@promptowl/contextnest-community 1.19.0 → 1.21.0

package/dist/{chunk-ENDHMQPD.js → chunk-6JGQX4GA.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -27,7 +27,7 @@ import { createEngineApi } from "@promptowl/contextnest-engine/api";
 
 // src/nests/service.ts
 import { mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 import { NestStorage } from "@promptowl/contextnest-engine";
 
 // src/shared/paths.ts
@@ -590,7 +590,7 @@ function parseAccessYaml(content) {
 }
 
 // src/governance/teams-service.ts
-import { v4 as uuid } from "uuid";
+import { v4 as uuid2 } from "uuid";
 
 // src/governance/roles.ts
 function collabPermToRole(permission) {
@@ -680,6 +680,14 @@ var STATUS_META = {
     subjectWord: "deleted",
     label: "Deleted",
     color: "#dc2626"
+  },
+  // An honoured ARCHIVE request. Deliberately not the deletion palette: the
+  // nest is intact and restorable, and red "Deleted" would tell the requester
+  // the opposite of what happened.
+  deletion_archived: {
+    subjectWord: "archived",
+    label: "Archived",
+    color: "#0891b2"
   }
 };
 var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
@@ -777,6 +785,14 @@ var TEMPLATES = {
     lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
     rows: governanceRows
   },
+  deletion_archived: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Nest details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been archived${x.byT}${x.noteT} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    lineH: (x) => `${x.doc} has been archived${x.byH}${x.noteH} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    rows: governanceRows
+  },
   steward: {
     heading: (x) => `You're now a steward of ${x.title}`,
     detailsHeader: "Details",
@@ -997,6 +1013,9 @@ async function notifyEmailForNest(nestId, message, details) {
     }
   }
 }
+function isEmailConfigured() {
+  return !!config.SMTP_URL && !!config.NOTIFY_EMAIL_FROM;
+}
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function recipientEnvelope(to, from) {
   const recipients = Array.isArray(to) ? to : [to];
@@ -1118,6 +1137,174 @@ async function buildDocContext(nestId, nodeId, baseUrl) {
   };
 }
 
+// src/governance/notify-service.ts
+import { v4 as uuid } from "uuid";
+async function listWatchers(nestId, nodeId) {
+  return await getDb().all(
+    `SELECT id, node_id, user_email, created_by, created_at
+       FROM watchers WHERE nest_id = ? AND node_id = ? ORDER BY created_at`,
+    [nestId, nodeId]
+  );
+}
+async function addWatcher(nestId, nodeId, userEmail, createdBy) {
+  await getDb().run(
+    `INSERT INTO watchers (id, nest_id, node_id, user_email, created_by, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(nest_id, node_id, user_email) DO NOTHING`,
+    [uuid(), nestId, nodeId, userEmail.toLowerCase(), createdBy, (/* @__PURE__ */ new Date()).toISOString()]
+  );
+}
+async function removeWatcher(nestId, nodeId, userEmail) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT id FROM watchers WHERE nest_id = ? AND node_id = ? AND LOWER(user_email) = LOWER(?)",
+    [nestId, nodeId, userEmail]
+  );
+  if (!row) return false;
+  await db.run("DELETE FROM watchers WHERE id = ?", [row.id]);
+  return true;
+}
+async function notifyReviewRequested(params) {
+  const { nestId, nodeId, requestedBy, reviewId } = params;
+  const db = getDb();
+  try {
+    const rows = await db.all(
+      `SELECT DISTINCT w.user_email, w.node_id AS via
+         FROM watchers w
+        WHERE w.nest_id = ?
+          AND (w.node_id = ?
+               OR w.node_id IN (
+                 SELECT e.from_node FROM edges e
+                   JOIN edge_types t ON t.id = e.type_id
+                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
+               ))`,
+      [nestId, nodeId, nestId, nodeId]
+    );
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const label = await describeNode(nestId, nodeId);
+    let created = 0;
+    for (const r of rows) {
+      if (r.user_email.toLowerCase() === requestedBy.toLowerCase()) continue;
+      await db.run(
+        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+         VALUES (?, ?, ?, 'review_requested', ?, ?, ?)`,
+        [
+          uuid(),
+          nestId,
+          r.user_email.toLowerCase(),
+          reviewId,
+          r.via === nodeId ? `"${label}" has a new version awaiting review (submitted by ${requestedBy})` : `Agent "${await describeNode(nestId, r.via)}" produced output on "${label}" \u2014 awaiting review`,
+          now
+        ]
+      );
+      created++;
+    }
+    return created;
+  } catch (err) {
+    console.error("[notify] review fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
+async function notifyReviewResolved(params) {
+  const { nestId, nodeId, status, resolvedBy, requestedBy, reviewId } = params;
+  const db = getDb();
+  try {
+    const rows = await db.all(
+      `SELECT DISTINCT w.user_email
+         FROM watchers w
+        WHERE w.nest_id = ?
+          AND (w.node_id = ?
+               OR w.node_id IN (
+                 SELECT e.from_node FROM edges e
+                   JOIN edge_types t ON t.id = e.type_id
+                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
+               ))`,
+      [nestId, nodeId, nestId, nodeId]
+    );
+    const recipients = new Set(rows.map((r) => r.user_email.toLowerCase()));
+    recipients.add(requestedBy.toLowerCase());
+    recipients.delete(resolvedBy.toLowerCase());
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const label = await describeNode(nestId, nodeId);
+    let created = 0;
+    for (const email of recipients) {
+      await db.run(
+        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [
+          uuid(),
+          nestId,
+          email,
+          `review_${status}`,
+          reviewId,
+          `"${label}" was ${status} by ${resolvedBy}`,
+          now
+        ]
+      );
+      created++;
+    }
+    return created;
+  } catch (err) {
+    console.error("[notify] resolution fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
+async function notifyNestInvite(params) {
+  const { nestId, inviteeEmail, permission, nestName: nestName2, viaTeam } = params;
+  const message = viaTeam ? `Your team "${viaTeam}" was given access to "${nestName2}" as ${permissionLabel(permission)}` : `You were added to "${nestName2}" as ${permissionLabel(permission)}`;
+  try {
+    await getDb().run(
+      `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+       VALUES (?, ?, ?, 'nest_invite', ?, ?, ?)`,
+      [
+        uuid(),
+        nestId,
+        inviteeEmail.toLowerCase(),
+        nestId,
+        message,
+        (/* @__PURE__ */ new Date()).toISOString()
+      ]
+    );
+  } catch (err) {
+    console.error("[notify] invite inbox insert failed", nestId, inviteeEmail, err);
+  }
+}
+async function listNotifications(userEmail, opts = {}) {
+  const limit = Math.min(opts.limit ?? 50, 200);
+  return await getDb().all(
+    `SELECT n.id, n.nest_id, n.kind, n.subject_id, n.message, n.created_at, n.read_at,
+            COALESCE(
+              rr.node_id,
+              CASE WHEN dr.target_type = 'document' THEN dr.node_id END,
+              -- A mention names the document directly; there's no request row.
+              CASE WHEN n.kind = 'mention' THEN n.subject_id END
+            ) AS node_id
+       FROM notifications n
+       LEFT JOIN review_requests rr ON rr.id = n.subject_id
+       LEFT JOIN deletion_requests dr ON dr.id = n.subject_id
+      WHERE LOWER(n.user_email) = LOWER(?)${opts.unreadOnly ? " AND n.read_at IS NULL" : ""}
+      ORDER BY n.created_at DESC LIMIT ${limit}`,
+    [userEmail]
+  );
+}
+async function markNotificationsRead(userEmail, ids) {
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  if (ids === "all") {
+    await db.run(
+      "UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND read_at IS NULL",
+      [now, userEmail]
+    );
+    return;
+  }
+  for (const id of ids.slice(0, 200)) {
+    await db.run(
+      "UPDATE notifications SET read_at = ? WHERE id = ? AND LOWER(user_email) = LOWER(?)",
+      [now, id, userEmail]
+    );
+  }
+}
+
 // src/governance/teams-service.ts
 var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
 function parseMembers(json) {
@@ -1196,7 +1383,7 @@ async function createTeam(params) {
   if (!name) throw new ValidationError("Team name is required");
   const db = getDb();
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid();
+  const id = uuid2();
   await db.run(
     "INSERT INTO teams (id, name, owner_id, members, source, external_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
     [
@@ -1316,10 +1503,10 @@ async function resolveMemberIdentity(params) {
     };
   }
   const { hashPassword } = await import("./keys-CTOGAG3W.js");
-  const userId = uuid();
+  const userId = uuid2();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [userId, requested, null, await hashPassword(uuid())]
+    [userId, requested, null, await hashPassword(uuid2())]
   );
   return { userId, email: requested };
 }
@@ -1397,6 +1584,23 @@ function parseSharedTeams(json) {
     return [];
   }
 }
+async function listSharedTeamMembers(refs) {
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
+  const byEmail = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    for (const member of parseMembers(row.members)) {
+      const key = (member.email || "").toLowerCase();
+      if (!key || byEmail.has(key)) continue;
+      byEmail.set(key, { userId: member.userId, email: member.email, name: null });
+    }
+  }
+  return [...byEmail.values()];
+}
 async function listNestTeams(nestId) {
   const db = getDb();
   const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
@@ -1408,6 +1612,7 @@ async function listNestTeams(nestId) {
 async function shareTeamWithNest(params) {
   const db = getDb();
   let sharedMembers = [];
+  let sharedTeamName = "";
   const refs = await db.transaction(async (tx) => {
     const team = await tx.get(
       "SELECT id, name, owner_id, members FROM teams WHERE id = ?",
@@ -1434,6 +1639,7 @@ async function shareTeamWithNest(params) {
     ]);
     const members = parseMembers(team.members);
     sharedMembers = members;
+    sharedTeamName = team.name;
     const hasGovernanceRole = members.some(
       (m) => m.role === "viewer" || m.role === "editor"
     );
@@ -1468,6 +1674,16 @@ async function shareTeamWithNest(params) {
         permission: role,
         by: caller?.email || void 0
       });
+      const permission = teamRoleToPermission(role) ?? role;
+      for (const email of emails) {
+        await notifyNestInvite({
+          nestId: params.nestId,
+          inviteeEmail: email,
+          permission,
+          nestName: shareNestName,
+          viaTeam: sharedTeamName
+        });
+      }
     }
   } catch (err) {
     console.error("[notify] team-share email fan-out failed", params.nestId, err);
@@ -1569,9 +1785,29 @@ var PERMISSION_LEVELS = {
 };
 var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
 async function resolveNestAccess(nestId, userId) {
+  const access = await resolveNestAccessRaw(nestId, userId);
+  return {
+    ...access,
+    rawPermission: access.permission,
+    permission: capForArchive(access.permission, access.archived)
+  };
+}
+async function isNestArchived(nestId) {
+  const row = await getDb().get(
+    "SELECT archived_at FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.archived_at;
+}
+function capForArchive(permission, archived) {
+  if (!archived) return permission;
+  return PERMISSION_LEVELS[permission] > PERMISSION_LEVELS.read ? "read" : permission;
+}
+async function resolveNestAccessRaw(nestId, userId) {
   const row = await getDb().get(
     `SELECT n.user_id      AS owner_id,
             n.visibility   AS visibility,
+            n.archived_at  AS archived_at,
             n.shared_teams AS shared_teams,
             u.email        AS caller_email,
             nc.permission  AS collab_permission,
@@ -1598,7 +1834,9 @@ async function resolveNestAccess(nestId, userId) {
     isSteward: false,
     hasGrant: false,
     permission: "none",
-    isPublicReader: false
+    rawPermission: "none",
+    isPublicReader: false,
+    archived: false
   };
   if (!row) return absent;
   const base = {
@@ -1610,7 +1848,8 @@ async function resolveNestAccess(nestId, userId) {
     // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
     // boolean, so normalize rather than leaking the driver's shape.
     isSteward: !!row.steward_hit,
-    hasGrant: !!row.grant_hit
+    hasGrant: !!row.grant_hit,
+    archived: !!row.archived_at
   };
   if (row.owner_id === userId) {
     return { ...base, permission: "owner", isPublicReader: false };
@@ -1696,9 +1935,32 @@ async function isImportedNest(nestId) {
   );
   return !!row?.is_imported;
 }
+var MAX_NEST_NAME_LENGTH = 100;
+function plainName(name, emptyMessage = "Name cannot be empty") {
+  const typed = (name ?? "").trim();
+  if (!typed) throw new ValidationError(emptyMessage);
+  if (typed.length > MAX_NEST_NAME_LENGTH) {
+    throw new ValidationError(
+      `Nest names are capped at ${MAX_NEST_NAME_LENGTH} characters`
+    );
+  }
+  if (/<\/?[a-zA-Z][^>]*>/.test(typed)) {
+    throw new ValidationError(
+      "Nest names are plain text \u2014 remove the HTML tags."
+    );
+  }
+  return typed;
+}
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+async function assertSlugFree(userId, slug, message, exceptId) {
+  const conflict = await getDb().get(
+    exceptId ? "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1" : "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+    exceptId ? [userId, slug, exceptId] : [userId, slug]
+  );
+  if (conflict) throw new ValidationError(message);
+}
 async function uniqueNestName(userId, baseName) {
   const db = getDb();
   let candidate = baseName;
@@ -1730,6 +1992,22 @@ async function setStewardshipEnabled(nestId, enabled) {
     nestId
   ]);
 }
+async function setReaderMode(nestId, opts) {
+  const db = getDb();
+  const sets = [];
+  const params = [];
+  if (opts.enabled !== void 0) {
+    sets.push("reader_mode = ?");
+    params.push(opts.enabled ? 1 : 0);
+  }
+  if (opts.homeNode !== void 0) {
+    sets.push("reader_home_node = ?");
+    params.push(opts.homeNode ?? null);
+  }
+  if (sets.length === 0) return;
+  params.push(nestId);
+  await db.run(`UPDATE nests SET ${sets.join(", ")} WHERE id = ?`, params);
+}
 async function nestAllowsSelfApprove(nestId) {
   const db = getDb();
   const row = await db.get(
@@ -1806,19 +2084,15 @@ async function renameNest(nestId, patch) {
   const updates = [];
   const params = [];
   if (patch.name !== void 0) {
-    const trimmed = patch.name.trim();
-    if (!trimmed) throw new ValidationError("Name cannot be empty");
+    const trimmed = plainName(patch.name);
     const slug = toSlug(trimmed);
     if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
-    const conflict = await db.get(
-      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
-      [existing.user_id, slug, nestId]
+    await assertSlugFree(
+      existing.user_id,
+      slug,
+      "Another nest already uses this name. Pick a different one.",
+      nestId
     );
-    if (conflict) {
-      throw new ValidationError(
-        `Another nest already uses this name. Pick a different one.`
-      );
-    }
     updates.push("name = ?", "slug = ?");
     params.push(trimmed, slug);
   }
@@ -1837,25 +2111,20 @@ async function renameNest(nestId, patch) {
   return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]);
 }
 async function createNest(userId, name, description) {
-  const id = uuid2();
+  const id = uuid3();
   const db = getDb();
-  const trimmed = name.trim();
-  if (!trimmed) throw new ValidationError("Name cannot be empty");
+  const trimmed = plainName(name);
   const slug = toSlug(trimmed);
   if (!slug) {
     throw new ValidationError(
       "Name must contain at least one alphanumeric character"
     );
   }
-  const conflict = await db.get(
-    "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
-    [userId, slug]
+  await assertSlugFree(
+    userId,
+    slug,
+    "You already have a nest with this name. Pick a different one."
   );
-  if (conflict) {
-    throw new ValidationError(
-      "You already have a nest with this name. Pick a different one."
-    );
-  }
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   await db.run(
     "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
@@ -1869,13 +2138,15 @@ async function createNest(userId, name, description) {
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
 async function importNest(userId, name) {
-  const nm = (name || "").trim();
-  if (!nm) {
-    throw new ValidationError("name is required");
-  }
+  const nm = plainName(name || "", "name is required");
   const db = getDb();
-  const id = uuid2();
+  const id = uuid3();
   const slug = toSlug(nm);
+  await assertSlugFree(
+    userId,
+    slug,
+    "A nest with this name already exists. Pick a different name."
+  );
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   mkdirSync(resolveNestPath(id), { recursive: true });
   await db.run(
@@ -1885,26 +2156,79 @@ async function importNest(userId, name) {
   trackEvent("nest.import", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function listNests(userId) {
+async function pinNest(userId, nestId) {
   const db = getDb();
+  const existing = await db.get(
+    "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+  if (existing) return;
+  try {
+    await db.run(
+      "INSERT INTO nest_pins (user_id, nest_id) VALUES (?, ?)",
+      [userId, nestId]
+    );
+  } catch (err) {
+    const now = await db.get(
+      "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+      [userId, nestId]
+    );
+    if (!now) throw err;
+  }
+}
+async function unpinNest(userId, nestId) {
+  await getDb().run(
+    "DELETE FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+}
+async function pinnedNestIds(userId) {
+  const rows = await getDb().all(
+    "SELECT nest_id FROM nest_pins WHERE user_id = ?",
+    [userId]
+  );
+  return new Set(rows.map((r) => r.nest_id));
+}
+var LIVE_ONLY = "archived_at IS NULL";
+var LIVE_ONLY_N = "n.archived_at IS NULL";
+async function listNests(userId, opts = {}) {
+  const db = getDb();
+  const scope = opts.archived ? "archived_at IS NOT NULL" : LIVE_ONLY;
   if (userId === ANON_USER_ID) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
   }
   const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [userId]
     );
   }
   return await db.all(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
+    `SELECT * FROM nests WHERE (user_id = ? OR user_id = ?) AND ${scope}
+      ORDER BY created_at DESC`,
     [userId, ANON_USER_ID]
   );
 }
+async function archiveNest(nestId) {
+  await getDb().transaction(async (tx) => {
+    await tx.run(
+      "UPDATE nests SET archived_at = ? WHERE id = ? AND archived_at IS NULL",
+      [(/* @__PURE__ */ new Date()).toISOString(), nestId]
+    );
+    await tx.run(
+      `DELETE FROM deletion_requests
+        WHERE nest_id = ? AND target_type = 'nest_archive' AND status = 'pending'`,
+      [nestId]
+    );
+  });
+}
+async function restoreNest(nestId) {
+  await getDb().run("UPDATE nests SET archived_at = NULL WHERE id = ?", [nestId]);
+}
 async function nestsSharedViaTeams(userId) {
   const db = getDb();
   const teams = await db.all(
@@ -1926,6 +2250,7 @@ async function nestsSharedViaTeams(userId) {
   const candidates = await db.all(
     `SELECT * FROM nests
        WHERE user_id != ?
+         AND ${LIVE_ONLY}
          AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
     [userId, ...ids.map((id) => `%${id}%`)]
   );
@@ -1951,6 +2276,7 @@ async function listSharedNests(userId) {
        LEFT JOIN grants g
          ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
+         AND ${LIVE_ONLY_N}
          AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
     [userId, userId, userId, userId]
@@ -1964,7 +2290,8 @@ async function listSharedNests(userId) {
   }
   if (await isServerAdminUserId(userId)) {
     const anon = await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${LIVE_ONLY}
+        ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
     for (const n of anon) {
@@ -1998,11 +2325,12 @@ async function listVisibleNests(userId, opts = {}) {
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
        ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
-      WHERE n.user_id = ?
+      WHERE ${LIVE_ONLY_N}
+        AND (n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
          ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
-         ${includeAnon ? "OR n.user_id = ?" : ""}
+         ${includeAnon ? "OR n.user_id = ?" : ""})
       ORDER BY n.created_at DESC`,
     params
   );
@@ -2020,6 +2348,7 @@ async function listPublicNests(userId) {
   return await db.all(
     `SELECT n.* FROM nests n
        WHERE n.visibility = 'public'
+         AND ${LIVE_ONLY_N}
          AND n.user_id != ?
          AND NOT EXISTS (
            SELECT 1 FROM nest_collaborators nc
@@ -2047,6 +2376,10 @@ async function deleteNest(nestId) {
     } catch {
     }
     await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
+    try {
+      await tx.run("DELETE FROM nest_pins WHERE nest_id = ?", [id]);
+    } catch {
+    }
     await tx.run("DELETE FROM nests WHERE id = ?", [id]);
   });
   const path = resolveNestPath(nestId);
@@ -2068,6 +2401,21 @@ function isSkippedSegment(segment) {
   return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
 }
 
+// src/nodes/meta-files.ts
+var META_BASENAMES = /* @__PURE__ */ new Set([
+  "INDEX",
+  "CONTEXT",
+  "CLAUDE",
+  "GEMINI",
+  "AGENTS",
+  "QWEN",
+  "README"
+]);
+function isMetaFile(idOrPath) {
+  const base = idOrPath.split(/[/\\]/).pop() ?? "";
+  return META_BASENAMES.has(base.replace(/\.md$/i, "").toUpperCase());
+}
+
 // src/shared/batch.ts
 var IO_CONCURRENCY = 32;
 async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
@@ -2079,14 +2427,6 @@ async function mapBatched(items, fn, concurrency = IO_CONCURRENCY) {
 }
 
 // src/nodes/flat-storage.ts
-var META_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "QWEN.md"
-]);
 var FlatNestStorage = class extends NestStorage2 {
   async discoverDocuments() {
     const root = this.root;
@@ -2100,7 +2440,7 @@ var FlatNestStorage = class extends NestStorage2 {
     const ids = [];
     for (const e of entries) {
       if (!e.isFile() || !e.name.endsWith(".md")) continue;
-      if (META_FILES.has(e.name)) continue;
+      if (isMetaFile(e.name)) continue;
       const dir = e.parentPath ?? e.path ?? root;
       const rel = relative(root, join3(dir, e.name)).split(sep).join("/");
       if (rel.split("/").some(isSkippedSegment)) continue;
@@ -2247,8 +2587,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-V4DY4PYN.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-3NK5DGLA.js");
+  const { engineCache: engineCache2 } = await import("./engine-IKZQ46P7.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-LTON57HO.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2345,18 +2685,11 @@ async function indexedFolderCounts(nestId) {
 // src/nodes/engine.ts
 var DISCOVERY_TTL_MS = 3e4;
 var isLive = (node) => node.frontmatter.status !== "rejected";
-var DERIVED_VAULT_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "README.md"
-]);
 function withDiscoveryCache(nestId, storage) {
   const entries = /* @__PURE__ */ new Map();
   let inflight = null;
-  const discover = storage.discoverDocuments.bind(storage);
+  const rawDiscover = storage.discoverDocuments.bind(storage);
+  const discover = async (options) => (await rawDiscover(options)).filter((d) => !isMetaFile(d.id));
   const readDoc = storage.readDocument.bind(storage);
   const filtersRetired = !(storage instanceof FlatNestStorage);
   let generation = 0;
@@ -2407,6 +2740,7 @@ function withDiscoveryCache(nestId, storage) {
     await markIndexStale(nestId);
   };
   const patch = async (id) => {
+    if (isMetaFile(id)) return;
     generation++;
     inflight = null;
     let node = null;
@@ -2448,8 +2782,7 @@ function withDiscoveryCache(nestId, storage) {
   wrap("init", () => desync());
   wrap("writeVaultFile", (args) => {
     const rel = String(args[0] ?? "");
-    const base = rel.split(/[/\\]/).pop() || "";
-    if (rel.endsWith(".md") && !DERIVED_VAULT_FILES.has(base)) return desync();
+    if (rel.endsWith(".md") && !isMetaFile(rel)) return desync();
   });
   return { storage, invalidate, desync: () => void desync() };
 }
@@ -2513,9 +2846,9 @@ export {
   canEditWith,
   canApproveWith,
   primaryRole,
-  permissionLabel,
   verifySmtp,
   notifyEmailForNest,
+  isEmailConfigured,
   sendEmailToRecipient,
   nestStorageRoot,
   resolveNestPath,
@@ -2525,6 +2858,7 @@ export {
   uniqueNestName,
   isStewardshipEnabled,
   setStewardshipEnabled,
+  setReaderMode,
   nestAllowsSelfApprove,
   setAllowSelfApprove,
   nestReviewsPrimeOnly,
@@ -2535,7 +2869,12 @@ export {
   renameNest,
   createNest,
   importNest,
+  pinNest,
+  unpinNest,
+  pinnedNestIds,
   listNests,
+  archiveNest,
+  restoreNest,
   listSharedNests,
   listVisibleNests,
   listPublicNests,
@@ -2563,6 +2902,14 @@ export {
   docLink,
   resolveNodeUrl,
   buildDocContext,
+  listWatchers,
+  addWatcher,
+  removeWatcher,
+  notifyReviewRequested,
+  notifyReviewResolved,
+  notifyNestInvite,
+  listNotifications,
+  markNotificationsRead,
   createTeam,
   findTeamByExternalId,
   listTeamsForUser,
@@ -2574,12 +2921,16 @@ export {
   replaceTeamRoster,
   updateMemberRole,
   removeMember,
+  parseSharedTeams,
+  listSharedTeamMembers,
   listNestTeams,
   shareTeamWithNest,
   unshareTeamFromNest,
   resolveTeamRolesForUser,
   isServerAdminUserId,
   resolveNestAccess,
+  isNestArchived,
+  capForArchive,
   resolveNestPermission,
   permissionLevel,
   isPublicReader