@promptowl/contextnest-community 1.17.0 → 1.18.0

package/dist/{chunk-SNFGU5Q7.js → chunk-FUUJG6XP.js}

@@ -8,23 +8,35 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 import {
   ANON_USER_ID
-} from "./chunk-SLTQACJW.js";
+} from "./chunk-YB3LKF7U.js";
 import {
   normalizeEmail
 } from "./chunk-FRQJWGN3.js";
 
-// src/db/sql.ts
-function nowExpr(db) {
-  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
-}
-function insertOrIgnore(db, insertSql) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
+// src/nodes/engine.ts
+import {
+  NestStorage as NestStorage3,
+  GraphQueryEngine,
+  VersionManager,
+  DocumentNotFoundError
+} from "@promptowl/contextnest-engine";
+import { createEngineApi } from "@promptowl/contextnest-engine/api";
+
+// src/nests/service.ts
+import { mkdirSync } from "fs";
+import { v4 as uuid2 } from "uuid";
+import { NestStorage } from "@promptowl/contextnest-engine";
+
+// src/shared/paths.ts
+import { join } from "path";
+function nestStorageRoot() {
+  return config.NEST_STORAGE_ROOT;
 }
-function insertOrReplace(db, insertSql, conflictCols, set) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
+function resolveNestPath(nestId) {
+  return join(nestStorageRoot(), nestId);
 }
 
 // src/telemetry/tracker.ts
@@ -122,6 +134,17 @@ function startTelemetryLoop() {
   );
 }
 
+// src/db/sql.ts
+function nowExpr(db) {
+  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
+}
+function insertOrIgnore(db, insertSql) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
+}
+function insertOrReplace(db, insertSql, conflictCols, set) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
+}
+
 // src/db/settings.ts
 var deployBaseline = null;
 function norm(v) {
@@ -460,7 +483,7 @@ async function _validateLicenseImpl(forceFresh) {
 
 // src/governance/access-service.ts
 import { readFileSync, existsSync } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 var accessConfig = null;
 var grantedSuperAdmins = /* @__PURE__ */ new Set();
 async function loadGrantedSuperAdmins() {
@@ -471,8 +494,8 @@ async function loadGrantedSuperAdmins() {
 }
 function loadAccessConfig() {
   const candidates = [
-    join(config.DATA_ROOT, "access.yaml"),
-    join(config.DATA_ROOT, "access.yml")
+    join2(config.DATA_ROOT, "access.yaml"),
+    join2(config.DATA_ROOT, "access.yml")
   ];
   for (const path of candidates) {
     if (existsSync(path)) {
@@ -566,6 +589,56 @@ function parseAccessYaml(content) {
   return result;
 }
 
+// src/governance/teams-service.ts
+import { v4 as uuid } from "uuid";
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+function teamRoleToPermission(role) {
+  switch (role) {
+    case "admin":
+      return "admin";
+    case "editor":
+      return "write";
+    case "viewer":
+      return "read";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+function permissionLabel(permission) {
+  const role = collabPermToRole(permission);
+  return role ? role[0].toUpperCase() + role.slice(1) : "Collaborator";
+}
+
 // src/notify/email-render.ts
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -610,6 +683,7 @@ var STATUS_META = {
   }
 };
 var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+var shareRole = (permission) => permission ? permissionLabel(permission) : "collaborator";
 var detailRow = (label, valueHtml) => `<tr>
       <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
       <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
@@ -653,11 +727,11 @@ var TEMPLATES = {
     heading: (x) => `You've been added to ${x.title}`,
     detailsHeader: "Details",
     linkLabel: "Open nest",
-    lineT: (x) => `You've been given ${x.d.permission || "collaborator"} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
-    lineH: (x) => `You've been given <strong>${escapeHtml(x.d.permission || "collaborator")}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
+    lineT: (x) => `You've been given ${shareRole(x.d.permission)} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
+    lineH: (x) => `You've been given <strong>${escapeHtml(shareRole(x.d.permission))}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
     rows: (x) => [
       plainRow("Nest", x.d.path),
-      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : []
+      ...x.d.permission ? [plainRow("Role", shareRole(x.d.permission))] : []
     ]
   },
   invited: {
@@ -972,272 +1046,72 @@ async function sendEmailToRecipient(to, details) {
   }
 }
 
-// src/nests/service.ts
-import { mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
-import { NestStorage as NestStorage3 } from "@promptowl/contextnest-engine";
-
-// src/shared/paths.ts
-import { join as join2 } from "path";
-function nestStorageRoot() {
-  return config.NEST_STORAGE_ROOT;
+// src/governance/title-resolver.ts
+async function buildTitleMap(nestId) {
+  try {
+    const { storage } = await engineCache.get(nestId);
+    const docs = await storage.discoverDocuments();
+    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
 }
-function resolveNestPath(nestId) {
-  return join2(nestStorageRoot(), nestId);
+function folderForNode(nodeId) {
+  const segments = nodeId.split("/");
+  const root = segments.indexOf("nodes");
+  return segments.slice(root + 1, -1).join("/");
 }
-
-// src/governance/teams-service.ts
-import { v4 as uuid } from "uuid";
-
-// src/nodes/engine.ts
-import {
-  NestStorage as NestStorage2,
-  GraphQueryEngine,
-  VersionManager,
-  DocumentNotFoundError
-} from "@promptowl/contextnest-engine";
-import { createEngineApi } from "@promptowl/contextnest-engine/api";
-
-// src/nodes/flat-storage.ts
-import { readdir } from "fs/promises";
-import { join as join3, relative, sep } from "path";
-import { NestStorage } from "@promptowl/contextnest-engine";
-
-// src/fs/vault-import.ts
-function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
+async function describeNode(nestId, nodeId) {
+  const title = await titleForNode(nestId, nodeId);
+  const folder = folderForNode(nodeId);
+  return folder ? `${title} (in ${folder})` : title;
 }
-
-// src/shared/batch.ts
-var IO_CONCURRENCY = 32;
-async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
-  const out = [];
-  for (let i = 0; i < items.length; i += concurrency) {
-    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
+async function titleForNode(nestId, nodeId) {
+  const titles = await buildTitleMap(nestId);
+  return titles.get(nodeId) || titleFallback(titles, nodeId);
+}
+function titleFallback(titles, nodeId) {
+  const at = nodeId.indexOf("nodes/");
+  if (at > 0) {
+    const normalized = nodeId.slice(at);
+    const hit = titles.get(normalized);
+    if (hit) return hit;
   }
-  return out;
+  return nodeId.split("/").pop() || nodeId;
 }
-
-// src/nodes/flat-storage.ts
-var META_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "QWEN.md"
-]);
-var FlatNestStorage = class extends NestStorage {
-  async discoverDocuments() {
-    const root = this.root;
-    let entries;
-    try {
-      entries = await readdir(root, { recursive: true, withFileTypes: true });
-    } catch (err) {
-      console.error("[FlatNestStorage] cannot read folder", root, err);
-      return [];
-    }
-    const ids = [];
-    for (const e of entries) {
-      if (!e.isFile() || !e.name.endsWith(".md")) continue;
-      if (META_FILES.has(e.name)) continue;
-      const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
-      if (rel.split("/").some(isSkippedSegment)) continue;
-      ids.push(rel.replace(/\.md$/, ""));
-    }
-    ids.sort();
-    const read = await mapBatched(ids, async (id) => {
-      try {
-        return await this.readDocument(id);
-      } catch (err) {
-        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
-        return null;
-      }
-    });
-    return read.filter((n) => n !== null);
+function prettyFolderPath(path) {
+  return path.replace(/^nodes\//, "").split("/").filter(Boolean).map(
+    (seg) => seg.split(/[-_]/).map((s) => s ? s[0].toUpperCase() + s.slice(1) : s).join(" ")
+  ).join(" / ");
+}
+async function nestName(nestId) {
+  try {
+    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+      nestId
+    ]);
+    return row?.name || nestId;
+  } catch {
+    return nestId;
   }
-};
-
-// src/nodes/engine.ts
-var DISCOVERY_TTL_MS = 3e4;
-var isLive = (node) => node.frontmatter.status !== "rejected";
-var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "README.md"
-]);
-function withDiscoveryCache(storage) {
-  const entries = /* @__PURE__ */ new Map();
-  const discover = storage.discoverDocuments.bind(storage);
-  const readDoc = storage.readDocument.bind(storage);
-  const filtersRetired = !(storage instanceof FlatNestStorage);
-  let generation = 0;
-  storage.discoverDocuments = async (options = {}) => {
-    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
-    const hit = entries.get(key);
-    if (hit && Date.now() - hit.ts < DISCOVERY_TTL_MS) return hit.docs;
-    const all = entries.get("all");
-    if (all && Date.now() - all.ts < DISCOVERY_TTL_MS) {
-      const docs2 = filtersRetired ? all.docs.filter(isLive) : all.docs;
-      entries.set("live", { docs: docs2, ts: all.ts });
-      return docs2;
-    }
-    const startedAt = generation;
-    const crawled = await discover({ ...options, includeRetired: true });
-    const docs = key === "all" || !filtersRetired ? crawled : crawled.filter(isLive);
-    if (generation === startedAt) {
-      const ts = Date.now();
-      entries.set("all", { docs: crawled, ts });
-      entries.set(key, { docs, ts });
-    }
-    return docs;
-  };
-  const invalidate = () => {
-    generation++;
-    entries.clear();
-  };
-  const patch = async (id) => {
-    generation++;
-    let node = null;
-    try {
-      node = await readDoc(id);
-    } catch (err) {
-      if (!(err instanceof DocumentNotFoundError)) {
-        invalidate();
-        return;
-      }
-      node = null;
-    }
-    for (const [key, entry] of entries) {
-      const docs = entry.docs.filter((d) => d.id !== id);
-      if (node && (key === "all" || isLive(node))) {
-        const at = docs.findIndex((d) => d.id > id);
-        docs.splice(at === -1 ? docs.length : at, 0, node);
-      }
-      entry.docs = docs;
-    }
-  };
-  const wrap = (name, after) => {
-    const write = storage[name].bind(storage);
-    storage[name] = async (...args) => {
-      try {
-        return await write(...args);
-      } finally {
-        try {
-          await after(args);
-        } catch {
-          invalidate();
-        }
-      }
-    };
-  };
-  wrap("writeDocument", (args) => patch(String(args[0])));
-  wrap("deleteDocument", (args) => patch(String(args[0])));
-  wrap("init", () => invalidate());
-  wrap("writeVaultFile", (args) => {
-    const rel = String(args[0] ?? "");
-    const base = rel.split(/[/\\]/).pop() || "";
-    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) invalidate();
-  });
-  return { storage, invalidate };
-}
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  async get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath = resolveNestPath(nestId);
-      const { storage, invalidate } = withDiscoveryCache(
-        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath)
-      );
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions, invalidateDiscovery: invalidate };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-var engineApi = createEngineApi();
-async function opContext(nestId, actor, onProgress) {
-  const { storage, query, versions } = await engineCache.get(nestId);
-  return { storage, query, versions, actor, onProgress };
-}
-
-// src/governance/title-resolver.ts
-async function buildTitleMap(nestId) {
-  try {
-    const { storage } = await engineCache.get(nestId);
-    const docs = await storage.discoverDocuments();
-    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
-  } catch {
-    return /* @__PURE__ */ new Map();
-  }
-}
-function folderForNode(nodeId) {
-  const segments = nodeId.split("/");
-  const root = segments.indexOf("nodes");
-  return segments.slice(root + 1, -1).join("/");
-}
-async function describeNode(nestId, nodeId) {
-  const title = await titleForNode(nestId, nodeId);
-  const folder = folderForNode(nodeId);
-  return folder ? `${title} (in ${folder})` : title;
-}
-async function titleForNode(nestId, nodeId) {
-  const titles = await buildTitleMap(nestId);
-  return titles.get(nodeId) || titleFallback(titles, nodeId);
-}
-function titleFallback(titles, nodeId) {
-  const at = nodeId.indexOf("nodes/");
-  if (at > 0) {
-    const normalized = nodeId.slice(at);
-    const hit = titles.get(normalized);
-    if (hit) return hit;
-  }
-  return nodeId.split("/").pop() || nodeId;
-}
-function prettyFolderPath(path) {
-  return path.replace(/^nodes\//, "").split("/").filter(Boolean).map(
-    (seg) => seg.split(/[-_]/).map((s) => s ? s[0].toUpperCase() + s.slice(1) : s).join(" ")
-  ).join(" / ");
-}
-async function nestName(nestId) {
-  try {
-    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-      nestId
-    ]);
-    return row?.name || nestId;
-  } catch {
-    return nestId;
-  }
-}
-function docLink(nestId, nodeId, baseUrl) {
-  const base = baseUrl || config.PUBLIC_BASE_URL;
-  if (!base) return "";
-  const q = new URLSearchParams({ nest: nestId });
-  if (nodeId) q.set("doc", nodeId);
-  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
-}
-async function buildDocContext(nestId, nodeId, baseUrl) {
-  const titles = await buildTitleMap(nestId);
-  const docTitle = titles.get(nodeId) || nodeId;
-  const folder = folderForNode(nodeId);
-  const name = await nestName(nestId);
-  return {
-    docTitle,
-    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
-    label: folder ? `${docTitle} (in ${folder})` : docTitle,
-    path: folder ? `${name} / ${folder}` : name,
-    link: docLink(nestId, nodeId, baseUrl)
+}
+function docLink(nestId, nodeId, baseUrl) {
+  const base = baseUrl || config.PUBLIC_BASE_URL;
+  if (!base) return "";
+  const q = new URLSearchParams({ nest: nestId });
+  if (nodeId) q.set("doc", nodeId);
+  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
+}
+async function buildDocContext(nestId, nodeId, baseUrl) {
+  const titles = await buildTitleMap(nestId);
+  const docTitle = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  const name = await nestName(nestId);
+  return {
+    docTitle,
+    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
+    label: folder ? `${docTitle} (in ${folder})` : docTitle,
+    path: folder ? `${name} / ${folder}` : name,
+    link: docLink(nestId, nodeId, baseUrl)
   };
 }
 
@@ -1438,7 +1312,7 @@ async function resolveMemberIdentity(params) {
       email: normalizeEmail(existing.email ?? requested)
     };
   }
-  const { hashPassword } = await import("./keys-73STFJJB.js");
+  const { hashPassword } = await import("./keys-CTOGAG3W.js");
   const userId = uuid();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
@@ -1674,49 +1548,6 @@ async function resolveTeamRolesFromShared(refs, userId) {
   return [...roles];
 }
 
-// src/governance/roles.ts
-function collabPermToRole(permission) {
-  switch (permission) {
-    case "owner":
-      return "owner";
-    case "admin":
-      return "admin";
-    case "write":
-      return "editor";
-    case "read":
-      return "viewer";
-    default:
-      return null;
-  }
-}
-function teamRoleToPermission(role) {
-  switch (role) {
-    case "admin":
-      return "admin";
-    case "editor":
-      return "write";
-    case "viewer":
-      return "read";
-    default:
-      return null;
-  }
-}
-var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
-var canViewWith = (roles) => roles.length > 0;
-var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
-var PRECEDENCE = [
-  "owner",
-  "admin",
-  "editor",
-  "reviewer",
-  "viewer"
-];
-function primaryRole(roles) {
-  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
-  return null;
-}
-
 // src/shared/access.ts
 async function isServerAdminUserId(userId) {
   if (await isLicenseAdminUserId(userId)) return true;
@@ -2029,7 +1860,7 @@ async function createNest(userId, name, description) {
   );
   const path = resolveNestPath(id);
   mkdirSync(path, { recursive: true });
-  const storage = new NestStorage3(path);
+  const storage = new NestStorage(path);
   await storage.init(trimmed);
   trackEvent("nest.create", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
@@ -2224,6 +2055,435 @@ async function deleteNest(nestId) {
   trackEvent("nest.delete", { nestId });
 }
 
+// src/nodes/flat-storage.ts
+import { readdir } from "fs/promises";
+import { join as join3, relative, sep } from "path";
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
+}
+
+// src/shared/batch.ts
+var IO_CONCURRENCY = 32;
+async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
+  const out = [];
+  for (let i = 0; i < items.length; i += concurrency) {
+    out.push(...await Promise.all(items.slice(i, i + concurrency).map(fn)));
+  }
+  return out;
+}
+
+// src/nodes/flat-storage.ts
+var META_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "QWEN.md"
+]);
+var FlatNestStorage = class extends NestStorage2 {
+  async discoverDocuments() {
+    const root = this.root;
+    let entries;
+    try {
+      entries = await readdir(root, { recursive: true, withFileTypes: true });
+    } catch (err) {
+      console.error("[FlatNestStorage] cannot read folder", root, err);
+      return [];
+    }
+    const ids = [];
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith(".md")) continue;
+      if (META_FILES.has(e.name)) continue;
+      const dir = e.parentPath ?? e.path ?? root;
+      const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
+      if (rel.split("/").some(isSkippedSegment)) continue;
+      ids.push(rel.replace(/\.md$/, ""));
+    }
+    ids.sort();
+    const read = await mapBatched(ids, async (id) => {
+      try {
+        return await this.readDocument(id);
+      } catch (err) {
+        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+        return null;
+      }
+    });
+    return read.filter((n) => n !== null);
+  }
+};
+
+// src/shared/node-id.ts
+function assertSafeNodeId(rawId) {
+  let id = rawId;
+  try {
+    id = decodeURIComponent(rawId);
+  } catch {
+  }
+  if (!id || id.length > 512) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.includes("\0") || id.includes("\\")) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.startsWith("/")) {
+    throw new ValidationError("invalid node id (absolute path)");
+  }
+  for (const seg of id.split("/")) {
+    if (seg === "" || seg === "." || seg === "..") {
+      throw new ValidationError("invalid node id (path traversal)");
+    }
+  }
+  return id;
+}
+function folderPathOf(path) {
+  if (path === "nodes") return "";
+  return path.startsWith("nodes/") ? path.slice(6) : path;
+}
+function folderOfId(id) {
+  const rel = folderPathOf(id);
+  const slash = rel.lastIndexOf("/");
+  return slash > 0 ? rel.slice(0, slash) : "";
+}
+
+// src/nodes/node-index.ts
+var INSERT_COLS = "(nest_id, node_id, folder, title, type, status, updated_at, frontmatter_json)";
+var INSERT_VALUES = "VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
+var UPSERT_SET = [
+  "folder = excluded.folder",
+  "title = excluded.title",
+  "type = excluded.type",
+  "status = excluded.status",
+  "updated_at = excluded.updated_at",
+  "frontmatter_json = excluded.frontmatter_json"
+].join(", ");
+function rowValues(node) {
+  const fm = node.frontmatter;
+  return [
+    node.id,
+    folderOfId(node.id),
+    fm.title === void 0 || fm.title === null ? "" : String(fm.title),
+    fm.type || "document",
+    fm.status || "draft",
+    fm.updated_at ?? null,
+    JSON.stringify(fm ?? {})
+  ];
+}
+function toNode(row) {
+  return {
+    id: row.node_id,
+    filePath: "",
+    rawContent: "",
+    // A row written by this process is always valid JSON; a hand-edited or
+    // half-written one must not take the whole listing down with it.
+    frontmatter: safeParse(row.frontmatter_json),
+    body: ""
+  };
+}
+function safeParse(json) {
+  try {
+    return JSON.parse(json);
+  } catch {
+    return {};
+  }
+}
+async function syncIndexedNode(nestId, nodeId, node) {
+  writeGeneration.set(nestId, (writeGeneration.get(nestId) ?? 0) + 1);
+  try {
+    const db = getDb();
+    if (!node) {
+      await db.run(
+        "DELETE FROM node_index WHERE nest_id = ? AND node_id = ?",
+        [nestId, nodeId]
+      );
+      return;
+    }
+    await db.run(
+      insertOrReplace(
+        db,
+        `INSERT INTO node_index ${INSERT_COLS} ${INSERT_VALUES}`,
+        ["nest_id", "node_id"],
+        UPSERT_SET
+      ),
+      [nestId, ...rowValues(node)]
+    );
+  } catch (err) {
+    console.error("[node-index] sync failed, marking stale", nestId, nodeId, err);
+    await markIndexStale(nestId);
+  }
+}
+async function markIndexStale(nestId) {
+  try {
+    await getDb().run(
+      "UPDATE nests SET index_synced_at = NULL WHERE id = ?",
+      [nestId]
+    );
+  } catch (err) {
+    console.error("[node-index] could not mark stale", nestId, err);
+  }
+}
+var rebuilds = /* @__PURE__ */ new Map();
+var writeGeneration = /* @__PURE__ */ new Map();
+async function ensureNodeIndex(nestId) {
+  const row = await getDb().get(
+    "SELECT index_synced_at FROM nests WHERE id = ?",
+    [nestId]
+  );
+  if (!row || row.index_synced_at) return;
+  const inflight = rebuilds.get(nestId);
+  if (inflight) return inflight;
+  const run = rebuildNodeIndex(nestId).then(() => void 0).catch((err) => {
+    console.error("[node-index] rebuild failed", nestId, err);
+  }).finally(() => {
+    if (rebuilds.get(nestId) === run) rebuilds.delete(nestId);
+  });
+  rebuilds.set(nestId, run);
+  return run;
+}
+async function rebuildNodeIndex(nestId) {
+  const { engineCache: engineCache2 } = await import("./engine-34E3YNX7.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-6Q6SHEOF.js");
+  const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
+  dropDiscoveryCache();
+  const startedAt = writeGeneration.get(nestId) ?? 0;
+  const documents = await storage.discoverDocuments({ includeRetired: true });
+  const staged = await documentsWithSuggestions(nestId);
+  const db = getDb();
+  const insertSql = insertOrReplace(
+    db,
+    `INSERT INTO node_index ${INSERT_COLS} ${INSERT_VALUES}`,
+    ["nest_id", "node_id"],
+    UPSERT_SET
+  );
+  const stagedSql = insertOrIgnore(
+    db,
+    "INSERT INTO node_suggestions (nest_id, node_id) VALUES (?, ?)"
+  );
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM node_index WHERE nest_id = ?", [nestId]);
+    for (const doc of documents) {
+      await tx.run(insertSql, [nestId, ...rowValues(doc)]);
+    }
+    await tx.run("DELETE FROM node_suggestions WHERE nest_id = ?", [nestId]);
+    for (const id of staged) {
+      await tx.run(stagedSql, [nestId, id]);
+    }
+    if ((writeGeneration.get(nestId) ?? 0) !== startedAt) return;
+    await tx.run(
+      `UPDATE nests SET index_synced_at = ${nowExpr(db)} WHERE id = ?`,
+      [nestId]
+    );
+  });
+  return documents.length;
+}
+async function setSuggestionFlag(nestId, nodeId, present) {
+  try {
+    const db = getDb();
+    if (!present) {
+      await db.run(
+        "DELETE FROM node_suggestions WHERE nest_id = ? AND node_id = ?",
+        [nestId, nodeId]
+      );
+      return;
+    }
+    await db.run(
+      insertOrIgnore(
+        db,
+        "INSERT INTO node_suggestions (nest_id, node_id) VALUES (?, ?)"
+      ),
+      [nestId, nodeId]
+    );
+  } catch (err) {
+    console.error("[node-index] suggestion flag failed", nestId, nodeId, err);
+  }
+}
+async function nodesWithSuggestions(nestId) {
+  const rows = await getDb().all(
+    "SELECT node_id FROM node_suggestions WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
+async function indexedNodeIds(nestId) {
+  const rows = await getDb().all(
+    "SELECT node_id FROM node_index WHERE nest_id = ?",
+    [nestId]
+  );
+  return new Set(rows.map((r) => r.node_id));
+}
+async function readIndexedNodes(nestId, filters = {}) {
+  const where = ["nest_id = ?"];
+  const params = [nestId];
+  if (filters.folder !== void 0) {
+    where.push("folder = ?");
+    params.push(filters.folder);
+  }
+  const rows = await getDb().all(
+    `SELECT node_id, frontmatter_json FROM node_index
+      WHERE ${where.join(" AND ")}
+      ORDER BY node_id`,
+    params
+  );
+  return rows.map(toNode);
+}
+async function indexedFolderCounts(nestId) {
+  const rows = await getDb().all(
+    `SELECT folder, COUNT(*) AS count FROM node_index
+      WHERE nest_id = ? AND folder <> ''
+      GROUP BY folder`,
+    [nestId]
+  );
+  return rows.map((r) => ({ path: r.folder, count: Number(r.count) }));
+}
+
+// src/nodes/engine.ts
+var DISCOVERY_TTL_MS = 3e4;
+var isLive = (node) => node.frontmatter.status !== "rejected";
+var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "README.md"
+]);
+function withDiscoveryCache(nestId, storage) {
+  const entries = /* @__PURE__ */ new Map();
+  let inflight = null;
+  const discover = storage.discoverDocuments.bind(storage);
+  const readDoc = storage.readDocument.bind(storage);
+  const filtersRetired = !(storage instanceof FlatNestStorage);
+  let generation = 0;
+  const crawl = (options) => {
+    if (inflight) return inflight;
+    const startedAt = generation;
+    const run = discover({ ...options, includeRetired: true }).then((crawled) => {
+      const sets = {
+        all: crawled,
+        live: filtersRetired ? crawled.filter(isLive) : crawled
+      };
+      if (generation === startedAt) {
+        const ts = Date.now();
+        entries.set("all", { docs: sets.all, ts });
+        entries.set("live", { docs: sets.live, ts });
+      }
+      return sets;
+    }).finally(() => {
+      if (inflight === run) inflight = null;
+    });
+    inflight = run;
+    return run;
+  };
+  storage.discoverDocuments = async (options = {}) => {
+    const key = options.includeRetired || options.includeSuperseded ? "all" : "live";
+    if (options.folder !== void 0) {
+      const crawled = await discover({ ...options, includeRetired: true });
+      return key === "all" || !filtersRetired ? crawled : crawled.filter(isLive);
+    }
+    const hit = entries.get(key);
+    if (hit) {
+      if (Date.now() - hit.ts >= DISCOVERY_TTL_MS) {
+        void crawl(options).catch((err) => {
+          console.error("[discovery] background refresh failed", err);
+        });
+      }
+      return hit.docs;
+    }
+    return (await crawl(options))[key];
+  };
+  const invalidate = () => {
+    generation++;
+    entries.clear();
+    inflight = null;
+  };
+  const desync = async () => {
+    invalidate();
+    await markIndexStale(nestId);
+  };
+  const patch = async (id) => {
+    generation++;
+    inflight = null;
+    let node = null;
+    try {
+      node = await readDoc(id);
+    } catch (err) {
+      if (!(err instanceof DocumentNotFoundError)) {
+        await desync();
+        return;
+      }
+      node = null;
+    }
+    await syncIndexedNode(nestId, id, node);
+    for (const [key, entry] of entries) {
+      const docs = entry.docs.filter((d) => d.id !== id);
+      if (node && (key === "all" || isLive(node))) {
+        const at = docs.findIndex((d) => d.id > id);
+        docs.splice(at === -1 ? docs.length : at, 0, node);
+      }
+      entry.docs = docs;
+    }
+  };
+  const wrap = (name, after) => {
+    const write = storage[name].bind(storage);
+    storage[name] = async (...args) => {
+      try {
+        return await write(...args);
+      } finally {
+        try {
+          await after(args);
+        } catch {
+          await desync();
+        }
+      }
+    };
+  };
+  wrap("writeDocument", (args) => patch(String(args[0])));
+  wrap("deleteDocument", (args) => patch(String(args[0])));
+  wrap("init", () => desync());
+  wrap("writeVaultFile", (args) => {
+    const rel = String(args[0] ?? "");
+    const base = rel.split(/[/\\]/).pop() || "";
+    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) return desync();
+  });
+  return { storage, invalidate, desync: () => void desync() };
+}
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  async get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = resolveNestPath(nestId);
+      const { storage, invalidate, desync } = withDiscoveryCache(
+        nestId,
+        await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath)
+      );
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = {
+        storage,
+        query,
+        versions,
+        invalidateDiscovery: desync,
+        dropDiscoveryCache: invalidate
+      };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+var engineApi = createEngineApi();
+async function opContext(nestId, actor, onProgress) {
+  const { storage, query, versions } = await engineCache.get(nestId);
+  return { storage, query, versions, actor, onProgress };
+}
+
 export {
   nowExpr,
   insertOrIgnore,
@@ -2245,6 +2505,12 @@ export {
   getAccessConfig,
   isSuperAdmin,
   isConfigSuperAdmin,
+  collabPermToRole,
+  canViewWith,
+  canEditWith,
+  canApproveWith,
+  primaryRole,
+  permissionLabel,
   verifySmtp,
   notifyEmailForNest,
   sendEmailToRecipient,
@@ -2272,6 +2538,16 @@ export {
   listPublicNests,
   getNest,
   deleteNest,
+  assertSafeNodeId,
+  folderOfId,
+  markIndexStale,
+  ensureNodeIndex,
+  rebuildNodeIndex,
+  setSuggestionFlag,
+  nodesWithSuggestions,
+  indexedNodeIds,
+  readIndexedNodes,
+  indexedFolderCounts,
   engineCache,
   engineApi,
   opContext,
@@ -2298,11 +2574,6 @@ export {
   shareTeamWithNest,
   unshareTeamFromNest,
   resolveTeamRolesForUser,
-  collabPermToRole,
-  canViewWith,
-  canEditWith,
-  canApproveWith,
-  primaryRole,
   isServerAdminUserId,
   resolveNestAccess,
   resolveNestPermission,