@promptowl/contextnest-community 1.18.0 → 1.20.0

package/dist/{chunk-HGN45I5P.js → chunk-GVUBZTI3.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-TQACHVVA.js";
+} from "./chunk-O5DYL7ZG.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
+} from "./chunk-3LUUJUWS.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-34UXRZXD.js";
+} from "./chunk-KHMSDTJJ.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -28,191 +28,27 @@ import {
   isStewardshipEnabled,
   nestName,
   notifyEmailForNest,
+  notifyReviewRequested,
+  notifyReviewResolved,
   nowExpr,
   opContext,
-  permissionLabel,
   prettyFolderPath,
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-7CPP6FIU.js";
 import {
   ConflictError,
   NotFoundError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-XCFKS65Y.js";
 
 // src/governance/review-service.ts
-import { v4 as uuid3 } from "uuid";
-
-// src/governance/notify-service.ts
-import { v4 as uuid } from "uuid";
-async function listWatchers(nestId, nodeId) {
-  return await getDb().all(
-    `SELECT id, node_id, user_email, created_by, created_at
-       FROM watchers WHERE nest_id = ? AND node_id = ? ORDER BY created_at`,
-    [nestId, nodeId]
-  );
-}
-async function addWatcher(nestId, nodeId, userEmail, createdBy) {
-  await getDb().run(
-    `INSERT INTO watchers (id, nest_id, node_id, user_email, created_by, created_at)
-     VALUES (?, ?, ?, ?, ?, ?)
-     ON CONFLICT(nest_id, node_id, user_email) DO NOTHING`,
-    [uuid(), nestId, nodeId, userEmail.toLowerCase(), createdBy, (/* @__PURE__ */ new Date()).toISOString()]
-  );
-}
-async function removeWatcher(nestId, nodeId, userEmail) {
-  const db = getDb();
-  const row = await db.get(
-    "SELECT id FROM watchers WHERE nest_id = ? AND node_id = ? AND LOWER(user_email) = LOWER(?)",
-    [nestId, nodeId, userEmail]
-  );
-  if (!row) return false;
-  await db.run("DELETE FROM watchers WHERE id = ?", [row.id]);
-  return true;
-}
-async function notifyReviewRequested(params) {
-  const { nestId, nodeId, requestedBy, reviewId } = params;
-  const db = getDb();
-  try {
-    const rows = await db.all(
-      `SELECT DISTINCT w.user_email, w.node_id AS via
-         FROM watchers w
-        WHERE w.nest_id = ?
-          AND (w.node_id = ?
-               OR w.node_id IN (
-                 SELECT e.from_node FROM edges e
-                   JOIN edge_types t ON t.id = e.type_id
-                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
-               ))`,
-      [nestId, nodeId, nestId, nodeId]
-    );
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const label = await describeNode(nestId, nodeId);
-    let created = 0;
-    for (const r of rows) {
-      if (r.user_email.toLowerCase() === requestedBy.toLowerCase()) continue;
-      await db.run(
-        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
-         VALUES (?, ?, ?, 'review_requested', ?, ?, ?)`,
-        [
-          uuid(),
-          nestId,
-          r.user_email.toLowerCase(),
-          reviewId,
-          r.via === nodeId ? `"${label}" has a new version awaiting review (submitted by ${requestedBy})` : `Agent "${await describeNode(nestId, r.via)}" produced output on "${label}" \u2014 awaiting review`,
-          now
-        ]
-      );
-      created++;
-    }
-    return created;
-  } catch (err) {
-    console.error("[notify] review fan-out failed", nestId, nodeId, err);
-    return 0;
-  }
-}
-async function notifyReviewResolved(params) {
-  const { nestId, nodeId, status, resolvedBy, requestedBy, reviewId } = params;
-  const db = getDb();
-  try {
-    const rows = await db.all(
-      `SELECT DISTINCT w.user_email
-         FROM watchers w
-        WHERE w.nest_id = ?
-          AND (w.node_id = ?
-               OR w.node_id IN (
-                 SELECT e.from_node FROM edges e
-                   JOIN edge_types t ON t.id = e.type_id
-                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
-               ))`,
-      [nestId, nodeId, nestId, nodeId]
-    );
-    const recipients = new Set(rows.map((r) => r.user_email.toLowerCase()));
-    recipients.add(requestedBy.toLowerCase());
-    recipients.delete(resolvedBy.toLowerCase());
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const label = await describeNode(nestId, nodeId);
-    let created = 0;
-    for (const email of recipients) {
-      await db.run(
-        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`,
-        [
-          uuid(),
-          nestId,
-          email,
-          `review_${status}`,
-          reviewId,
-          `"${label}" was ${status} by ${resolvedBy}`,
-          now
-        ]
-      );
-      created++;
-    }
-    return created;
-  } catch (err) {
-    console.error("[notify] resolution fan-out failed", nestId, nodeId, err);
-    return 0;
-  }
-}
-async function notifyNestInvite(params) {
-  const { nestId, inviteeEmail, permission, nestName: nestName2 } = params;
-  try {
-    await getDb().run(
-      `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
-       VALUES (?, ?, ?, 'nest_invite', ?, ?, ?)`,
-      [
-        uuid(),
-        nestId,
-        inviteeEmail.toLowerCase(),
-        nestId,
-        `You were added to "${nestName2}" as ${permissionLabel(permission)}`,
-        (/* @__PURE__ */ new Date()).toISOString()
-      ]
-    );
-  } catch (err) {
-    console.error("[notify] invite inbox insert failed", nestId, inviteeEmail, err);
-  }
-}
-async function listNotifications(userEmail, opts = {}) {
-  const limit = Math.min(opts.limit ?? 50, 200);
-  return await getDb().all(
-    `SELECT n.id, n.nest_id, n.kind, n.subject_id, n.message, n.created_at, n.read_at,
-            COALESCE(
-              rr.node_id,
-              CASE WHEN dr.target_type = 'document' THEN dr.node_id END
-            ) AS node_id
-       FROM notifications n
-       LEFT JOIN review_requests rr ON rr.id = n.subject_id
-       LEFT JOIN deletion_requests dr ON dr.id = n.subject_id
-      WHERE LOWER(n.user_email) = LOWER(?)${opts.unreadOnly ? " AND n.read_at IS NULL" : ""}
-      ORDER BY n.created_at DESC LIMIT ${limit}`,
-    [userEmail]
-  );
-}
-async function markNotificationsRead(userEmail, ids) {
-  const db = getDb();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  if (ids === "all") {
-    await db.run(
-      "UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND read_at IS NULL",
-      [now, userEmail]
-    );
-    return;
-  }
-  for (const id of ids.slice(0, 200)) {
-    await db.run(
-      "UPDATE notifications SET read_at = ? WHERE id = ? AND LOWER(user_email) = LOWER(?)",
-      [now, id, userEmail]
-    );
-  }
-}
+import { v4 as uuid2 } from "uuid";
 
 // src/workflow/env-routes.ts
 import { Hono as Hono2 } from "hono";
@@ -270,7 +106,7 @@ async function filterAccessible(nestId, userId, userEmail, nodes, approvedVersio
 
 // src/workflow/edge-type-routes.ts
 import { Hono } from "hono";
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid } from "uuid";
 
 // src/shared/json.ts
 var safeJson = (s) => {
@@ -363,7 +199,7 @@ async function seedDefaultEdgeTypes(nestId) {
          (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
        VALUES (?, ?, ?, ?, 'directed', ?, NULL, ?, ?, ?, ?)
        ON CONFLICT DO NOTHING`,
-      [uuid2(), nestId, name, description, isFlow, color, createdBy, now, now]
+      [uuid(), nestId, name, description, isFlow, color, createdBy, now, now]
     );
   }
 }
@@ -451,7 +287,7 @@ edgeTypeRoutes.post("/", requireWorkflowPlane, async (c) => {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid2(), nestId, name, body.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid(), nestId, name, body.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -869,7 +705,7 @@ async function submitForReview(params) {
   if (existing) {
     throw new Error("A review is already pending for this node");
   }
-  const id = uuid3();
+  const id = uuid2();
   await db.run(
     `INSERT INTO review_requests
      (id, nest_id, node_id, version, requested_by, request_note, priority)
@@ -1168,6 +1004,18 @@ async function cancelReview(params) {
       [params.nestId, params.nodeId]
     );
     if (!pending) return null;
+    if (String(pending.requested_by).toLowerCase() !== params.cancelledBy.toLowerCase()) {
+      const verdict = await canUserApprove(
+        params.nestId,
+        params.nodeId,
+        params.cancelledBy
+      );
+      if (!verdict.allowed) {
+        throw new Error(
+          "Only the submitter or a reviewer can withdraw this review"
+        );
+      }
+    }
     await db.run(
       `UPDATE review_requests
      SET status = 'cancelled', resolved_by = ?, resolved_at = ${nowExpr(db)}
@@ -1282,7 +1130,7 @@ async function inboxInsert(nestId, recipients, kind, subjectId, message) {
       await db.run(
         `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?)`,
-        [uuid3(), nestId, email.toLowerCase(), kind, subjectId, message, now]
+        [uuid2(), nestId, email.toLowerCase(), kind, subjectId, message, now]
       );
     } catch (err) {
       console.error("[notify] deletion inbox insert failed", nestId, email, err);
@@ -1420,7 +1268,7 @@ async function requestDeletion(params) {
   if (existing) {
     throw new ConflictError(`A deletion request is already pending for this ${noun}`);
   }
-  const id = uuid3();
+  const id = uuid2();
   try {
     await db.run(
       `INSERT INTO deletion_requests (id, nest_id, node_id, target_type, requested_by, reason)
@@ -1584,12 +1432,6 @@ function rowToReviewRequest(row) {
 }
 
 export {
-  listWatchers,
-  addWatcher,
-  removeWatcher,
-  notifyNestInvite,
-  listNotifications,
-  markNotificationsRead,
   resolveCallerEmail,
   canReadNode,
   canRequestDeletion,

package/dist/{chunk-34UXRZXD.js → chunk-KHMSDTJJ.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-7CPP6FIU.js";
 import {
   getDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-XCFKS65Y.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-TQACHVVA.js → chunk-O5DYL7ZG.js}

@@ -11,16 +11,16 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-7CPP6FIU.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-XCFKS65Y.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-HYSTFMFG.js → chunk-XCFKS65Y.js}

@@ -176,6 +176,58 @@ var config = {
   get PUBLIC_BASE_URL() {
     return (process.env.PUBLIC_BASE_URL || "").replace(/\/$/, "");
   },
+  /**
+   * Dedicated secret this deployment uses to SIGN the short-lived MCP tickets
+   * minted by the SSO token-exchange (POST /auth/token-exchange). Kept distinct
+   * from OFFICIAL_COMMUNITY_SSO_SECRET so a SELF-HOSTED server can issue its own
+   * MCP bearers without the official PromptOwl trust relationship. The MCP
+   * acceptor verifies a ticket signed with EITHER secret. Unset ⇒ token-exchange
+   * cannot mint (and the acceptor simply doesn't offer this key).
+   */
+  get MCP_SIGNING_SECRET() {
+    return process.env.MCP_SIGNING_SECRET || "";
+  },
+  /**
+   * Master switch for the SSO token-exchange endpoint. Default OFF — a
+   * deployment must deliberately enable it (and set MCP_SIGNING_SECRET + at
+   * least one provider) before /auth/token-exchange will mint anything.
+   */
+  get SSO_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.SSO_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  get MS_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.MS_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  get GOOGLE_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.GOOGLE_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  /**
+   * Microsoft Entra: the app (client) id inbound tokens must be issued for
+   * (audience), and the tenant id used to build the expected issuer
+   * https://login.microsoftonline.com/<tenant>/v2.0.
+   */
+  get MS_CLIENT_ID() {
+    return (process.env.MS_CLIENT_ID || "").trim();
+  },
+  get MS_TENANT_ID() {
+    return (process.env.MS_TENANT_ID || "").trim();
+  },
+  /**
+   * Google: the OAuth client id inbound tokens must be issued for (audience).
+   * Issuer is fixed at https://accounts.google.com.
+   */
+  get GOOGLE_CLIENT_ID() {
+    return (process.env.GOOGLE_CLIENT_ID || "").trim();
+  },
+  /**
+   * Lifetime of a minted MCP ticket, in seconds. Clamped to [30, 3600]; short
+   * by design so a leaked exchange token expires quickly. Default 300.
+   */
+  get MCP_TOKEN_TTL_SECONDS() {
+    const raw = parseInt(process.env.MCP_TOKEN_TTL_SECONDS || "", 10);
+    if (!Number.isFinite(raw)) return 300;
+    return Math.max(30, Math.min(3600, raw));
+  },
   /**
    * Restrict "Sign in with PromptOwl":
    *   "open"       — anyone may sign in with PromptOwl (default)
@@ -744,6 +796,12 @@ function runMigrations(db) {
   if (!nestCols.includes("index_synced_at")) {
     db.exec("ALTER TABLE nests ADD COLUMN index_synced_at TEXT");
   }
+  if (!nestCols.includes("reader_mode")) {
+    db.exec("ALTER TABLE nests ADD COLUMN reader_mode INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("reader_home_node")) {
+    db.exec("ALTER TABLE nests ADD COLUMN reader_home_node TEXT");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1572,6 +1630,54 @@ function runMigrations(db) {
     })();
     recordMigration("036_node_index");
   }
+  if (!hasMigration("037_publish")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS publish (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          slug TEXT NOT NULL,
+          access_mode TEXT NOT NULL DEFAULT 'public'
+            CHECK(access_mode IN ('public','email','code','invite')),
+          code_hash TEXT,
+          comments_enabled INTEGER NOT NULL DEFAULT 0,
+          watermark INTEGER NOT NULL DEFAULT 0,
+          no_download INTEGER NOT NULL DEFAULT 0,
+          created_by TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          expires_at TEXT,
+          revoked_at TEXT
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_publish_slug ON publish(slug);
+        CREATE INDEX IF NOT EXISTS idx_publish_nest ON publish(nest_id, node_id);
+
+        CREATE TABLE IF NOT EXISTS access_grant (
+          id TEXT PRIMARY KEY,
+          publish_id TEXT NOT NULL REFERENCES publish(id) ON DELETE CASCADE,
+          kind TEXT NOT NULL
+            CHECK(kind IN ('invite','link','session','view')),
+          email TEXT,
+          token_hash TEXT,
+          expires_at TEXT,
+          used_at TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+        CREATE INDEX IF NOT EXISTS idx_access_grant_publish ON access_grant(publish_id, kind);
+        CREATE INDEX IF NOT EXISTS idx_access_grant_token ON access_grant(token_hash);
+      `);
+    })();
+    recordMigration("037_publish");
+  }
+  {
+    const publishCols = db.prepare("PRAGMA table_info(publish)").all().map((c) => c.name);
+    if (publishCols.length && !publishCols.includes("watermark")) {
+      db.exec("ALTER TABLE publish ADD COLUMN watermark INTEGER NOT NULL DEFAULT 0");
+    }
+    if (publishCols.length && !publishCols.includes("no_download")) {
+      db.exec("ALTER TABLE publish ADD COLUMN no_download INTEGER NOT NULL DEFAULT 0");
+    }
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1789,7 +1895,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-5VI4RDTS.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-L42OXR7K.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-GUNJTORH.js → chunk-YVMSM7LS.js}

@@ -43,6 +43,17 @@ var LockedError = class extends AppError {
     this.name = "LockedError";
   }
 };
+var VaultBusyError = class extends AppError {
+  retryAfterSeconds = 5;
+  constructor(message = "The vault is busy with another write. Retry shortly.") {
+    super(503, message);
+    this.name = "VaultBusyError";
+  }
+};
+function isVaultLockTimeout(err) {
+  const e = err;
+  return e?.name === "VaultLockTimeoutError" || e?.code === "VAULT_LOCK_TIMEOUT";
+}
 
 export {
   AppError,
@@ -51,5 +62,7 @@ export {
   UnauthorizedError,
   ValidationError,
   ConflictError,
-  LockedError
+  LockedError,
+  VaultBusyError,
+  isVaultLockTimeout
 };

package/dist/{client-SW5I6ZBK.js → client-7Z2IVCPW.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-XCFKS65Y.js";
 import "./chunk-YB3LKF7U.js";
 export {
   getDb,

package/dist/{engine-34E3YNX7.js → engine-VZTSDUPB.js}

@@ -2,9 +2,9 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
-import "./chunk-HYSTFMFG.js";
+} from "./chunk-7CPP6FIU.js";
+import "./chunk-YVMSM7LS.js";
+import "./chunk-XCFKS65Y.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-6Q6SHEOF.js → external-edit-service-3FVK3OD7.js}

@@ -11,10 +11,10 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-OOBZG6BW.js";
-import "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
-import "./chunk-HYSTFMFG.js";
+} from "./chunk-EY7WOKJR.js";
+import "./chunk-7CPP6FIU.js";
+import "./chunk-YVMSM7LS.js";
+import "./chunk-XCFKS65Y.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-ME7HIVHU.js → grants-service-WC27TRY3.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
-import "./chunk-GUNJTORH.js";
-import "./chunk-HYSTFMFG.js";
+} from "./chunk-3LUUJUWS.js";
+import "./chunk-YVMSM7LS.js";
+import "./chunk-XCFKS65Y.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,