@promptowl/contextnest-community 1.19.0 → 1.21.0

package/dist/{chunk-TNAZJYL5.js → chunk-6PJQSKKV.js}

@@ -1,13 +1,14 @@
 import {
   engineCache,
   indexedNodeIds,
+  isNestArchived,
   markIndexStale,
   resolveNestPath,
   setSuggestionFlag
-} from "./chunk-ENDHMQPD.js";
+} from "./chunk-6JGQX4GA.js";
 import {
   getDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -81,6 +82,10 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
+  const { hasUnsealedDraft } = await import("./version-service-PJV74PVQ.js");
+  if (await hasUnsealedDraft(nestId, documentId)) {
+    return null;
+  }
   const approved = await loadChainHead(storage, documentId);
   if (!approved) return null;
   const existing = await listSuggestions(storage, documentId);
@@ -110,6 +115,7 @@ async function refreshSuggestionFlag(nestId, storage, documentId) {
   }
 }
 async function scanNestForDrift(nestId, actor = "system:scanner") {
+  if (await isNestArchived(nestId)) return { scanned: 0, staged: 0 };
   const { storage, dropDiscoveryCache } = await engineCache.get(nestId);
   dropDiscoveryCache();
   const docs = await storage.discoverDocuments();
@@ -253,7 +259,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-G7SFFKFO.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-PJV74PVQ.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,
@@ -338,7 +344,9 @@ async function rejectExternalEdit(input) {
 var scannerTimer = null;
 async function scanAllNests() {
   const db = getDb();
-  const rows = await db.all("SELECT id FROM nests");
+  const rows = await db.all(
+    "SELECT id FROM nests WHERE archived_at IS NULL"
+  );
   await Promise.all(
     rows.map(
       ({ id }) => scanNestForDrift(id).catch(

package/dist/{chunk-BXUVIAMP.js → chunk-IGPJ74O4.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-ENDHMQPD.js";
+} from "./chunk-6JGQX4GA.js";
 import {
   getDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -136,6 +136,44 @@ async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   );
   await db.run(sql, [nestId, nodeId, version, approvedBy]);
 }
+async function getSealedVersion(nestId, nodeId) {
+  const approved = await getApprovedVersion(nestId, nodeId);
+  if (approved != null) return approved;
+  const db = getDb();
+  const row = await db.get(
+    `SELECT MAX(version) as v FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND status IN ('published', 'approved')`,
+    [nestId, nodeId]
+  );
+  return row?.v ?? null;
+}
+async function deleteSupersededDrafts(nestId, nodeId, belowVersion) {
+  const db = getDb();
+  await db.run(
+    `DELETE FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND status = 'draft' AND version < ?`,
+    [nestId, nodeId, belowVersion]
+  );
+}
+async function deleteUnsealedVersions(nestId, nodeId, sealedVersion) {
+  const db = getDb();
+  await db.run(
+    `DELETE FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND version > ?
+        AND status IN ('draft', 'rejected', 'pending_review')`,
+    [nestId, nodeId, sealedVersion]
+  );
+}
+async function hasUnsealedDraft(nestId, nodeId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT status FROM node_versions
+      WHERE nest_id = ? AND node_id = ?
+      ORDER BY version DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
+  return row?.status === "draft" || row?.status === "rejected" || row?.status === "pending_review";
+}
 async function checkConflict(nestId, nodeId, baseVersion) {
   const db = getDb();
   const current = await db.get(
@@ -265,20 +303,16 @@ async function listMyDrafts(params) {
            WHERE r.nest_id = v.nest_id AND r.node_id = v.node_id
              AND r.status = 'pending')`;
   const args = [params.authorEmail.toLowerCase(), ...params.nestIds];
-  const total = Number(
-    (await db.get(
-      `SELECT COUNT(*) as c FROM node_versions v ${where}`,
-      args
-    )).c
-  );
   const limit = Math.min(Math.max(params.limit ?? 25, 1), 100);
   const offset = Math.max(params.offset ?? 0, 0);
+  const q = params.q?.trim().toLowerCase() || "";
+  const SCAN_CAP = 500;
   const rows = await db.all(
     `SELECT v.nest_id, v.node_id, v.status, v.version, v.created_at
        FROM node_versions v ${where}
       ORDER BY v.created_at DESC
-      LIMIT ? OFFSET ?`,
-    [...args, limit, offset]
+      LIMIT ?`,
+    [...args, SCAN_CAP]
   );
   const titlesByNest = new Map(
     await Promise.all(
@@ -290,7 +324,7 @@ async function listMyDrafts(params) {
       )
     )
   );
-  const drafts = rows.filter((r) => titlesByNest.get(r.nest_id)?.has(r.node_id)).map((r) => ({
+  let drafts = rows.filter((r) => titlesByNest.get(r.nest_id)?.has(r.node_id)).map((r) => ({
     nestId: r.nest_id,
     nodeId: r.node_id,
     title: titlesByNest.get(r.nest_id).get(r.node_id) || r.node_id,
@@ -300,7 +334,17 @@ async function listMyDrafts(params) {
     version: Number(r.version),
     updatedAt: r.created_at
   }));
-  return { drafts, total };
+  if (q) {
+    drafts = drafts.filter(
+      (d) => [d.title, params.nestNames?.get(d.nestId) ?? "", d.nodeId].some(
+        (s) => s.toLowerCase().includes(q)
+      )
+    );
+  }
+  if (params.sort === "title") {
+    drafts.sort((a, b) => a.title.localeCompare(b.title));
+  }
+  return { drafts: drafts.slice(offset, offset + limit), total: drafts.length };
 }
 function rowToVersion(row) {
   return {
@@ -327,6 +371,10 @@ export {
   getApprovedVersion,
   getApprovedVersions,
   setApprovedVersion,
+  getSealedVersion,
+  deleteSupersededDrafts,
+  deleteUnsealedVersions,
+  hasUnsealedDraft,
   checkConflict,
   getNodeTags,
   getDisplayStatus,

package/dist/{chunk-HYSTFMFG.js → chunk-LPPKPEYI.js}

@@ -176,6 +176,58 @@ var config = {
   get PUBLIC_BASE_URL() {
     return (process.env.PUBLIC_BASE_URL || "").replace(/\/$/, "");
   },
+  /**
+   * Dedicated secret this deployment uses to SIGN the short-lived MCP tickets
+   * minted by the SSO token-exchange (POST /auth/token-exchange). Kept distinct
+   * from OFFICIAL_COMMUNITY_SSO_SECRET so a SELF-HOSTED server can issue its own
+   * MCP bearers without the official PromptOwl trust relationship. The MCP
+   * acceptor verifies a ticket signed with EITHER secret. Unset ⇒ token-exchange
+   * cannot mint (and the acceptor simply doesn't offer this key).
+   */
+  get MCP_SIGNING_SECRET() {
+    return process.env.MCP_SIGNING_SECRET || "";
+  },
+  /**
+   * Master switch for the SSO token-exchange endpoint. Default OFF — a
+   * deployment must deliberately enable it (and set MCP_SIGNING_SECRET + at
+   * least one provider) before /auth/token-exchange will mint anything.
+   */
+  get SSO_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.SSO_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  get MS_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.MS_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  get GOOGLE_TOKEN_EXCHANGE_ENABLED() {
+    return process.env.GOOGLE_TOKEN_EXCHANGE_ENABLED === "true";
+  },
+  /**
+   * Microsoft Entra: the app (client) id inbound tokens must be issued for
+   * (audience), and the tenant id used to build the expected issuer
+   * https://login.microsoftonline.com/<tenant>/v2.0.
+   */
+  get MS_CLIENT_ID() {
+    return (process.env.MS_CLIENT_ID || "").trim();
+  },
+  get MS_TENANT_ID() {
+    return (process.env.MS_TENANT_ID || "").trim();
+  },
+  /**
+   * Google: the OAuth client id inbound tokens must be issued for (audience).
+   * Issuer is fixed at https://accounts.google.com.
+   */
+  get GOOGLE_CLIENT_ID() {
+    return (process.env.GOOGLE_CLIENT_ID || "").trim();
+  },
+  /**
+   * Lifetime of a minted MCP ticket, in seconds. Clamped to [30, 3600]; short
+   * by design so a leaked exchange token expires quickly. Default 300.
+   */
+  get MCP_TOKEN_TTL_SECONDS() {
+    const raw = parseInt(process.env.MCP_TOKEN_TTL_SECONDS || "", 10);
+    if (!Number.isFinite(raw)) return 300;
+    return Math.max(30, Math.min(3600, raw));
+  },
   /**
    * Restrict "Sign in with PromptOwl":
    *   "open"       — anyone may sign in with PromptOwl (default)
@@ -744,6 +796,12 @@ function runMigrations(db) {
   if (!nestCols.includes("index_synced_at")) {
     db.exec("ALTER TABLE nests ADD COLUMN index_synced_at TEXT");
   }
+  if (!nestCols.includes("reader_mode")) {
+    db.exec("ALTER TABLE nests ADD COLUMN reader_mode INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("reader_home_node")) {
+    db.exec("ALTER TABLE nests ADD COLUMN reader_home_node TEXT");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1572,6 +1630,78 @@ function runMigrations(db) {
     })();
     recordMigration("036_node_index");
   }
+  if (!hasMigration("037_publish")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS publish (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          slug TEXT NOT NULL,
+          access_mode TEXT NOT NULL DEFAULT 'public'
+            CHECK(access_mode IN ('public','email','code','invite')),
+          code_hash TEXT,
+          comments_enabled INTEGER NOT NULL DEFAULT 0,
+          watermark INTEGER NOT NULL DEFAULT 0,
+          no_download INTEGER NOT NULL DEFAULT 0,
+          created_by TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          expires_at TEXT,
+          revoked_at TEXT
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_publish_slug ON publish(slug);
+        CREATE INDEX IF NOT EXISTS idx_publish_nest ON publish(nest_id, node_id);
+
+        CREATE TABLE IF NOT EXISTS access_grant (
+          id TEXT PRIMARY KEY,
+          publish_id TEXT NOT NULL REFERENCES publish(id) ON DELETE CASCADE,
+          kind TEXT NOT NULL
+            CHECK(kind IN ('invite','link','session','view')),
+          email TEXT,
+          token_hash TEXT,
+          expires_at TEXT,
+          used_at TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+        CREATE INDEX IF NOT EXISTS idx_access_grant_publish ON access_grant(publish_id, kind);
+        CREATE INDEX IF NOT EXISTS idx_access_grant_token ON access_grant(token_hash);
+      `);
+    })();
+    recordMigration("037_publish");
+  }
+  {
+    const publishCols = db.prepare("PRAGMA table_info(publish)").all().map((c) => c.name);
+    if (publishCols.length && !publishCols.includes("watermark")) {
+      db.exec("ALTER TABLE publish ADD COLUMN watermark INTEGER NOT NULL DEFAULT 0");
+    }
+    if (publishCols.length && !publishCols.includes("no_download")) {
+      db.exec("ALTER TABLE publish ADD COLUMN no_download INTEGER NOT NULL DEFAULT 0");
+    }
+  }
+  if (!hasMigration("038_nest_archive")) {
+    const cols = db.prepare("PRAGMA table_info(nests)").all().map((c) => c.name);
+    if (!cols.includes("archived_at")) {
+      db.exec("ALTER TABLE nests ADD COLUMN archived_at TEXT");
+    }
+    recordMigration("038_nest_archive");
+  }
+  if (!hasMigration("039_nest_pins")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS nest_pins (
+          -- BOTH sides cascade, as grants and nest_collaborators do. Without it
+          -- on user_id, deleting an account with a single pin fails the whole
+          -- transaction on a foreign-key violation (foreign_keys is ON).
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          PRIMARY KEY (user_id, nest_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_nest_pins_user ON nest_pins(user_id);
+      `);
+    })();
+    recordMigration("039_nest_pins");
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1789,7 +1919,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-5VI4RDTS.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-JA2YGLS3.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-3GMGLYTZ.js → chunk-N2DTJFCD.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-ENDHMQPD.js";
+} from "./chunk-6JGQX4GA.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-GSYMJ3A4.js → chunk-XWGEXQU3.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YVMSM7LS.js";
 import {
   getDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";
@@ -11,7 +11,10 @@ var rank = (r) => r === "write" ? 2 : 1;
 async function resolveNodeGrant(nestId, userId, nodeId) {
   if (!userId || !nodeId) return null;
   const rows = await getDb().all(
-    "SELECT target, role FROM grants WHERE nest_id = ? AND user_id = ?",
+    `SELECT g.target, g.role, n.archived_at
+       FROM grants g
+       JOIN nests n ON n.id = g.nest_id
+      WHERE g.nest_id = ? AND g.user_id = ?`,
     [nestId, userId]
   );
   let best = null;
@@ -20,6 +23,7 @@ async function resolveNodeGrant(nestId, userId, nodeId) {
       if (!best || rank(r.role) > rank(best)) best = r.role;
     }
   }
+  if (best === "write" && rows[0]?.archived_at) return "read";
   return best;
 }
 async function listUserGrants(nestId, userId) {

package/dist/{client-SW5I6ZBK.js → client-BD6PAUCZ.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-LPPKPEYI.js";
 import "./chunk-YB3LKF7U.js";
 export {
   getDb,

package/dist/{engine-V4DY4PYN.js → engine-IKZQ46P7.js}

@@ -2,9 +2,9 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-ENDHMQPD.js";
+} from "./chunk-6JGQX4GA.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-HYSTFMFG.js";
+import "./chunk-LPPKPEYI.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-3NK5DGLA.js → external-edit-service-LTON57HO.js}

@@ -11,10 +11,10 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-TNAZJYL5.js";
-import "./chunk-ENDHMQPD.js";
+} from "./chunk-6PJQSKKV.js";
+import "./chunk-6JGQX4GA.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-HYSTFMFG.js";
+import "./chunk-LPPKPEYI.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-CADI6LIB.js → grants-service-LSNZN6NG.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-GSYMJ3A4.js";
+} from "./chunk-XWGEXQU3.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-HYSTFMFG.js";
+import "./chunk-LPPKPEYI.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,