@promptowl/contextnest-community 1.20.0 → 1.21.0

package/README.md

@@ -15,7 +15,7 @@ ContextNest Community Edition is a self-hosted server that lets you:
 - Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`
+- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`, or register the nest in the ctx CLI (`ctx vault add <alias> --url <server>/nests/<id>/mcp --bearer-env CONTEXTNEST_API_KEY`, then `ctx query "#tag" --vault <alias>`)
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
 The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.

package/dist/{chunk-GVUBZTI3.js → chunk-4KJGQHWB.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-O5DYL7ZG.js";
+} from "./chunk-N2DTJFCD.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-3LUUJUWS.js";
+} from "./chunk-XWGEXQU3.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-KHMSDTJJ.js";
+} from "./chunk-IGPJ74O4.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -36,7 +36,7 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-7CPP6FIU.js";
+} from "./chunk-6JGQX4GA.js";
 import {
   ConflictError,
   NotFoundError,
@@ -45,7 +45,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-LPPKPEYI.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -119,6 +119,20 @@ var safeJson = (s) => {
 };
 
 // src/workflow/flow-graph.ts
+async function nodeTrail(db, nestId, ids) {
+  const unique = [...new Set(ids)];
+  const titles = /* @__PURE__ */ new Map();
+  try {
+    const rows = await db.all(
+      `SELECT node_id, title FROM node_index
+        WHERE nest_id = ? AND node_id IN (${unique.map(() => "?").join(",")})`,
+      [nestId, ...unique]
+    );
+    for (const r of rows) if (r.title) titles.set(r.node_id, r.title);
+  } catch {
+  }
+  return ids.map((id) => `"${titles.get(id) ?? id}"`).join(" \u2192 ");
+}
 async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   const db = getDb();
   const rows = await db.all(
@@ -133,7 +147,7 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   for (const r of rows) {
     if (r.from_node === r.to_node) {
       throw new ConflictError(
-        `cycle: ["${r.from_node}"] \u2014 a flow edge cannot be a self-loop`
+        `cycle: ${await nodeTrail(db, nestId, [r.from_node])} cannot flow into itself`
       );
     }
     nodes.add(r.from_node);
@@ -698,31 +712,60 @@ function withNodeWriteLock(key, fn) {
 // src/governance/review-service.ts
 async function submitForReview(params) {
   const db = getDb();
-  const existing = await db.get(
-    "SELECT id FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending'",
-    [params.nestId, params.nodeId]
-  );
-  if (existing) {
-    throw new Error("A review is already pending for this node");
-  }
-  const id = uuid2();
-  await db.run(
-    `INSERT INTO review_requests
+  const { id, version } = await withNodeWriteLock(
+    nodeWriteKey(params.nestId, params.nodeId),
+    async () => {
+      const existing = await db.get(
+        "SELECT id FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending'",
+        [params.nestId, params.nodeId]
+      );
+      if (existing) {
+        throw new Error("A review is already pending for this node");
+      }
+      const version2 = await getCurrentVersion(params.nestId, params.nodeId) || params.version;
+      const id2 = uuid2();
+      await db.run(
+        `INSERT INTO review_requests
      (id, nest_id, node_id, version, requested_by, request_note, priority)
      VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [
-      id,
-      params.nestId,
-      params.nodeId,
-      params.version,
-      params.requestedBy,
-      params.note || null,
-      params.priority || "normal"
-    ]
-  );
-  await db.run(
-    "UPDATE node_versions SET status = 'pending_review' WHERE nest_id = ? AND node_id = ? AND version = ?",
-    [params.nestId, params.nodeId, params.version]
+        [
+          id2,
+          params.nestId,
+          params.nodeId,
+          version2,
+          params.requestedBy,
+          params.note || null,
+          params.priority || "normal"
+        ]
+      );
+      await db.run(
+        "UPDATE node_versions SET status = 'pending_review' WHERE nest_id = ? AND node_id = ? AND version = ?",
+        [params.nestId, params.nodeId, version2]
+      );
+      try {
+        const { storage, versions: versionManager } = await engineCache.get(
+          params.nestId
+        );
+        const node = await storage.readDocument(params.nodeId);
+        const history = await versionManager.getHistory(params.nodeId);
+        const alreadySealed = (history?.versions ?? []).some(
+          (v) => v.version === (node.frontmatter.version ?? 1)
+        );
+        if (!alreadySealed) {
+          await versionManager.createVersion(node, params.requestedBy, {
+            note: params.note || "Submitted for review"
+          });
+        }
+      } catch (err) {
+        console.error(
+          "VersionManager.createVersion failed (submit for review)",
+          params.nestId,
+          params.nodeId,
+          err
+        );
+      }
+      return { id: id2, version: version2 };
+    }
   );
   const reviewCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
   void dispatchEvent({
@@ -730,18 +773,18 @@ async function submitForReview(params) {
     nestId: params.nestId,
     subjectId: params.nodeId,
     actor: params.requestedBy,
-    message: `Review requested on *${reviewCtx.label}* (v${params.version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
+    message: `Review requested on *${reviewCtx.label}* (v${version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
   });
   void notifyNestEvent(
     params.nestId,
-    `:memo: Review requested on *${reviewCtx.label}* (v${params.version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`,
+    `:memo: Review requested on *${reviewCtx.label}* (v${version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`,
     {
       status: "pending_review",
       docTitle: reviewCtx.docTitle,
       path: reviewCtx.path,
       link: reviewCtx.link,
       actor: params.requestedBy,
-      version: params.version,
+      version,
       note: params.note || null
     }
   );
@@ -765,7 +808,7 @@ async function submitForReview(params) {
         path: reviewCtx.path,
         link: reviewCtx.link,
         actor: params.requestedBy,
-        version: params.version,
+        version,
         note: params.note || null
       });
     }
@@ -1106,9 +1149,12 @@ async function getPendingReview(nestId, nodeId) {
   );
   return row ? rowToReviewRequest(row) : null;
 }
+function isNestTarget(t) {
+  return t === "nest" || t === "nest_archive";
+}
 async function deletionTargetTitle(request, titles) {
   if (request.targetType === "folder") return prettyFolderPath(request.nodeId);
-  if (request.targetType === "nest") return await nestName(request.nestId);
+  if (isNestTarget(request.targetType)) return await nestName(request.nestId);
   return titles?.get(request.nodeId) ?? await titleForNode(request.nestId, request.nodeId);
 }
 async function nestAdminEmails(nestId) {
@@ -1145,7 +1191,7 @@ async function deletionTargetContext(request, baseUrl) {
   const name = await nestName(request.nestId);
   const label = request.targetType === "folder" ? prettyFolderPath(request.nodeId) : name;
   return {
-    noun: request.targetType,
+    noun: request.targetType === "nest_archive" ? "nest" : request.targetType,
     label,
     docTitle: label,
     path: name,
@@ -1210,7 +1256,8 @@ async function notifyDeletionRequested(request, baseUrl) {
 async function notifyDeletionResolved(params) {
   try {
     const { outcome, resolvedBy, note } = params;
-    const verb = outcome === "deleted" ? "deleted" : "rejected the deletion of";
+    const archivedInstead = outcome === "deleted" && params.targetType === "nest_archive";
+    const verb = archivedInstead ? "archived" : outcome === "deleted" ? "deleted" : "rejected the deletion of";
     const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
     const recipient = params.requestedBy.toLowerCase();
     const canInbox = !(params.targetType === "nest" && outcome === "deleted");
@@ -1220,7 +1267,7 @@ async function notifyDeletionResolved(params) {
         [recipient],
         `deletion_${outcome}`,
         params.requestId,
-        outcome === "deleted" ? `"${params.docTitle}" was deleted by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+        outcome === "deleted" ? `"${params.docTitle}" was ${archivedInstead ? "archived" : "deleted"} by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
       );
     }
     void dispatchEvent({
@@ -1240,7 +1287,10 @@ async function notifyDeletionResolved(params) {
     if (recipient !== resolvedBy.toLowerCase()) {
       const link = params.baseUrl ? `${params.baseUrl}/?nest=${encodeURIComponent(params.nestId)}` : "";
       void sendEmailToRecipient(recipient, {
-        status: outcome === "deleted" ? "deletion_deleted" : "deletion_declined",
+        // The email has to agree with the inbox row and the channel line above:
+        // an honoured archive is not a deletion, and the deletion template says
+        // the nest is gone.
+        status: archivedInstead ? "deletion_archived" : outcome === "deleted" ? "deletion_deleted" : "deletion_declined",
         docTitle: params.docTitle,
         path: params.nestId,
         link: outcome === "deleted" ? link : void 0,
@@ -1261,12 +1311,13 @@ async function requestDeletion(params) {
   const db = getDb();
   const targetType = params.targetType || "document";
   const noun = targetType === "document" ? "node" : targetType === "folder" ? "folder" : "nest";
+  const kind = targetType === "nest_archive" ? "An archive request" : "A deletion request";
   const existing = await db.get(
     "SELECT id FROM deletion_requests WHERE nest_id = ? AND node_id = ? AND target_type = ? AND status = 'pending'",
     [params.nestId, params.nodeId, targetType]
   );
   if (existing) {
-    throw new ConflictError(`A deletion request is already pending for this ${noun}`);
+    throw new ConflictError(`${kind} is already pending for this ${noun}`);
   }
   const id = uuid2();
   try {
@@ -1289,7 +1340,7 @@ async function requestDeletion(params) {
       params.nodeId,
       err
     );
-    throw new ConflictError(`A deletion request is already pending for this ${noun}`);
+    throw new ConflictError(`${kind} is already pending for this ${noun}`);
   }
   const request = await getDeletionRequest(id);
   await notifyDeletionRequested(request, params.baseUrl);
@@ -1437,6 +1488,7 @@ export {
   canRequestDeletion,
   filterAccessible,
   safeJson,
+  nodeTrail,
   requireWorkflowPlane,
   seedDefaultEdgeTypes,
   parseConditionSchema,
@@ -1458,6 +1510,7 @@ export {
   getReviewQueue,
   getReviewHistory,
   getPendingReview,
+  isNestTarget,
   deletionTargetTitle,
   notifyDeletionResolved,
   requestDeletion,

package/dist/{chunk-7CPP6FIU.js → chunk-6JGQX4GA.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-LPPKPEYI.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -680,6 +680,14 @@ var STATUS_META = {
     subjectWord: "deleted",
     label: "Deleted",
     color: "#dc2626"
+  },
+  // An honoured ARCHIVE request. Deliberately not the deletion palette: the
+  // nest is intact and restorable, and red "Deleted" would tell the requester
+  // the opposite of what happened.
+  deletion_archived: {
+    subjectWord: "archived",
+    label: "Archived",
+    color: "#0891b2"
   }
 };
 var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
@@ -777,6 +785,14 @@ var TEMPLATES = {
     lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
     rows: governanceRows
   },
+  deletion_archived: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Nest details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been archived${x.byT}${x.noteT} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    lineH: (x) => `${x.doc} has been archived${x.byH}${x.noteH} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    rows: governanceRows
+  },
   steward: {
     heading: (x) => `You're now a steward of ${x.title}`,
     detailsHeader: "Details",
@@ -1259,7 +1275,9 @@ async function listNotifications(userEmail, opts = {}) {
     `SELECT n.id, n.nest_id, n.kind, n.subject_id, n.message, n.created_at, n.read_at,
             COALESCE(
               rr.node_id,
-              CASE WHEN dr.target_type = 'document' THEN dr.node_id END
+              CASE WHEN dr.target_type = 'document' THEN dr.node_id END,
+              -- A mention names the document directly; there's no request row.
+              CASE WHEN n.kind = 'mention' THEN n.subject_id END
             ) AS node_id
        FROM notifications n
        LEFT JOIN review_requests rr ON rr.id = n.subject_id
@@ -1566,6 +1584,23 @@ function parseSharedTeams(json) {
     return [];
   }
 }
+async function listSharedTeamMembers(refs) {
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
+  const byEmail = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    for (const member of parseMembers(row.members)) {
+      const key = (member.email || "").toLowerCase();
+      if (!key || byEmail.has(key)) continue;
+      byEmail.set(key, { userId: member.userId, email: member.email, name: null });
+    }
+  }
+  return [...byEmail.values()];
+}
 async function listNestTeams(nestId) {
   const db = getDb();
   const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
@@ -1750,9 +1785,29 @@ var PERMISSION_LEVELS = {
 };
 var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
 async function resolveNestAccess(nestId, userId) {
+  const access = await resolveNestAccessRaw(nestId, userId);
+  return {
+    ...access,
+    rawPermission: access.permission,
+    permission: capForArchive(access.permission, access.archived)
+  };
+}
+async function isNestArchived(nestId) {
+  const row = await getDb().get(
+    "SELECT archived_at FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.archived_at;
+}
+function capForArchive(permission, archived) {
+  if (!archived) return permission;
+  return PERMISSION_LEVELS[permission] > PERMISSION_LEVELS.read ? "read" : permission;
+}
+async function resolveNestAccessRaw(nestId, userId) {
   const row = await getDb().get(
     `SELECT n.user_id      AS owner_id,
             n.visibility   AS visibility,
+            n.archived_at  AS archived_at,
             n.shared_teams AS shared_teams,
             u.email        AS caller_email,
             nc.permission  AS collab_permission,
@@ -1779,7 +1834,9 @@ async function resolveNestAccess(nestId, userId) {
     isSteward: false,
     hasGrant: false,
     permission: "none",
-    isPublicReader: false
+    rawPermission: "none",
+    isPublicReader: false,
+    archived: false
   };
   if (!row) return absent;
   const base = {
@@ -1791,7 +1848,8 @@ async function resolveNestAccess(nestId, userId) {
     // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
     // boolean, so normalize rather than leaking the driver's shape.
     isSteward: !!row.steward_hit,
-    hasGrant: !!row.grant_hit
+    hasGrant: !!row.grant_hit,
+    archived: !!row.archived_at
   };
   if (row.owner_id === userId) {
     return { ...base, permission: "owner", isPublicReader: false };
@@ -1877,20 +1935,32 @@ async function isImportedNest(nestId) {
   );
   return !!row?.is_imported;
 }
+var MAX_NEST_NAME_LENGTH = 100;
 function plainName(name, emptyMessage = "Name cannot be empty") {
   const typed = (name ?? "").trim();
   if (!typed) throw new ValidationError(emptyMessage);
-  const stripped = typed.replace(/<[^>]*>/g, "").trim();
-  if (!stripped) {
+  if (typed.length > MAX_NEST_NAME_LENGTH) {
+    throw new ValidationError(
+      `Nest names are capped at ${MAX_NEST_NAME_LENGTH} characters`
+    );
+  }
+  if (/<\/?[a-zA-Z][^>]*>/.test(typed)) {
     throw new ValidationError(
-      "That's not a valid nest name \u2014 it's only HTML markup. Use plain text."
+      "Nest names are plain text \u2014 remove the HTML tags."
     );
   }
-  return stripped;
+  return typed;
 }
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+async function assertSlugFree(userId, slug, message, exceptId) {
+  const conflict = await getDb().get(
+    exceptId ? "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1" : "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+    exceptId ? [userId, slug, exceptId] : [userId, slug]
+  );
+  if (conflict) throw new ValidationError(message);
+}
 async function uniqueNestName(userId, baseName) {
   const db = getDb();
   let candidate = baseName;
@@ -2017,15 +2087,12 @@ async function renameNest(nestId, patch) {
     const trimmed = plainName(patch.name);
     const slug = toSlug(trimmed);
     if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
-    const conflict = await db.get(
-      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
-      [existing.user_id, slug, nestId]
+    await assertSlugFree(
+      existing.user_id,
+      slug,
+      "Another nest already uses this name. Pick a different one.",
+      nestId
     );
-    if (conflict) {
-      throw new ValidationError(
-        `Another nest already uses this name. Pick a different one.`
-      );
-    }
     updates.push("name = ?", "slug = ?");
     params.push(trimmed, slug);
   }
@@ -2053,15 +2120,11 @@ async function createNest(userId, name, description) {
       "Name must contain at least one alphanumeric character"
     );
   }
-  const conflict = await db.get(
-    "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
-    [userId, slug]
+  await assertSlugFree(
+    userId,
+    slug,
+    "You already have a nest with this name. Pick a different one."
   );
-  if (conflict) {
-    throw new ValidationError(
-      "You already have a nest with this name. Pick a different one."
-    );
-  }
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   await db.run(
     "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
@@ -2079,6 +2142,11 @@ async function importNest(userId, name) {
   const db = getDb();
   const id = uuid3();
   const slug = toSlug(nm);
+  await assertSlugFree(
+    userId,
+    slug,
+    "A nest with this name already exists. Pick a different name."
+  );
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   mkdirSync(resolveNestPath(id), { recursive: true });
   await db.run(
@@ -2088,26 +2156,79 @@ async function importNest(userId, name) {
   trackEvent("nest.import", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function listNests(userId) {
+async function pinNest(userId, nestId) {
+  const db = getDb();
+  const existing = await db.get(
+    "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+  if (existing) return;
+  try {
+    await db.run(
+      "INSERT INTO nest_pins (user_id, nest_id) VALUES (?, ?)",
+      [userId, nestId]
+    );
+  } catch (err) {
+    const now = await db.get(
+      "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+      [userId, nestId]
+    );
+    if (!now) throw err;
+  }
+}
+async function unpinNest(userId, nestId) {
+  await getDb().run(
+    "DELETE FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+}
+async function pinnedNestIds(userId) {
+  const rows = await getDb().all(
+    "SELECT nest_id FROM nest_pins WHERE user_id = ?",
+    [userId]
+  );
+  return new Set(rows.map((r) => r.nest_id));
+}
+var LIVE_ONLY = "archived_at IS NULL";
+var LIVE_ONLY_N = "n.archived_at IS NULL";
+async function listNests(userId, opts = {}) {
   const db = getDb();
+  const scope = opts.archived ? "archived_at IS NOT NULL" : LIVE_ONLY;
   if (userId === ANON_USER_ID) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
   }
   const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [userId]
     );
   }
   return await db.all(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
+    `SELECT * FROM nests WHERE (user_id = ? OR user_id = ?) AND ${scope}
+      ORDER BY created_at DESC`,
     [userId, ANON_USER_ID]
   );
 }
+async function archiveNest(nestId) {
+  await getDb().transaction(async (tx) => {
+    await tx.run(
+      "UPDATE nests SET archived_at = ? WHERE id = ? AND archived_at IS NULL",
+      [(/* @__PURE__ */ new Date()).toISOString(), nestId]
+    );
+    await tx.run(
+      `DELETE FROM deletion_requests
+        WHERE nest_id = ? AND target_type = 'nest_archive' AND status = 'pending'`,
+      [nestId]
+    );
+  });
+}
+async function restoreNest(nestId) {
+  await getDb().run("UPDATE nests SET archived_at = NULL WHERE id = ?", [nestId]);
+}
 async function nestsSharedViaTeams(userId) {
   const db = getDb();
   const teams = await db.all(
@@ -2129,6 +2250,7 @@ async function nestsSharedViaTeams(userId) {
   const candidates = await db.all(
     `SELECT * FROM nests
        WHERE user_id != ?
+         AND ${LIVE_ONLY}
          AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
     [userId, ...ids.map((id) => `%${id}%`)]
   );
@@ -2154,6 +2276,7 @@ async function listSharedNests(userId) {
        LEFT JOIN grants g
          ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
+         AND ${LIVE_ONLY_N}
          AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
     [userId, userId, userId, userId]
@@ -2167,7 +2290,8 @@ async function listSharedNests(userId) {
   }
   if (await isServerAdminUserId(userId)) {
     const anon = await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${LIVE_ONLY}
+        ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
     for (const n of anon) {
@@ -2201,11 +2325,12 @@ async function listVisibleNests(userId, opts = {}) {
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
        ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
-      WHERE n.user_id = ?
+      WHERE ${LIVE_ONLY_N}
+        AND (n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
          ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
-         ${includeAnon ? "OR n.user_id = ?" : ""}
+         ${includeAnon ? "OR n.user_id = ?" : ""})
       ORDER BY n.created_at DESC`,
     params
   );
@@ -2223,6 +2348,7 @@ async function listPublicNests(userId) {
   return await db.all(
     `SELECT n.* FROM nests n
        WHERE n.visibility = 'public'
+         AND ${LIVE_ONLY_N}
          AND n.user_id != ?
          AND NOT EXISTS (
            SELECT 1 FROM nest_collaborators nc
@@ -2250,6 +2376,10 @@ async function deleteNest(nestId) {
     } catch {
     }
     await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
+    try {
+      await tx.run("DELETE FROM nest_pins WHERE nest_id = ?", [id]);
+    } catch {
+    }
     await tx.run("DELETE FROM nests WHERE id = ?", [id]);
   });
   const path = resolveNestPath(nestId);
@@ -2283,7 +2413,7 @@ var META_BASENAMES = /* @__PURE__ */ new Set([
 ]);
 function isMetaFile(idOrPath) {
   const base = idOrPath.split(/[/\\]/).pop() ?? "";
-  return META_BASENAMES.has(base.replace(/\.md$/i, ""));
+  return META_BASENAMES.has(base.replace(/\.md$/i, "").toUpperCase());
 }
 
 // src/shared/batch.ts
@@ -2457,8 +2587,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-VZTSDUPB.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-3FVK3OD7.js");
+  const { engineCache: engineCache2 } = await import("./engine-IKZQ46P7.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-LTON57HO.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2739,7 +2869,12 @@ export {
   renameNest,
   createNest,
   importNest,
+  pinNest,
+  unpinNest,
+  pinnedNestIds,
   listNests,
+  archiveNest,
+  restoreNest,
   listSharedNests,
   listVisibleNests,
   listPublicNests,
@@ -2786,12 +2921,16 @@ export {
   replaceTeamRoster,
   updateMemberRole,
   removeMember,
+  parseSharedTeams,
+  listSharedTeamMembers,
   listNestTeams,
   shareTeamWithNest,
   unshareTeamFromNest,
   resolveTeamRolesForUser,
   isServerAdminUserId,
   resolveNestAccess,
+  isNestArchived,
+  capForArchive,
   resolveNestPermission,
   permissionLevel,
   isPublicReader