@promptowl/contextnest-community 1.20.0 → 1.21.1

package/README.md

@@ -15,7 +15,7 @@ ContextNest Community Edition is a self-hosted server that lets you:
 - Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`
+- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`, or register the nest in the ctx CLI (`ctx vault add <alias> --url <server>/nests/<id>/mcp --bearer-env CONTEXTNEST_API_KEY`, then `ctx query "#tag" --vault <alias>`)
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
 The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.

package/dist/{adapter.postgres-YOODX2BI.js → adapter.postgres-6VZCMPQL.js}

@@ -5,7 +5,17 @@ function translatePlaceholders(sql) {
   let n = 0;
   for (let i = 0; i < sql.length; i++) {
     const ch = sql[i];
-    if (ch === "'") {
+    if (!inStr && ch === "-" && sql[i + 1] === "-") {
+      const end = sql.indexOf("\n", i);
+      const stop = end === -1 ? sql.length : end;
+      out += sql.slice(i, stop);
+      i = stop - 1;
+    } else if (!inStr && ch === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      const stop = end === -1 ? sql.length : end + 2;
+      out += sql.slice(i, stop);
+      i = stop - 1;
+    } else if (ch === "'") {
       inStr = !inStr;
       out += ch;
     } else if (ch === "?" && !inStr) {

package/dist/{chunk-KHMSDTJJ.js → chunk-FXYFLUE7.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-7CPP6FIU.js";
+} from "./chunk-G4AL7ETF.js";
 import {
   getDb
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-SKZ7YYT4.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -136,6 +136,44 @@ async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   );
   await db.run(sql, [nestId, nodeId, version, approvedBy]);
 }
+async function getSealedVersion(nestId, nodeId) {
+  const approved = await getApprovedVersion(nestId, nodeId);
+  if (approved != null) return approved;
+  const db = getDb();
+  const row = await db.get(
+    `SELECT MAX(version) as v FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND status IN ('published', 'approved')`,
+    [nestId, nodeId]
+  );
+  return row?.v ?? null;
+}
+async function deleteSupersededDrafts(nestId, nodeId, belowVersion) {
+  const db = getDb();
+  await db.run(
+    `DELETE FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND status = 'draft' AND version < ?`,
+    [nestId, nodeId, belowVersion]
+  );
+}
+async function deleteUnsealedVersions(nestId, nodeId, sealedVersion) {
+  const db = getDb();
+  await db.run(
+    `DELETE FROM node_versions
+      WHERE nest_id = ? AND node_id = ? AND version > ?
+        AND status IN ('draft', 'rejected', 'pending_review')`,
+    [nestId, nodeId, sealedVersion]
+  );
+}
+async function hasUnsealedDraft(nestId, nodeId) {
+  const db = getDb();
+  const row = await db.get(
+    `SELECT status FROM node_versions
+      WHERE nest_id = ? AND node_id = ?
+      ORDER BY version DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
+  return row?.status === "draft" || row?.status === "rejected" || row?.status === "pending_review";
+}
 async function checkConflict(nestId, nodeId, baseVersion) {
   const db = getDb();
   const current = await db.get(
@@ -265,20 +303,16 @@ async function listMyDrafts(params) {
            WHERE r.nest_id = v.nest_id AND r.node_id = v.node_id
              AND r.status = 'pending')`;
   const args = [params.authorEmail.toLowerCase(), ...params.nestIds];
-  const total = Number(
-    (await db.get(
-      `SELECT COUNT(*) as c FROM node_versions v ${where}`,
-      args
-    )).c
-  );
   const limit = Math.min(Math.max(params.limit ?? 25, 1), 100);
   const offset = Math.max(params.offset ?? 0, 0);
+  const q = params.q?.trim().toLowerCase() || "";
+  const SCAN_CAP = 500;
   const rows = await db.all(
     `SELECT v.nest_id, v.node_id, v.status, v.version, v.created_at
        FROM node_versions v ${where}
       ORDER BY v.created_at DESC
-      LIMIT ? OFFSET ?`,
-    [...args, limit, offset]
+      LIMIT ?`,
+    [...args, SCAN_CAP]
   );
   const titlesByNest = new Map(
     await Promise.all(
@@ -290,7 +324,7 @@ async function listMyDrafts(params) {
       )
     )
   );
-  const drafts = rows.filter((r) => titlesByNest.get(r.nest_id)?.has(r.node_id)).map((r) => ({
+  let drafts = rows.filter((r) => titlesByNest.get(r.nest_id)?.has(r.node_id)).map((r) => ({
     nestId: r.nest_id,
     nodeId: r.node_id,
     title: titlesByNest.get(r.nest_id).get(r.node_id) || r.node_id,
@@ -300,7 +334,17 @@ async function listMyDrafts(params) {
     version: Number(r.version),
     updatedAt: r.created_at
   }));
-  return { drafts, total };
+  if (q) {
+    drafts = drafts.filter(
+      (d) => [d.title, params.nestNames?.get(d.nestId) ?? "", d.nodeId].some(
+        (s) => s.toLowerCase().includes(q)
+      )
+    );
+  }
+  if (params.sort === "title") {
+    drafts.sort((a, b) => a.title.localeCompare(b.title));
+  }
+  return { drafts: drafts.slice(offset, offset + limit), total: drafts.length };
 }
 function rowToVersion(row) {
   return {
@@ -327,6 +371,10 @@ export {
   getApprovedVersion,
   getApprovedVersions,
   setApprovedVersion,
+  getSealedVersion,
+  deleteSupersededDrafts,
+  deleteUnsealedVersions,
+  hasUnsealedDraft,
   checkConflict,
   getNodeTags,
   getDisplayStatus,

package/dist/{chunk-7CPP6FIU.js → chunk-G4AL7ETF.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-SKZ7YYT4.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -680,6 +680,14 @@ var STATUS_META = {
     subjectWord: "deleted",
     label: "Deleted",
     color: "#dc2626"
+  },
+  // An honoured ARCHIVE request. Deliberately not the deletion palette: the
+  // nest is intact and restorable, and red "Deleted" would tell the requester
+  // the opposite of what happened.
+  deletion_archived: {
+    subjectWord: "archived",
+    label: "Archived",
+    color: "#0891b2"
   }
 };
 var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
@@ -777,6 +785,14 @@ var TEMPLATES = {
     lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
     rows: governanceRows
   },
+  deletion_archived: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Nest details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been archived${x.byT}${x.noteT} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    lineH: (x) => `${x.doc} has been archived${x.byH}${x.noteH} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    rows: governanceRows
+  },
   steward: {
     heading: (x) => `You're now a steward of ${x.title}`,
     detailsHeader: "Details",
@@ -1259,7 +1275,9 @@ async function listNotifications(userEmail, opts = {}) {
     `SELECT n.id, n.nest_id, n.kind, n.subject_id, n.message, n.created_at, n.read_at,
             COALESCE(
               rr.node_id,
-              CASE WHEN dr.target_type = 'document' THEN dr.node_id END
+              CASE WHEN dr.target_type = 'document' THEN dr.node_id END,
+              -- A mention names the document directly; there's no request row.
+              CASE WHEN n.kind = 'mention' THEN n.subject_id END
             ) AS node_id
        FROM notifications n
        LEFT JOIN review_requests rr ON rr.id = n.subject_id
@@ -1566,6 +1584,23 @@ function parseSharedTeams(json) {
     return [];
   }
 }
+async function listSharedTeamMembers(refs) {
+  const ids = [...new Set(refs.map((r) => r.teamId).filter(Boolean))];
+  if (ids.length === 0) return [];
+  const rows = await getDb().all(
+    `SELECT members FROM teams WHERE id IN (${ids.map(() => "?").join(",")})`,
+    ids
+  );
+  const byEmail = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    for (const member of parseMembers(row.members)) {
+      const key = (member.email || "").toLowerCase();
+      if (!key || byEmail.has(key)) continue;
+      byEmail.set(key, { userId: member.userId, email: member.email, name: null });
+    }
+  }
+  return [...byEmail.values()];
+}
 async function listNestTeams(nestId) {
   const db = getDb();
   const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
@@ -1750,9 +1785,29 @@ var PERMISSION_LEVELS = {
 };
 var higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
 async function resolveNestAccess(nestId, userId) {
+  const access = await resolveNestAccessRaw(nestId, userId);
+  return {
+    ...access,
+    rawPermission: access.permission,
+    permission: capForArchive(access.permission, access.archived)
+  };
+}
+async function isNestArchived(nestId) {
+  const row = await getDb().get(
+    "SELECT archived_at FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.archived_at;
+}
+function capForArchive(permission, archived) {
+  if (!archived) return permission;
+  return PERMISSION_LEVELS[permission] > PERMISSION_LEVELS.read ? "read" : permission;
+}
+async function resolveNestAccessRaw(nestId, userId) {
   const row = await getDb().get(
     `SELECT n.user_id      AS owner_id,
             n.visibility   AS visibility,
+            n.archived_at  AS archived_at,
             n.shared_teams AS shared_teams,
             u.email        AS caller_email,
             nc.permission  AS collab_permission,
@@ -1779,7 +1834,9 @@ async function resolveNestAccess(nestId, userId) {
     isSteward: false,
     hasGrant: false,
     permission: "none",
-    isPublicReader: false
+    rawPermission: "none",
+    isPublicReader: false,
+    archived: false
   };
   if (!row) return absent;
   const base = {
@@ -1791,7 +1848,8 @@ async function resolveNestAccess(nestId, userId) {
     // Postgres returns integer 1, SQLite returns 1 — both truthy, neither a
     // boolean, so normalize rather than leaking the driver's shape.
     isSteward: !!row.steward_hit,
-    hasGrant: !!row.grant_hit
+    hasGrant: !!row.grant_hit,
+    archived: !!row.archived_at
   };
   if (row.owner_id === userId) {
     return { ...base, permission: "owner", isPublicReader: false };
@@ -1877,20 +1935,32 @@ async function isImportedNest(nestId) {
   );
   return !!row?.is_imported;
 }
+var MAX_NEST_NAME_LENGTH = 100;
 function plainName(name, emptyMessage = "Name cannot be empty") {
   const typed = (name ?? "").trim();
   if (!typed) throw new ValidationError(emptyMessage);
-  const stripped = typed.replace(/<[^>]*>/g, "").trim();
-  if (!stripped) {
+  if (typed.length > MAX_NEST_NAME_LENGTH) {
+    throw new ValidationError(
+      `Nest names are capped at ${MAX_NEST_NAME_LENGTH} characters`
+    );
+  }
+  if (/<\/?[a-zA-Z][^>]*>/.test(typed)) {
     throw new ValidationError(
-      "That's not a valid nest name \u2014 it's only HTML markup. Use plain text."
+      "Nest names are plain text \u2014 remove the HTML tags."
     );
   }
-  return stripped;
+  return typed;
 }
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+async function assertSlugFree(userId, slug, message, exceptId) {
+  const conflict = await getDb().get(
+    exceptId ? "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1" : "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+    exceptId ? [userId, slug, exceptId] : [userId, slug]
+  );
+  if (conflict) throw new ValidationError(message);
+}
 async function uniqueNestName(userId, baseName) {
   const db = getDb();
   let candidate = baseName;
@@ -2017,15 +2087,12 @@ async function renameNest(nestId, patch) {
     const trimmed = plainName(patch.name);
     const slug = toSlug(trimmed);
     if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
-    const conflict = await db.get(
-      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
-      [existing.user_id, slug, nestId]
+    await assertSlugFree(
+      existing.user_id,
+      slug,
+      "Another nest already uses this name. Pick a different one.",
+      nestId
     );
-    if (conflict) {
-      throw new ValidationError(
-        `Another nest already uses this name. Pick a different one.`
-      );
-    }
     updates.push("name = ?", "slug = ?");
     params.push(trimmed, slug);
   }
@@ -2053,15 +2120,11 @@ async function createNest(userId, name, description) {
       "Name must contain at least one alphanumeric character"
     );
   }
-  const conflict = await db.get(
-    "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
-    [userId, slug]
+  await assertSlugFree(
+    userId,
+    slug,
+    "You already have a nest with this name. Pick a different one."
   );
-  if (conflict) {
-    throw new ValidationError(
-      "You already have a nest with this name. Pick a different one."
-    );
-  }
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   await db.run(
     "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
@@ -2079,6 +2142,11 @@ async function importNest(userId, name) {
   const db = getDb();
   const id = uuid3();
   const slug = toSlug(nm);
+  await assertSlugFree(
+    userId,
+    slug,
+    "A nest with this name already exists. Pick a different name."
+  );
   const visibility = userId === ANON_USER_ID ? "public" : "private";
   mkdirSync(resolveNestPath(id), { recursive: true });
   await db.run(
@@ -2088,26 +2156,79 @@ async function importNest(userId, name) {
   trackEvent("nest.import", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function listNests(userId) {
+async function pinNest(userId, nestId) {
+  const db = getDb();
+  const existing = await db.get(
+    "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+  if (existing) return;
+  try {
+    await db.run(
+      "INSERT INTO nest_pins (user_id, nest_id) VALUES (?, ?)",
+      [userId, nestId]
+    );
+  } catch (err) {
+    const now = await db.get(
+      "SELECT 1 FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+      [userId, nestId]
+    );
+    if (!now) throw err;
+  }
+}
+async function unpinNest(userId, nestId) {
+  await getDb().run(
+    "DELETE FROM nest_pins WHERE user_id = ? AND nest_id = ?",
+    [userId, nestId]
+  );
+}
+async function pinnedNestIds(userId) {
+  const rows = await getDb().all(
+    "SELECT nest_id FROM nest_pins WHERE user_id = ?",
+    [userId]
+  );
+  return new Set(rows.map((r) => r.nest_id));
+}
+var LIVE_ONLY = "archived_at IS NULL";
+var LIVE_ONLY_N = "n.archived_at IS NULL";
+async function listNests(userId, opts = {}) {
   const db = getDb();
+  const scope = opts.archived ? "archived_at IS NOT NULL" : LIVE_ONLY;
   if (userId === ANON_USER_ID) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
   }
   const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
     return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
       [userId]
     );
   }
   return await db.all(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
+    `SELECT * FROM nests WHERE (user_id = ? OR user_id = ?) AND ${scope}
+      ORDER BY created_at DESC`,
     [userId, ANON_USER_ID]
   );
 }
+async function archiveNest(nestId) {
+  await getDb().transaction(async (tx) => {
+    await tx.run(
+      "UPDATE nests SET archived_at = ? WHERE id = ? AND archived_at IS NULL",
+      [(/* @__PURE__ */ new Date()).toISOString(), nestId]
+    );
+    await tx.run(
+      `DELETE FROM deletion_requests
+        WHERE nest_id = ? AND target_type = 'nest_archive' AND status = 'pending'`,
+      [nestId]
+    );
+  });
+}
+async function restoreNest(nestId) {
+  await getDb().run("UPDATE nests SET archived_at = NULL WHERE id = ?", [nestId]);
+}
 async function nestsSharedViaTeams(userId) {
   const db = getDb();
   const teams = await db.all(
@@ -2129,6 +2250,7 @@ async function nestsSharedViaTeams(userId) {
   const candidates = await db.all(
     `SELECT * FROM nests
        WHERE user_id != ?
+         AND ${LIVE_ONLY}
          AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
     [userId, ...ids.map((id) => `%${id}%`)]
   );
@@ -2154,6 +2276,7 @@ async function listSharedNests(userId) {
        LEFT JOIN grants g
          ON g.nest_id = n.id AND g.user_id = ?
        WHERE n.user_id != ?
+         AND ${LIVE_ONLY_N}
          AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL OR g.id IS NOT NULL)
        ORDER BY n.created_at DESC`,
     [userId, userId, userId, userId]
@@ -2167,7 +2290,8 @@ async function listSharedNests(userId) {
   }
   if (await isServerAdminUserId(userId)) {
     const anon = await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      `SELECT * FROM nests WHERE user_id = ? AND ${LIVE_ONLY}
+        ORDER BY created_at DESC`,
       [ANON_USER_ID]
     );
     for (const n of anon) {
@@ -2201,11 +2325,12 @@ async function listVisibleNests(userId, opts = {}) {
          ON s.nest_id = n.id AND s.is_active = 1
         AND LOWER(s.user_email) = LOWER(u.email)
        ${opts.readable ? "LEFT JOIN grants g ON g.nest_id = n.id AND g.user_id = ?" : ""}
-      WHERE n.user_id = ?
+      WHERE ${LIVE_ONLY_N}
+        AND (n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
          ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
-         ${includeAnon ? "OR n.user_id = ?" : ""}
+         ${includeAnon ? "OR n.user_id = ?" : ""})
       ORDER BY n.created_at DESC`,
     params
   );
@@ -2223,6 +2348,7 @@ async function listPublicNests(userId) {
   return await db.all(
     `SELECT n.* FROM nests n
        WHERE n.visibility = 'public'
+         AND ${LIVE_ONLY_N}
          AND n.user_id != ?
          AND NOT EXISTS (
            SELECT 1 FROM nest_collaborators nc
@@ -2250,6 +2376,10 @@ async function deleteNest(nestId) {
     } catch {
     }
     await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
+    try {
+      await tx.run("DELETE FROM nest_pins WHERE nest_id = ?", [id]);
+    } catch {
+    }
     await tx.run("DELETE FROM nests WHERE id = ?", [id]);
   });
   const path = resolveNestPath(nestId);
@@ -2283,7 +2413,7 @@ var META_BASENAMES = /* @__PURE__ */ new Set([
 ]);
 function isMetaFile(idOrPath) {
   const base = idOrPath.split(/[/\\]/).pop() ?? "";
-  return META_BASENAMES.has(base.replace(/\.md$/i, ""));
+  return META_BASENAMES.has(base.replace(/\.md$/i, "").toUpperCase());
 }
 
 // src/shared/batch.ts
@@ -2457,8 +2587,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-VZTSDUPB.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-3FVK3OD7.js");
+  const { engineCache: engineCache2 } = await import("./engine-WXWER2V7.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-Y757EFMS.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2739,7 +2869,12 @@ export {
   renameNest,
   createNest,
   importNest,
+  pinNest,
+  unpinNest,
+  pinnedNestIds,
   listNests,
+  archiveNest,
+  restoreNest,
   listSharedNests,
   listVisibleNests,
   listPublicNests,
@@ -2786,12 +2921,16 @@ export {
   replaceTeamRoster,
   updateMemberRole,
   removeMember,
+  parseSharedTeams,
+  listSharedTeamMembers,
   listNestTeams,
   shareTeamWithNest,
   unshareTeamFromNest,
   resolveTeamRolesForUser,
   isServerAdminUserId,
   resolveNestAccess,
+  isNestArchived,
+  capForArchive,
   resolveNestPermission,
   permissionLevel,
   isPublicReader

package/dist/{chunk-3LUUJUWS.js → chunk-IVXVOXYN.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YVMSM7LS.js";
 import {
   getDb
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-SKZ7YYT4.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";
@@ -11,7 +11,10 @@ var rank = (r) => r === "write" ? 2 : 1;
 async function resolveNodeGrant(nestId, userId, nodeId) {
   if (!userId || !nodeId) return null;
   const rows = await getDb().all(
-    "SELECT target, role FROM grants WHERE nest_id = ? AND user_id = ?",
+    `SELECT g.target, g.role, n.archived_at
+       FROM grants g
+       JOIN nests n ON n.id = g.nest_id
+      WHERE g.nest_id = ? AND g.user_id = ?`,
     [nestId, userId]
   );
   let best = null;
@@ -20,6 +23,7 @@ async function resolveNodeGrant(nestId, userId, nodeId) {
       if (!best || rank(r.role) > rank(best)) best = r.role;
     }
   }
+  if (best === "write" && rows[0]?.archived_at) return "read";
   return best;
 }
 async function listUserGrants(nestId, userId) {

package/dist/{chunk-O5DYL7ZG.js → chunk-LL2JU5AA.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-7CPP6FIU.js";
+} from "./chunk-G4AL7ETF.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-XCFKS65Y.js";
+} from "./chunk-SKZ7YYT4.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";