@promptowl/contextnest-community 1.21.1 → 1.23.0

package/CONFIGURATION.md

@@ -59,7 +59,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to the database (`server_settings` table) so it survives a rebuild and reaches every instance — see [Runtime settings persistence](#runtime-settings-persistence). Setting it here in the deploy environment takes precedence on the next boot. |
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `MANUAL_SIGN_IN` | `open` | Email + password sign-in mode. `open` = anyone may log in and self-register a new account; `invite-only` = existing/invited users may log in but brand-new self-registration returns `403` (the admin provisions accounts via invite/share/steward and shares the password — there is no self-service "set password", which would be account takeover without email verification); `disabled` = no email/password sign-in at all (`POST /auth/login` and `POST /auth/register` return `403`). Independent of `PROMPTOWL_SIGN_IN_GATE`, so the two methods are controlled separately (e.g. `invite-only` manual + `admin-only` PromptOwl). Also settable from Settings → General. The server refuses `disabled` while PromptOwl sign-in is also `disabled` (that would leave no way to log in). Unknown values fall back to `open`. |
-| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
+| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Legacy — official deployment only, leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. Superseded by the DB-backed **Settings → Community sites** list (`/admin/community-sites`), which supports multiple official sites each with their own name/url/secret/active flag — this env var still works as an implicit extra site for backward compatibility. When no site is configured (env var unset and no DB rows), `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. See `API.md → Community sites`. |
 | `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — whenever a ticket-signing secret is set (`OFFICIAL_COMMUNITY_SSO_SECRET` on the official deployment, `MCP_SIGNING_SECRET` on a self-hosted one); with neither set no ticket verifies at all, so the audience check is moot. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever email- or invite-gated publish links are used.** The magic link mailed by `POST /p/:slug/gate` is built from it; unset, it falls back to the request origin, so a proxy forwarding an attacker-supplied `Host` would send the recipient a one-time access token pointing at the attacker's domain — the classic reset-link poisoning. (4) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. |
 | `OIDC_ENABLED` | `false` | Turn on generic OIDC single sign-on (`GET /auth/oidc/login` / `GET /auth/oidc/callback`). Requires `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET` — the login-page button only appears once all three are set. Also editable from Settings → Single sign-on. See [Single sign-on (OIDC)](#single-sign-on-oidc). |
 | `OIDC_ISSUER` | `""` | OIDC issuer URL, e.g. `https://login.microsoftonline.com/<tenant>/v2.0` (Microsoft Entra ID) or `https://accounts.google.com` (Google). **`https://` only** — a non-https value is rejected with a warning and SSO stays off. Must serve `<issuer>/.well-known/openid-configuration`. |
@@ -67,6 +67,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `OIDC_CLIENT_SECRET` | `""` | Client secret from your IdP app registration. Write-only on the Settings API — `GET /admin/settings` reports only `oidc_client_secret_set: true/false`, never the value. |
 | `OIDC_ALLOWED_DOMAINS` | `""` (any) | Comma-separated email-domain allowlist, e.g. `acme.com, contractors.acme.com`. When set, only accounts whose asserted email is on a listed domain may sign in (others bounce with `domain_not_allowed`). Empty allows any domain the IdP asserts. |
 | `OIDC_AUTO_PROVISION` | `true` | Create a user automatically on first successful OIDC sign-in (display name from the `name` claim). Set `false` to allow only pre-existing (invited/registered) users — unknown emails bounce with `not_invited`. |
+| `PEOPLE_SUGGEST_ALL_USERS` | `false` | Widen the add-a-person suggestions (`GET /people/suggest`, behind every "add a person" field) and the `@mention` pickers from *people the caller already shares a nest or team with* to **every registered account on this server**. **Leave this off on a server that hosts more than one organisation** — the PromptOwl-hosted deployment does, and turning it on there would offer one customer's staff another customer's email addresses. On a single-company self-hosted server the whole directory is the useful answer, which is what this is for. Suggestions never gate the invite either way: an address that appears in no list is still valid to type. In the `@` pickers the widening is an invite: a write+ author mentioning someone off the nest adds them as a `read` collaborator before notifying (a read-only author's mention of an outsider reaches nobody). A server admin always sees every account (they administer them). Also editable from **Settings → General → People directory**. |
 | `OIDC_DEPARTMENT_TAGGING` | `false` | Auto-tag newly **created** documents with the creator's directory department: `dept:<slugified-department>` (lowercase, spaces → dashes, e.g. `dept:customer-success`) is appended to the document's tags, deduped against user-supplied tags. Applies on create only — never on update, never retroactively — and a user without a stored department is a silent no-op. The department is captured from the OIDC `department` ID-token claim on every SSO login (a login without the claim clears it, so directory moves propagate), so this is only meaningful when your IdP emits that claim — see [Department auto-tagging](#department-auto-tagging). Also editable from Settings → Single sign-on. |
 | `SSO_TOKEN_EXCHANGE_ENABLED` | `false` | Master switch for `POST /auth/token-exchange` — an external agent exchanges an IdP ID token for a short-lived MCP bearer. Also needs `MCP_SIGNING_SECRET` and at least one provider; otherwise the endpoint returns `404`. Security-critical — see [Agent SSO (token exchange)](#agent-sso-token-exchange). |
 | `MCP_SIGNING_SECRET` | `""` | HMAC secret **this** server signs its minted MCP bearers with (distinct from `OFFICIAL_COMMUNITY_SSO_SECRET`, so self-hosted deployments can issue their own). Long random string. `/index` and `/mcp` accept a ticket signed with either secret. Write-only on the Settings API. **Clearing it is the revocation switch** — turning `SSO_TOKEN_EXCHANGE_ENABLED` off stops minting but already-minted bearers stay valid until they expire. |
@@ -76,6 +77,8 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to an optional `.env` file the server reads at boot (in addition to `$cwd/.env`). **No longer used for persistence** — the License Setup Page and Settings page now write to the database, not this file (see [Runtime settings persistence](#runtime-settings-persistence)). Kept for operators who bootstrap config from a mounted `.env`. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
+| `POSTHOG_KEY` | `""` | PostHog project API key for product analytics in the UI. Empty = analytics off (the default — a self-hosted install brings its own project). Served to the browser via `/health`, but only while `TELEMETRY_ENABLED` is on, so that switch turns off everything this server sends outward. Also editable from Settings → Advanced. |
+| `POSTHOG_HOST` | `https://us.i.posthog.com` | PostHog ingestion host. Set it to your own region or self-hosted PostHog. Also editable from Settings → Advanced. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `FRAME_ANCESTORS` | `'self'` | Which origins may embed this server in an iframe, sent as CSP `frame-ancestors`. The default lets nothing but this origin frame the UI, which blocks clickjacking. Deployments that are meant to be embedded list the embedding origin — e.g. the PromptOwl Data Room iframes ContextNest, so that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`. Comma-separated; `'self'` is always included; `*` allows any site and disables the protection. Note the embedding page must be **same-site** (a sibling subdomain) for the session cookie to survive inside the frame — a genuinely cross-domain embed will render the login page no matter what this is set to. |
@@ -150,7 +153,8 @@ plain-text `fallbackText` for clients that cannot render cards.
 Per-nest connector rows post the same Adaptive Card format to a nest-specific
 webhook, with per-event filtering: `POST /nests/:id/connectors` with a JSON
 body like `{"channel": "teams", "url": "https://…", "events":
-["review_requested", "review_rejected"]}` (`events` may also be `["*"]`; the
+["review_requested", "review_rejected"]}` (`events` is any of `review_requested`,
+`review_approved`, `review_rejected`, `run_failed`, `mention`, or `["*"]`; the
 `url` may be an `env:KEY` reference into the nest's env store). Manage rows
 with `GET`/`PATCH`/`DELETE` on the same path.
 

package/README.md

@@ -165,4 +165,4 @@ The Software injects content into large language models. AI output may be inaccu
 **Copyright © 2026 Promptowl LLC.** All rights reserved.
 "ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
 
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-LL2JU5AA.js → chunk-2YPY2HGZ.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-G4AL7ETF.js";
+} from "./chunk-QLXC6542.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-FXYFLUE7.js → chunk-5CVZMHHB.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-G4AL7ETF.js";
+} from "./chunk-QLXC6542.js";
 import {
   getDb
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-NH7L2S6S.js → chunk-MLQU4I5J.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-LL2JU5AA.js";
+} from "./chunk-2YPY2HGZ.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-IVXVOXYN.js";
+} from "./chunk-UOMW7TT6.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-FXYFLUE7.js";
+} from "./chunk-5CVZMHHB.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -26,6 +26,7 @@ import {
   insertOrReplace,
   isPublicReader,
   isStewardshipEnabled,
+  markNotificationsReadBySubject,
   nestName,
   notifyEmailForNest,
   notifyReviewRequested,
@@ -36,7 +37,7 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-G4AL7ETF.js";
+} from "./chunk-QLXC6542.js";
 import {
   ConflictError,
   NotFoundError,
@@ -45,7 +46,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -131,7 +132,17 @@ async function nodeTrail(db, nestId, ids) {
     for (const r of rows) if (r.title) titles.set(r.node_id, r.title);
   } catch {
   }
-  return ids.map((id) => `"${titles.get(id) ?? id}"`).join(" \u2192 ");
+  const label = (id) => titles.get(id) ?? id;
+  const idsPerLabel = /* @__PURE__ */ new Map();
+  for (const id of unique) {
+    const l = label(id);
+    (idsPerLabel.get(l) ?? idsPerLabel.set(l, /* @__PURE__ */ new Set()).get(l)).add(id);
+  }
+  return ids.map((id) => {
+    const l = label(id);
+    const ambiguous = (idsPerLabel.get(l)?.size ?? 0) > 1;
+    return ambiguous && l !== id ? `"${l}" (${id})` : `"${l}"`;
+  }).join(" \u2192 ");
 }
 async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   const db = getDb();
@@ -147,7 +158,9 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   for (const r of rows) {
     if (r.from_node === r.to_node) {
       throw new ConflictError(
-        `cycle: ${await nodeTrail(db, nestId, [r.from_node])} cannot flow into itself`
+        `This step loops back on itself: ${await nodeTrail(db, nestId, [r.from_node])}.
+
+A flow can't return to a step it already ran.`
       );
     }
     nodes.add(r.from_node);
@@ -170,7 +183,7 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   }
   if (removed < nodes.size) {
     throw new ConflictError(
-      "cycle: enabling flow on this edge type would create a cycle in the flow graph \u2014 flow edges must form a DAG"
+      "Making this connection type a flow would loop these steps back on each other. A flow can't return to a step it already ran."
     );
   }
 }
@@ -534,6 +547,7 @@ async function notifySlack(text) {
 
 // src/notify/dispatch.ts
 var EVENT_EMOJI = {
+  mention: ":speech_balloon:",
   review_requested: ":memo:",
   review_approved: ":white_check_mark:",
   review_rejected: ":x:",
@@ -600,6 +614,27 @@ async function resolveUrl(nestId, raw) {
   }
   return isSafeConnectorUrl(raw) ? raw : null;
 }
+async function hasAnyConnector(nestId, kind) {
+  if ((config.SLACK_WEBHOOK_URL || config.MSTEAMS_WEBHOOK_URL) && !DIGEST_DELIVERED_KINDS.has(kind)) {
+    return true;
+  }
+  try {
+    const rows = await getDb().all(
+      "SELECT events FROM connectors WHERE nest_id = ? AND enabled = 1",
+      [nestId]
+    );
+    return rows.some((r) => {
+      try {
+        const kinds = JSON.parse(r.events);
+        return kinds.includes("*") || kinds.includes(kind);
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
 async function dispatchEvent(ev) {
   const db = getDb();
   const nestName2 = await resolveNestName(ev.nestId);
@@ -1201,7 +1236,8 @@ async function deletionTargetContext(request, baseUrl) {
 async function notifyDeletionRequested(request, baseUrl) {
   try {
     const ctx = await deletionTargetContext(request, baseUrl);
-    const line = `Deletion requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"`;
+    const isArchiveRequest = request.targetType === "nest_archive";
+    const line = isArchiveRequest ? `Archive requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"` : `Deletion requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"`;
     const admins = (await nestAdminEmails(request.nestId)).filter(
       (e) => e !== request.requestedBy.toLowerCase()
     );
@@ -1210,7 +1246,7 @@ async function notifyDeletionRequested(request, baseUrl) {
       admins,
       "deletion_requested",
       request.id,
-      `${ctx.noun === "document" ? "" : `${ctx.noun} `}"${ctx.docTitle}" was flagged for deletion by ${request.requestedBy} \u2014 "${request.reason}"`
+      isArchiveRequest ? `${ctx.noun} "${ctx.docTitle}" was requested to be archived by ${request.requestedBy} \u2014 "${request.reason}"` : `${ctx.noun === "document" ? "" : `${ctx.noun} `}"${ctx.docTitle}" was flagged for deletion by ${request.requestedBy} \u2014 "${request.reason}"`
     );
     void dispatchEvent({
       kind: "deletion_requested",
@@ -1257,9 +1293,11 @@ async function notifyDeletionResolved(params) {
   try {
     const { outcome, resolvedBy, note } = params;
     const archivedInstead = outcome === "deleted" && params.targetType === "nest_archive";
-    const verb = archivedInstead ? "archived" : outcome === "deleted" ? "deleted" : "rejected the deletion of";
+    const isArchiveRequest = params.targetType === "nest_archive";
+    const verb = archivedInstead ? "archived" : outcome === "deleted" ? "deleted" : isArchiveRequest ? "declined the archive request for" : "rejected the deletion of";
     const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
     const recipient = params.requestedBy.toLowerCase();
+    await markNotificationsReadBySubject(params.requestId, "deletion_requested");
     const canInbox = !(params.targetType === "nest" && outcome === "deleted");
     if (canInbox && recipient !== resolvedBy.toLowerCase()) {
       await inboxInsert(
@@ -1267,7 +1305,7 @@ async function notifyDeletionResolved(params) {
         [recipient],
         `deletion_${outcome}`,
         params.requestId,
-        outcome === "deleted" ? `"${params.docTitle}" was ${archivedInstead ? "archived" : "deleted"} by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+        outcome === "deleted" ? `"${params.docTitle}" was ${archivedInstead ? "archived" : "deleted"} by ${resolvedBy} \u2014 your request was accepted` : `Your ${isArchiveRequest ? "archive" : "deletion"} request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
       );
     }
     void dispatchEvent({
@@ -1436,6 +1474,7 @@ async function declineDeletion(params) {
       requestedBy: declined.requestedBy,
       resolvedBy: params.declinedBy,
       requestId: declined.id,
+      targetType: declined.targetType,
       note: params.note,
       baseUrl: params.baseUrl
     });
@@ -1497,6 +1536,7 @@ export {
   envRoutes,
   envValues,
   isSafeConnectorUrl,
+  hasAnyConnector,
   dispatchEvent,
   sendTestNotification,
   notifyNestEvent,

package/dist/{chunk-G4AL7ETF.js → chunk-QLXC6542.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -138,6 +138,12 @@ function startTelemetryLoop() {
 function nowExpr(db) {
   return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
 }
+function suffixOf(db, column, length) {
+  return db.dialect === "sqlite" ? `substr(${column}, -${length})` : `right(${column}, ${length})`;
+}
+function nowMsExpr(db) {
+  return db.dialect === "sqlite" ? "strftime('%Y-%m-%d %H:%M:%f','now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS.MS')";
+}
 function insertOrIgnore(db, insertSql) {
   return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
 }
@@ -657,6 +663,7 @@ function renderText(message) {
 }
 var STATUS_META = {
   approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
+  mention: { subjectWord: "mentioned you", label: "Mention", color: "#7c3aed" },
   rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
   pending_review: {
     subjectWord: "awaiting review",
@@ -715,6 +722,17 @@ var TEMPLATES = {
     lineH: (x) => `${x.doc}${x.vH} has been approved${x.byH}${x.noteH}.`,
     rows: governanceRows
   },
+  // A mention names one person, so this is the one template addressed to
+  // "you". `note` carries the comment's own words when there are any — a
+  // mention with no context reads as a summons.
+  mention: {
+    heading: (x) => `${x.d.actor || "Someone"} mentioned you in ${x.title}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `You were mentioned in ${x.title}${x.byT}${x.noteT}.`,
+    lineH: (x) => `You were mentioned in ${x.doc}${x.byH}${x.noteH}.`,
+    rows: (x) => [plainRow("Nest", x.d.path)]
+  },
   rejected: {
     heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
     detailsHeader: "Document details",
@@ -1304,6 +1322,12 @@ async function markNotificationsRead(userEmail, ids) {
     );
   }
 }
+async function markNotificationsReadBySubject(subjectId, kind) {
+  await getDb().run(
+    "UPDATE notifications SET read_at = ? WHERE subject_id = ? AND kind = ? AND read_at IS NULL",
+    [(/* @__PURE__ */ new Date()).toISOString(), subjectId, kind]
+  );
+}
 
 // src/governance/teams-service.ts
 var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
@@ -1879,8 +1903,9 @@ async function resolveNestAccessRaw(nestId, userId) {
     return { ...base, permission: best, isPublicReader: false };
   }
   if (base.isSteward) best = higher(best, "read");
-  if (row.visibility === "public") best = higher(best, "read");
-  const isPublicReader2 = row.visibility === "public" && !row.collab_permission && !base.isSteward;
+  const visibilityRead = row.visibility === "public" || row.visibility === "org" && userId !== ANON_USER_ID;
+  if (visibilityRead) best = higher(best, "read");
+  const isPublicReader2 = visibilityRead && !row.collab_permission && !base.isSteward;
   return { ...base, permission: best, isPublicReader: isPublicReader2 };
 }
 async function resolveNestPermission(nestId, userId) {
@@ -2194,22 +2219,23 @@ var LIVE_ONLY_N = "n.archived_at IS NULL";
 async function listNests(userId, opts = {}) {
   const db = getDb();
   const scope = opts.archived ? "archived_at IS NOT NULL" : LIVE_ONLY;
+  const orderBy = opts.archived ? "archived_at DESC" : "created_at DESC";
   if (userId === ANON_USER_ID) {
     return await db.all(
-      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY ${orderBy}`,
       [ANON_USER_ID]
     );
   }
   const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
     return await db.all(
-      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY ${orderBy}`,
       [userId]
     );
   }
   return await db.all(
     `SELECT * FROM nests WHERE (user_id = ? OR user_id = ?) AND ${scope}
-      ORDER BY created_at DESC`,
+      ORDER BY ${orderBy}`,
     [userId, ANON_USER_ID]
   );
 }
@@ -2309,11 +2335,13 @@ async function listSharedNests(userId) {
 async function listVisibleNests(userId, opts = {}) {
   const db = getDb();
   const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  const visibleByVisibility = userId === ANON_USER_ID ? ["public"] : ["public", "org"];
   const params = [
     userId,
     userId,
     ...opts.readable ? [userId] : [],
     userId,
+    ...opts.readable ? visibleByVisibility : [],
     ...includeAnon ? [ANON_USER_ID] : []
   ];
   const rows = await db.all(
@@ -2329,7 +2357,7 @@ async function listVisibleNests(userId, opts = {}) {
         AND (n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
-         ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
+         ${opts.readable ? `OR g.id IS NOT NULL OR n.visibility IN (${visibleByVisibility.map(() => "?").join(", ")})` : ""}
          ${includeAnon ? "OR n.user_id = ?" : ""})
       ORDER BY n.created_at DESC`,
     params
@@ -2345,9 +2373,10 @@ async function listVisibleNests(userId, opts = {}) {
 }
 async function listPublicNests(userId) {
   const db = getDb();
+  const visibilities = userId === ANON_USER_ID ? ["public"] : ["public", "org"];
   return await db.all(
     `SELECT n.* FROM nests n
-       WHERE n.visibility = 'public'
+       WHERE n.visibility IN (${visibilities.map(() => "?").join(", ")})
          AND ${LIVE_ONLY_N}
          AND n.user_id != ?
          AND NOT EXISTS (
@@ -2355,7 +2384,7 @@ async function listPublicNests(userId) {
            WHERE nc.nest_id = n.id AND nc.user_id = ?
          )
        ORDER BY n.created_at DESC`,
-    [userId, userId]
+    [...visibilities, userId, userId]
   );
 }
 async function getNest(nestId) {
@@ -2587,8 +2616,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-WXWER2V7.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-Y757EFMS.js");
+  const { engineCache: engineCache2 } = await import("./engine-QFF2IA3G.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-F7D3VSA2.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2822,6 +2851,8 @@ async function opContext(nestId, actor, onProgress) {
 
 export {
   nowExpr,
+  suffixOf,
+  nowMsExpr,
   insertOrIgnore,
   insertOrReplace,
   trackEvent,
@@ -2910,6 +2941,7 @@ export {
   notifyNestInvite,
   listNotifications,
   markNotificationsRead,
+  markNotificationsReadBySubject,
   createTeam,
   findTeamByExternalId,
   listTeamsForUser,

package/dist/{chunk-SKZ7YYT4.js → chunk-QWNXWRWO.js}

@@ -334,6 +334,28 @@ var config = {
   get OIDC_DEPARTMENT_TAGGING() {
     return process.env.OIDC_DEPARTMENT_TAGGING === "true";
   },
+  /**
+   * Widen the add-a-person suggestions (GET /people/suggest) from "people you
+   * already work with" to every registered account on this server.
+   *
+   * OFF BY DEFAULT, and the default is the point. On a single-company
+   * self-hosted server every account is a colleague, so the whole directory is
+   * the useful answer and this saves asking someone for their address. On the
+   * PromptOwl-hosted deployment, one server holds many unrelated customers —
+   * so the same list is one customer's staff being offered another customer's
+   * email addresses. The hosted deployment leaves this unset; a self-hosted
+   * operator who knows their user table is their own staff turns it on.
+   *
+   * Narrows nothing when off: the default scoping (shared nests and teams,
+   * plus everything for a server admin, who administers the accounts anyway)
+   * is unchanged. Suggestions never gate the add either way — an address that
+   * appears in no list is still valid to type, so this only ever affects what
+   * is *offered*, never who can be invited. Superadmin-togglable at runtime
+   * via /admin/settings.
+   */
+  get PEOPLE_SUGGEST_ALL_USERS() {
+    return process.env.PEOPLE_SUGGEST_ALL_USERS === "true";
+  },
   /**
    * Path to the .env file the server reads its config from and the license
    * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
@@ -351,6 +373,19 @@ var config = {
   get TELEMETRY_INTERVAL_MS() {
     return parseInt(process.env.TELEMETRY_INTERVAL_MS || "3600000", 10);
   },
+  /**
+   * PostHog product analytics. Empty key = off, which is the default: a
+   * self-hosted operator brings their own project. The key is a public client
+   * key by design (the browser sends it), so /health may hand it out — but
+   * only while TELEMETRY_ENABLED is on, so one switch stops all outbound
+   * usage data. Editable at runtime from the admin Settings page.
+   */
+  get POSTHOG_KEY() {
+    return (process.env.POSTHOG_KEY || "").trim();
+  },
+  get POSTHOG_HOST() {
+    return (process.env.POSTHOG_HOST || "").trim() || "https://us.i.posthog.com";
+  },
   /**
    * Activity-trace retention window in days (the api_events table behind
    * GET /admin/trace and GET /nests/:id/trace). 0 = keep forever (pruning is
@@ -626,7 +661,7 @@ function runMigrations(db) {
       slug TEXT NOT NULL,
       description TEXT,
       visibility TEXT NOT NULL DEFAULT 'private'
-        CHECK(visibility IN ('private', 'public')),
+        CHECK(visibility IN ('private', 'org', 'public')),
       created_at TEXT NOT NULL DEFAULT (datetime('now')),
       UNIQUE(user_id, slug)
     );
@@ -1702,6 +1737,83 @@ function runMigrations(db) {
     })();
     recordMigration("039_nest_pins");
   }
+  if (!hasMigration("041_nest_visibility_org")) {
+    widenNestVisibilityWithGuard(db);
+    recordMigration("041_nest_visibility_org");
+  }
+  if (!hasMigration("042_community_sites")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS community_sites (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          url TEXT NOT NULL UNIQUE,
+          secret TEXT NOT NULL,
+          is_active INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+      `);
+      recordMigration("042_community_sites");
+    })();
+  }
+}
+function fkViolationCounts(db) {
+  const rows = db.pragma("foreign_key_check");
+  const counts = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const key = `${r.table}|${r.parent}|${r.fkid}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return counts;
+}
+function widenNestVisibilityWithGuard(db) {
+  const before = fkViolationCounts(db);
+  const fkWasOn = db.pragma("foreign_keys", { simple: true }) === 1;
+  if (fkWasOn) db.pragma("foreign_keys = OFF");
+  try {
+    db.transaction(() => {
+      widenNestVisibilityCheck(db);
+    })();
+    const after = fkViolationCounts(db);
+    const introduced = [...after].filter(
+      ([key, n]) => n > (before.get(key) ?? 0)
+    );
+    if (introduced.length > 0) {
+      throw new Error(
+        `041_nest_visibility_org introduced foreign-key violations: ${introduced.map(([key]) => key).join(", ")}`
+      );
+    }
+  } finally {
+    if (fkWasOn) db.pragma("foreign_keys = ON");
+  }
+}
+function widenNestVisibilityCheck(db) {
+  const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'nests'").get();
+  const ddl = row?.sql;
+  if (!ddl) return;
+  const checkRe = /CHECK\s*\(\s*visibility\s+IN\s*\([^)]*\)\s*\)/i;
+  const current = ddl.match(checkRe);
+  if (!current) return;
+  if (/'org'/i.test(current[0])) return;
+  const newDdl = ddl.replace(
+    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`\[]?nests["'`\]]?/i,
+    "CREATE TABLE nests_new"
+  ).replace(checkRe, "CHECK(visibility IN ('private', 'org', 'public'))");
+  if (!newDdl.startsWith("CREATE TABLE nests_new")) {
+    throw new Error("041: could not rewrite the nests CREATE TABLE statement");
+  }
+  const cols = db.prepare("PRAGMA table_info(nests)").all().map((c) => `"${c.name}"`).join(", ");
+  const indexes = db.prepare(
+    "SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'nests' AND sql IS NOT NULL"
+  ).all().map((r) => `${r.sql};`);
+  db.exec(`
+    ${newDdl};
+    INSERT INTO nests_new (${cols}) SELECT ${cols} FROM nests;
+    DROP TABLE nests;
+    ALTER TABLE nests_new RENAME TO nests;
+    ${indexes.join("\n    ")}
+  `);
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1919,7 +2031,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-JA2YGLS3.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-APCVSYUE.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-IVXVOXYN.js → chunk-UOMW7TT6.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YVMSM7LS.js";
 import {
   getDb
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-UVOAYQTU.js → chunk-XYD6V2LH.js}

@@ -5,10 +5,10 @@ import {
   markIndexStale,
   resolveNestPath,
   setSuggestionFlag
-} from "./chunk-G4AL7ETF.js";
+} from "./chunk-QLXC6542.js";
 import {
   getDb
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -82,7 +82,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-GWSDSUZR.js");
+  const { hasUnsealedDraft } = await import("./version-service-RJ6CWZ3O.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -259,7 +259,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-GWSDSUZR.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-RJ6CWZ3O.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{client-KBK4VIWJ.js → client-LWDMNKX3.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-SKZ7YYT4.js";
+} from "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 export {
   getDb,

package/dist/{engine-WXWER2V7.js → engine-QFF2IA3G.js}

@@ -2,9 +2,9 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-G4AL7ETF.js";
+} from "./chunk-QLXC6542.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-SKZ7YYT4.js";
+import "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {