${escapeHtml(x.d.permission || "collaborator")}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
+    lineT: (x) => `You've been given ${shareRole(x.d.permission)} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
+    lineH: (x) => `You've been given <strong>${escapeHtml(shareRole(x.d.permission))}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
     rows: (x) => [
       plainRow("Nest", x.d.path),
-      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : []
+      ...x.d.permission ? [plainRow("Role", shareRole(x.d.permission))] : []
     ]
   },
   invited: {
@@ -972,156 +1046,6 @@ async function sendEmailToRecipient(to, details) {
   }
 }
 
-// src/nests/service.ts
-import { mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
-import { NestStorage as NestStorage3 } from "@promptowl/contextnest-engine";
-
-// src/shared/paths.ts
-import { join as join2 } from "path";
-function nestStorageRoot() {
-  return config.NEST_STORAGE_ROOT;
-}
-function resolveNestPath(nestId) {
-  return join2(nestStorageRoot(), nestId);
-}
-
-// src/governance/teams-service.ts
-import { v4 as uuid } from "uuid";
-
-// src/nodes/engine.ts
-import {
-  NestStorage as NestStorage2,
-  GraphQueryEngine,
-  VersionManager
-} from "@promptowl/contextnest-engine";
-import { createEngineApi } from "@promptowl/contextnest-engine/api";
-
-// src/nodes/flat-storage.ts
-import { readdir } from "fs/promises";
-import { join as join3, relative, sep } from "path";
-import { NestStorage } from "@promptowl/contextnest-engine";
-
-// src/fs/vault-import.ts
-function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
-}
-
-// src/shared/batch.ts
-var IO_CONCURRENCY = 32;
-async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
-  const out = [];
-  for (let i = 0; i < items.length; i += concurrency) {
-    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
-  }
-  return out;
-}
-
-// src/nodes/flat-storage.ts
-var META_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "QWEN.md"
-]);
-var FlatNestStorage = class extends NestStorage {
-  async discoverDocuments() {
-    const root = this.root;
-    let entries;
-    try {
-      entries = await readdir(root, { recursive: true, withFileTypes: true });
-    } catch (err) {
-      console.error("[FlatNestStorage] cannot read folder", root, err);
-      return [];
-    }
-    const ids = [];
-    for (const e of entries) {
-      if (!e.isFile() || !e.name.endsWith(".md")) continue;
-      if (META_FILES.has(e.name)) continue;
-      const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
-      if (rel.split("/").some(isSkippedSegment)) continue;
-      ids.push(rel.replace(/\.md$/, ""));
-    }
-    ids.sort();
-    const read = await mapBatched(ids, async (id) => {
-      try {
-        return await this.readDocument(id);
-      } catch (err) {
-        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
-        return null;
-      }
-    });
-    return read.filter((n) => n !== null);
-  }
-};
-
-// src/nodes/engine.ts
-var DISCOVERY_TTL_MS = 3e4;
-var DOCUMENT_WRITERS = [
-  "writeDocument",
-  "deleteDocument",
-  "writeVaultFile",
-  "init"
-];
-function withDiscoveryCache(storage) {
-  const entries = /* @__PURE__ */ new Map();
-  const discover = storage.discoverDocuments.bind(storage);
-  let generation = 0;
-  storage.discoverDocuments = async (options = {}) => {
-    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
-    const hit = entries.get(key);
-    if (hit && Date.now() - hit.ts < DISCOVERY_TTL_MS) return hit.docs;
-    const startedAt = generation;
-    const docs = await discover(options);
-    if (generation === startedAt) entries.set(key, { docs, ts: Date.now() });
-    return docs;
-  };
-  const invalidate = () => {
-    generation++;
-    entries.clear();
-  };
-  for (const name of DOCUMENT_WRITERS) {
-    const write = storage[name].bind(storage);
-    storage[name] = async (...args) => {
-      try {
-        return await write(...args);
-      } finally {
-        invalidate();
-      }
-    };
-  }
-  return { storage, invalidate };
-}
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  async get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath = resolveNestPath(nestId);
-      const { storage, invalidate } = withDiscoveryCache(
-        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath)
-      );
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions, invalidateDiscovery: invalidate };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-var engineApi = createEngineApi();
-async function opContext(nestId, actor, onProgress) {
-  const { storage, query, versions } = await engineCache.get(nestId);
-  return { storage, query, versions, actor, onProgress };
-}
-
 // src/governance/title-resolver.ts
 async function buildTitleMap(nestId) {
   try {
@@ -1388,7 +1312,7 @@ async function resolveMemberIdentity(params) {
       email: normalizeEmail(existing.email ?? requested)
     };
   }
-  const { hashPassword } = await import("./keys-73STFJJB.js");
+  const { hashPassword } = await import("./keys-CTOGAG3W.js");
   const userId = uuid();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
@@ -1606,63 +1530,24 @@ async function removeTeamRefs(tx, teamId) {
 }
 async function resolveTeamRolesForUser(nestId, userId) {
   const refs = await listNestTeams(nestId).catch(() => []);
+  return resolveTeamRolesFromShared(refs, userId);
+}
+async function resolveTeamRolesFromShared(refs, userId) {
   if (refs.length === 0) return [];
-  const db = getDb();
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
   const roles = /* @__PURE__ */ new Set();
-  for (const ref of refs) {
-    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
-      ref.teamId
-    ]);
-    if (!row) continue;
+  for (const row of rows) {
     const member = parseMembers(row.members).find((m) => m.userId === userId);
     if (member) roles.add(member.role);
   }
   return [...roles];
 }
 
-// src/governance/roles.ts
-function collabPermToRole(permission) {
-  switch (permission) {
-    case "owner":
-      return "owner";
-    case "admin":
-      return "admin";
-    case "write":
-      return "editor";
-    case "read":
-      return "viewer";
-    default:
-      return null;
-  }
-}
-function teamRoleToPermission(role) {
-  switch (role) {
-    case "admin":
-      return "admin";
-    case "editor":
-      return "write";
-    case "viewer":
-      return "read";
-    default:
-      return null;
-  }
-}
-var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
-var canViewWith = (roles) => roles.length > 0;
-var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
-var PRECEDENCE = [
-  "owner",
-  "admin",
-  "editor",
-  "reviewer",
-  "viewer"
-];
-function primaryRole(roles) {
-  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
-  return null;
-}
-
 // src/shared/access.ts
 async function isServerAdminUserId(userId) {
   if (await isLicenseAdminUserId(userId)) return true;
@@ -1679,71 +1564,91 @@ var PERMISSION_LEVELS = {
   admin: 3,
   owner: 4
 };
-async function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
-    return "owner";
-  }
-  if (await isLicenseAdminUserId(userId)) return "admin";
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) {
-    return "admin";
-  }
-  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
-  let best = "none";
-  const directGrant = await db.get(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) best = higher(best, directGrant.permission);
-  if (best === "admin") return best;
-  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
-    best = higher(best, teamRoleToPermission(role));
-  }
-  if (best === "admin") return best;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
+var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
+async function resolveNestAccess(nestId, userId) {
+  const row = await getDb().get(
+    `SELECT n.user_id      AS owner_id,
+            n.visibility   AS visibility,
+            n.shared_teams AS shared_teams,
+            u.email        AS caller_email,
+            nc.permission  AS collab_permission,
+            (SELECT 1 FROM stewards s
+               WHERE s.nest_id = n.id AND s.is_active = 1
+                 AND LOWER(s.user_email) = LOWER(u.email)
+               LIMIT 1) AS steward_hit,
+            (SELECT 1 FROM grants g
+               WHERE g.nest_id = n.id AND g.user_id = ?
+               LIMIT 1) AS grant_hit
+       FROM nests n
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+      WHERE n.id = ?`,
+    [userId, userId, userId, nestId]
   );
-  if (stewardGrant) best = higher(best, "read");
-  if (nest.visibility === "public") best = higher(best, "read");
-  return best;
+  const absent = {
+    exists: false,
+    ownerId: null,
+    visibility: null,
+    callerEmail: null,
+    collaboratorPermission: null,
+    isSteward: false,
+    hasGrant: false,
+    permission: "none",
+    isPublicReader: false
+  };
+  if (!row) return absent;
+  const base = {
+    exists: true,
+    ownerId: row.owner_id,
+    visibility: row.visibility,
+    callerEmail: row.caller_email ?? null,
+    collaboratorPermission: row.collab_permission ?? null,
+    // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
+    // boolean, so normalize rather than leaking the driver's shape.
+    isSteward: !!row.steward_hit,
+    hasGrant: !!row.grant_hit
+  };
+  if (row.owner_id === userId) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  const email = row.caller_email ?? null;
+  const licenseAdmin = isLicenseAdminEmail(email);
+  if (row.owner_id === ANON_USER_ID && licenseAdmin) {
+    return { ...base, permission: "owner", isPublicReader: false };
+  }
+  if (licenseAdmin || email && isSuperAdmin(email)) {
+    return { ...base, permission: "admin", isPublicReader: false };
+  }
+  let best = higher("none", row.collab_permission);
+  if (best !== "admin") {
+    const teamRoles = await resolveTeamRolesFromShared(
+      parseSharedTeams(row.shared_teams),
+      userId
+    );
+    for (const role of teamRoles) {
+      best = higher(best, teamRoleToPermission(role));
+    }
+    if (teamRoles.length > 0) {
+      return { ...base, permission: best, isPublicReader: false };
+    }
+  }
+  if (best === "admin") {
+    return { ...base, permission: best, isPublicReader: false };
+  }
+  if (base.isSteward) best = higher(best, "read");
+  if (row.visibility === "public") best = higher(best, "read");
+  const isPublicReader2 = row.visibility === "public" && !row.collab_permission && !base.isSteward;
+  return { ...base, permission: best, isPublicReader: isPublicReader2 };
+}
+async function resolveNestPermission(nestId, userId) {
+  return (await resolveNestAccess(nestId, userId)).permission;
 }
 function permissionLevel(p) {
   return PERMISSION_LEVELS[p] ?? 0;
 }
 async function isPublicReader(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return false;
-  if (nest.visibility !== "public") return false;
-  if (nest.user_id === userId) return false;
-  const directGrant = await db.get(
-    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) return false;
-  if (await isLicenseAdminUserId(userId)) return false;
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) return false;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
-  );
-  if (stewardGrant) return false;
-  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
-  return true;
+  return (await resolveNestAccess(nestId, userId)).isPublicReader;
 }
 
 // src/governance/tag-index-service.ts
@@ -1955,7 +1860,7 @@ async function createNest(userId, name, description) {
   );
   const path = resolveNestPath(id);
   mkdirSync(path, { recursive: true });
-  const storage = new NestStorage3(path);
+  const storage = new NestStorage(path);
   await storage.init(trimmed);
   trackEvent("nest.create", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
@@ -2040,10 +1945,12 @@ async function listSharedNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       LEFT JOIN grants g
+         ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
-         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
+         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
-    [userId, userId, userId]
+    [userId, userId, userId, userId]
   );
   const seen = new Set(direct.map((n) => n.id));
   for (const n of await nestsSharedViaTeams(userId)) {
@@ -2069,10 +1976,16 @@ async function listSharedNests(userId) {
   );
   return direct;
 }
-async function listVisibleNests(userId) {
+async function listVisibleNests(userId, opts = {}) {
   const db = getDb();
   const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
-  const params = includeAnon ? [userId, userId, userId, ANON_USER_ID] : [userId, userId, userId];
+  const params = [
+    userId,
+    userId,
+    ...opts.readable ? [userId] : [],
+    userId,
+    ...includeAnon ? [ANON_USER_ID] : []
+  ];
   const rows = await db.all(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
@@ -2081,9 +1994,11 @@ async function listVisibleNests(userId) {
        LEFT JOIN stewards s
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
+       ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
       WHERE n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
+         ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
          ${includeAnon ? "OR n.user_id = ?" : ""}
       ORDER BY n.created_at DESC`,
     params
@@ -2140,6 +2055,435 @@ async function deleteNest(nestId) {
   trackEvent("nest.delete", { nestId });
 }
 
+// src/nodes/flat-storage.ts
+import { readdir } from "fs/promises";
+import { join as join3, relative, sep } from "path";
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
+}
+
+// src/shared/batch.ts
+var IO_CONCURRENCY = 32;
+async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
+  const out = [];
+  for (let i = 0; i < items.length; i += concurrency) {
+    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
+  }
+  return out;
+}
+
+// src/nodes/flat-storage.ts
+var META_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "QWEN.md"
+]);
+var FlatNestStorage = class extends NestStorage2 {
+  async discoverDocuments() {
+    const root = this.root;
+    let entries;
+    try {
+      entries = await readdir(root, { recursive: true, withFileTypes: true });
+    } catch (err) {
+      console.error("[FlatNestStorage] cannot read folder", root, err);
+      return [];
+    }
+    const ids = [];
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith(".md")) continue;
+      if (META_FILES.has(e.name)) continue;
+      const dir = e.parentPath ?? e.path ?? root;
+      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
+      if (rel.split("/").some(isSkippedSegment)) continue;
+      ids.push(rel.replace(/\.md$/, ""));
+    }
+    ids.sort();
+    const read = await mapBatched(ids, async (id) => {
+      try {
+        return await this.readDocument(id);
+      } catch (err) {
+        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+        return null;
+      }
+    });
+    return read.filter((n) => n !== null);
+  }
+};
+
+// src/shared/node-id.ts
+function assertSafeNodeId(rawId) {
+  let id = rawId;
+  try {
+    id = decodeURIComponent(rawId);
+  } catch {
+  }
+  if (!id || id.length > 512) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.includes("\0") || id.includes("\\")) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.startsWith("/")) {
+    throw new ValidationError("invalid node id (absolute path)");
+  }
+  for (const seg of id.split("/")) {
+    if (seg === "" || seg === "." || seg === "..") {
+      throw new ValidationError("invalid node id (path traversal)");
+    }
+  }
+  return id;
+}
+function folderPathOf(path) {
+  if (path === "nodes") return "";
+  return path.startsWith("nodes/") ? path.slice(6) : path;
+}
+function folderOfId(id) {
+  const rel = folderPathOf(id);
+  const slash = rel.lastIndexOf("/");
+  return slash > 0 ? rel.slice(0, slash) : "";
+}
+
+// src/nodes/node-index.ts
+var INSERT_COLS = "(nest_id, node_id, folder, title, type, status, updated_at, frontmatter_json)";
+var INSERT_VALUES = "VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
+var UPSERT_SET = [
+  "folder = excluded.folder",
+  "title = excluded.title",
+  "type = excluded.type",
+  "status = excluded.status",
+  "updated_at = excluded.updated_at",
+  "frontmatter_json = excluded.frontmatter_json"
+].join(", ");
+function rowValues(node) {
+  const fm = node.frontmatter;
+  return [
+    node.id,
+    folderOfId(node.id),
+    fm.title === void 0 || fm.title === null ? "" : String(fm.title),
+    fm.type || "document",
+    fm.status || "draft",
+    fm.updated_at ?? null,
+    JSON.stringify(fm ?? {})
+  ];
+}
+function toNode(row) {
+  return {
+    id: row.node_id,
+    filePath: "",
+    rawContent: "",
+    // A row written by this process is always valid JSON; a hand-edited or
+    // half-written one must not take the whole listing down with it.
+    frontmatter: safeParse(row.frontmatter_json),
+    body: ""
+  };
+}
+function safeParse(json) {
+  try {
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+async function syncIndexedNode(nestId, nodeId, node) {
+  writeGeneration.set(nestId, (writeGeneration.get(nestId) ?? 0) + 1);
+  try {
+    const db = getDb();
+    if (!node) {
+      await db.run(
+        "DELETE FROM node_index WHERE nest_id = ? AND node_id = ?",
+        [nestId, nodeId]
+      );
+      return;
+    }
+    await db.run(
+      insertOrReplace(
+        db,
+        `INSERT INTO node_index ${INSERT_COLS} ${INSERT_VALUES}`,
+        ["nest_id", "node_id"],
+        UPSERT_SET
+      ),
+      [nestId, ...rowValues(node)]
+    );
+  } catch (err) {
+    console.error("[node-index] sync failed, marking stale", nestId, nodeId, err);
+    await markIndexStale(nestId);
+  }
+}
+async function markIndexStale(nestId) {
+  try {
+    await getDb().run(
+      "UPDATE nests SET index_synced_at = NULL WHERE id = ?",
+      [nestId]
+    );
+  } catch (err) {
+    console.error("[node-index] could not mark stale", nestId, err);
+  }
+}
+var rebuilds = /* @__PURE__ */ new Map();
+var writeGeneration = /* @__PURE__ */ new Map();
+async function ensureNodeIndex(nestId) {
+  const row = await getDb().get(
+    "SELECT index_synced_at FROM nests WHERE id = ?",
+    [nestId]
+  );
+  if (!row || row.index_synced_at) return;
+  const inflight = rebuilds.get(nestId);
+  if (inflight) return inflight;
+  const run = rebuildNodeIndex(nestId).then(() => void 0).catch((err) => {
+    console.error("[node-index] rebuild failed", nestId, err);
+  }).finally(() => {
+    if (rebuilds.get(nestId) === run) rebuilds.delete(nestId);
+  });
+  rebuilds.set(nestId, run);
+  return run;
+}
+async function rebuildNodeIndex(nestId) {
+  const { engineCache: engineCache2 } = await import("./engine-34E3YNX7.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-6Q6SHEOF.js");
+  const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
+  dropDiscoveryCache();
+  const startedAt = writeGeneration.get(nestId) ?? 0;
+  const documents = await storage.discoverDocuments({ includeRetired: true });
+  const staged = await documentsWithSuggestions(nestId);
+  const db = getDb();
+  const insertSql = insertOrReplace(
+    db,
+    `INSERT INTO node_index ${INSERT_COLS} ${INSERT_VALUES}`,
+    ["nest_id", "node_id"],
+    UPSERT_SET
+  );
+  const stagedSql = insertOrIgnore(
+    db,
+    "INSERT INTO node_suggestions (nest_id, node_id) VALUES (?, ?)"
+  );
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM node_index WHERE nest_id = ?", [nestId]);
+    for (const doc of documents) {
+      await tx.run(insertSql, [nestId, ...rowValues(doc)]);
+    }
+    await tx.run("DELETE FROM node_suggestions WHERE nest_id = ?", [nestId]);
+    for (const id of staged) {
+      await tx.run(stagedSql, [nestId, id]);
+    }
+    if ((writeGeneration.get(nestId) ?? 0) !== startedAt) return;
+    await tx.run(
+      `UPDATE nests SET index_synced_at = ${nowExpr(db)} WHERE id = ?`,
+      [nestId]
+    );
+  });
+  return documents.length;
+}
+async function setSuggestionFlag(nestId, nodeId, present) {
+  try {
+    const db = getDb();
+    if (!present) {
+      await db.run(
+        "DELETE FROM node_suggestions WHERE nest_id = ? AND node_id = ?",
+        [nestId, nodeId]
+      );
+      return;
+    }
+    await db.run(
+      insertOrIgnore(
+        db,
+        "INSERT INTO node_suggestions (nest_id, node_id) VALUES (?, ?)"
+      ),
+      [nestId, nodeId]
+    );
+  } catch (err) {
+    console.error("[node-index] suggestion flag failed", nestId, nodeId, err);
+  }
+}
+async function nodesWithSuggestions(nestId) {
+  const rows = await getDb().all(
+    "SELECT node_id FROM node_suggestions WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
+async function indexedNodeIds(nestId) {
+  const rows = await getDb().all(
+    "SELECT node_id FROM node_index WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
+async function readIndexedNodes(nestId, filters = {}) {
+  const where = ["nest_id = ?"];
+  const params = [nestId];
+  if (filters.folder !== void 0) {
+    where.push("folder = ?");
+    params.push(filters.folder);
+  }
+  const rows = await getDb().all(
+    `SELECT node_id, frontmatter_json FROM node_index
+      WHERE ${where.join(" AND ")}
+      ORDER BY node_id`,
+    params
+  );
+  return rows.map(toNode);
+}
+async function indexedFolderCounts(nestId) {
+  const rows = await getDb().all(
+    `SELECT folder, COUNT(*) AS count FROM node_index
+      WHERE nest_id = ? AND folder <> ''
+      GROUP BY folder`,
+    [nestId]
+  );
+  return rows.map((r) => ({ path: r.folder, count: Number(r.count) }));
+}
+
+// src/nodes/engine.ts
+var DISCOVERY_TTL_MS = 3e4;
+var isLive = (node) => node.frontmatter.status !== "rejected";
+var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "README.md"
+]);
+function withDiscoveryCache(nestId, storage) {
+  const entries = /* @__PURE__ */ new Map();
+  let inflight = null;
+  const discover = storage.discoverDocuments.bind(storage);
+  const readDoc = storage.readDocument.bind(storage);
+  const filtersRetired = !(storage instanceof FlatNestStorage);
+  let generation = 0;
+  const crawl = (options) => {
+    if (inflight) return inflight;
+    const startedAt = generation;
+    const run = discover({ ...options, includeRetired: true }).then((crawled) => {
+      const sets = {
+        all: crawled,
+        live: filtersRetired ? crawled.filter(isLive) : crawled
+      };
+      if (generation === startedAt) {
+        const ts = Date.now();
+        entries.set("all", { docs: sets.all, ts });
+        entries.set("live", { docs: sets.live, ts });
+      }
+      return sets;
+    }).finally(() => {
+      if (inflight === run) inflight = null;
+    });
+    inflight = run;
+    return run;
+  };
+  storage.discoverDocuments = async (options = {}) => {
+    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
+    if (options.folder !== void 0) {
+      const crawled = await discover({ ...options, includeRetired: true });
+      return key === "all" || !filtersRetired ? crawled : crawled.filter(isLive);
+    }
+    const hit = entries.get(key);
+    if (hit) {
+      if (Date.now() - hit.ts >= DISCOVERY_TTL_MS) {
+        void crawl(options).catch((err) => {
+          console.error("[discovery] background refresh failed", err);
+        });
+      }
+      return hit.docs;
+    }
+    return (await crawl(options))[key];
+  };
+  const invalidate = () => {
+    generation++;
+    entries.clear();
+    inflight = null;
+  };
+  const desync = async () => {
+    invalidate();
+    await markIndexStale(nestId);
+  };
+  const patch = async (id) => {
+    generation++;
+    inflight = null;
+    let node = null;
+    try {
+      node = await readDoc(id);
+    } catch (err) {
+      if (!(err instanceof DocumentNotFoundError)) {
+        await desync();
+        return;
+      }
+      node = null;
+    }
+    await syncIndexedNode(nestId, id, node);
+    for (const [key, entry] of entries) {
+      const docs = entry.docs.filter((d) => d.id !== id);
+      if (node && (key === "all" || isLive(node))) {
+        const at = docs.findIndex((d) => d.id > id);
+        docs.splice(at === -1 ? docs.length : at, 0, node);
+      }
+      entry.docs = docs;
+    }
+  };
+  const wrap = (name, after) => {
+    const write = storage[name].bind(storage);
+    storage[name] = async (...args) => {
+      try {
+        return await write(...args);
+      } finally {
+        try {
+          await after(args);
+        } catch {
+          await desync();
+        }
+      }
+    };
+  };
+  wrap("writeDocument", (args) => patch(String(args[0])));
+  wrap("deleteDocument", (args) => patch(String(args[0])));
+  wrap("init", () => desync());
+  wrap("writeVaultFile", (args) => {
+    const rel = String(args[0] ?? "");
+    const base = rel.split(/[/\\]/).pop() || "";
+    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) return desync();
+  });
+  return { storage, invalidate, desync: () => void desync() };
+}
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  async get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = resolveNestPath(nestId);
+      const { storage, invalidate, desync } = withDiscoveryCache(
+        nestId,
+        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath)
+      );
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = {
+        storage,
+        query,
+        versions,
+        invalidateDiscovery: desync,
+        dropDiscoveryCache: invalidate
+      };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+var engineApi = createEngineApi();
+async function opContext(nestId, actor, onProgress) {
+  const { storage, query, versions } = await engineCache.get(nestId);
+  return { storage, query, versions, actor, onProgress };
+}
+
 export {
   nowExpr,
   insertOrIgnore,
@@ -2161,6 +2505,12 @@ export {
   getAccessConfig,
   isSuperAdmin,
   isConfigSuperAdmin,
+  collabPermToRole,
+  canViewWith,
+  canEditWith,
+  canApproveWith,
+  primaryRole,
+  permissionLabel,
   verifySmtp,
   notifyEmailForNest,
   sendEmailToRecipient,
@@ -2188,6 +2538,16 @@ export {
   listPublicNests,
   getNest,
   deleteNest,
+  assertSafeNodeId,
+  folderOfId,
+  markIndexStale,
+  ensureNodeIndex,
+  rebuildNodeIndex,
+  setSuggestionFlag,
+  nodesWithSuggestions,
+  indexedNodeIds,
+  readIndexedNodes,
+  indexedFolderCounts,
   engineCache,
   engineApi,
   opContext,
@@ -2214,12 +2574,8 @@ export {
   shareTeamWithNest,
   unshareTeamFromNest,
   resolveTeamRolesForUser,
-  collabPermToRole,
-  canViewWith,
-  canEditWith,
-  canApproveWith,
-  primaryRole,
   isServerAdminUserId,
+  resolveNestAccess,
   resolveNestPermission,
   permissionLevel,
   isPublicReader