@promptowl/contextnest-community 1.22.0 → 1.23.0

package/CONFIGURATION.md

@@ -59,7 +59,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to the database (`server_settings` table) so it survives a rebuild and reaches every instance — see [Runtime settings persistence](#runtime-settings-persistence). Setting it here in the deploy environment takes precedence on the next boot. |
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `MANUAL_SIGN_IN` | `open` | Email + password sign-in mode. `open` = anyone may log in and self-register a new account; `invite-only` = existing/invited users may log in but brand-new self-registration returns `403` (the admin provisions accounts via invite/share/steward and shares the password — there is no self-service "set password", which would be account takeover without email verification); `disabled` = no email/password sign-in at all (`POST /auth/login` and `POST /auth/register` return `403`). Independent of `PROMPTOWL_SIGN_IN_GATE`, so the two methods are controlled separately (e.g. `invite-only` manual + `admin-only` PromptOwl). Also settable from Settings → General. The server refuses `disabled` while PromptOwl sign-in is also `disabled` (that would leave no way to log in). Unknown values fall back to `open`. |
-| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
+| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Legacy — official deployment only, leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. Superseded by the DB-backed **Settings → Community sites** list (`/admin/community-sites`), which supports multiple official sites each with their own name/url/secret/active flag — this env var still works as an implicit extra site for backward compatibility. When no site is configured (env var unset and no DB rows), `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. See `API.md → Community sites`. |
 | `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — whenever a ticket-signing secret is set (`OFFICIAL_COMMUNITY_SSO_SECRET` on the official deployment, `MCP_SIGNING_SECRET` on a self-hosted one); with neither set no ticket verifies at all, so the audience check is moot. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever email- or invite-gated publish links are used.** The magic link mailed by `POST /p/:slug/gate` is built from it; unset, it falls back to the request origin, so a proxy forwarding an attacker-supplied `Host` would send the recipient a one-time access token pointing at the attacker's domain — the classic reset-link poisoning. (4) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. |
 | `OIDC_ENABLED` | `false` | Turn on generic OIDC single sign-on (`GET /auth/oidc/login` / `GET /auth/oidc/callback`). Requires `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET` — the login-page button only appears once all three are set. Also editable from Settings → Single sign-on. See [Single sign-on (OIDC)](#single-sign-on-oidc). |
 | `OIDC_ISSUER` | `""` | OIDC issuer URL, e.g. `https://login.microsoftonline.com/<tenant>/v2.0` (Microsoft Entra ID) or `https://accounts.google.com` (Google). **`https://` only** — a non-https value is rejected with a warning and SSO stays off. Must serve `<issuer>/.well-known/openid-configuration`. |
@@ -67,6 +67,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `OIDC_CLIENT_SECRET` | `""` | Client secret from your IdP app registration. Write-only on the Settings API — `GET /admin/settings` reports only `oidc_client_secret_set: true/false`, never the value. |
 | `OIDC_ALLOWED_DOMAINS` | `""` (any) | Comma-separated email-domain allowlist, e.g. `acme.com, contractors.acme.com`. When set, only accounts whose asserted email is on a listed domain may sign in (others bounce with `domain_not_allowed`). Empty allows any domain the IdP asserts. |
 | `OIDC_AUTO_PROVISION` | `true` | Create a user automatically on first successful OIDC sign-in (display name from the `name` claim). Set `false` to allow only pre-existing (invited/registered) users — unknown emails bounce with `not_invited`. |
+| `PEOPLE_SUGGEST_ALL_USERS` | `false` | Widen the add-a-person suggestions (`GET /people/suggest`, behind every "add a person" field) and the `@mention` pickers from *people the caller already shares a nest or team with* to **every registered account on this server**. **Leave this off on a server that hosts more than one organisation** — the PromptOwl-hosted deployment does, and turning it on there would offer one customer's staff another customer's email addresses. On a single-company self-hosted server the whole directory is the useful answer, which is what this is for. Suggestions never gate the invite either way: an address that appears in no list is still valid to type. In the `@` pickers the widening is an invite: a write+ author mentioning someone off the nest adds them as a `read` collaborator before notifying (a read-only author's mention of an outsider reaches nobody). A server admin always sees every account (they administer them). Also editable from **Settings → General → People directory**. |
 | `OIDC_DEPARTMENT_TAGGING` | `false` | Auto-tag newly **created** documents with the creator's directory department: `dept:<slugified-department>` (lowercase, spaces → dashes, e.g. `dept:customer-success`) is appended to the document's tags, deduped against user-supplied tags. Applies on create only — never on update, never retroactively — and a user without a stored department is a silent no-op. The department is captured from the OIDC `department` ID-token claim on every SSO login (a login without the claim clears it, so directory moves propagate), so this is only meaningful when your IdP emits that claim — see [Department auto-tagging](#department-auto-tagging). Also editable from Settings → Single sign-on. |
 | `SSO_TOKEN_EXCHANGE_ENABLED` | `false` | Master switch for `POST /auth/token-exchange` — an external agent exchanges an IdP ID token for a short-lived MCP bearer. Also needs `MCP_SIGNING_SECRET` and at least one provider; otherwise the endpoint returns `404`. Security-critical — see [Agent SSO (token exchange)](#agent-sso-token-exchange). |
 | `MCP_SIGNING_SECRET` | `""` | HMAC secret **this** server signs its minted MCP bearers with (distinct from `OFFICIAL_COMMUNITY_SSO_SECRET`, so self-hosted deployments can issue their own). Long random string. `/index` and `/mcp` accept a ticket signed with either secret. Write-only on the Settings API. **Clearing it is the revocation switch** — turning `SSO_TOKEN_EXCHANGE_ENABLED` off stops minting but already-minted bearers stay valid until they expire. |
@@ -152,7 +153,8 @@ plain-text `fallbackText` for clients that cannot render cards.
 Per-nest connector rows post the same Adaptive Card format to a nest-specific
 webhook, with per-event filtering: `POST /nests/:id/connectors` with a JSON
 body like `{"channel": "teams", "url": "https://…", "events":
-["review_requested", "review_rejected"]}` (`events` may also be `["*"]`; the
+["review_requested", "review_rejected"]}` (`events` is any of `review_requested`,
+`review_approved`, `review_rejected`, `run_failed`, `mention`, or `["*"]`; the
 `url` may be an `env:KEY` reference into the nest's env store). Manage rows
 with `GET`/`PATCH`/`DELETE` on the same path.
 

package/README.md

@@ -165,4 +165,4 @@ The Software injects content into large language models. AI output may be inaccu
 **Copyright © 2026 Promptowl LLC.** All rights reserved.
 "ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
 
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-PX3P4FTU.js → chunk-2YPY2HGZ.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-6WESEA75.js → chunk-5CVZMHHB.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import {
   getDb
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-OQXZ43HG.js → chunk-MLQU4I5J.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-PX3P4FTU.js";
+} from "./chunk-2YPY2HGZ.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-MY4JIWQD.js";
+} from "./chunk-UOMW7TT6.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-6WESEA75.js";
+} from "./chunk-5CVZMHHB.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -26,6 +26,7 @@ import {
   insertOrReplace,
   isPublicReader,
   isStewardshipEnabled,
+  markNotificationsReadBySubject,
   nestName,
   notifyEmailForNest,
   notifyReviewRequested,
@@ -36,7 +37,7 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import {
   ConflictError,
   NotFoundError,
@@ -45,7 +46,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -157,7 +158,9 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   for (const r of rows) {
     if (r.from_node === r.to_node) {
       throw new ConflictError(
-        `This step loops back on itself: ${await nodeTrail(db, nestId, [r.from_node])}. A flow can't return to a step it already ran.`
+        `This step loops back on itself: ${await nodeTrail(db, nestId, [r.from_node])}.
+
+A flow can't return to a step it already ran.`
       );
     }
     nodes.add(r.from_node);
@@ -544,6 +547,7 @@ async function notifySlack(text) {
 
 // src/notify/dispatch.ts
 var EVENT_EMOJI = {
+  mention: ":speech_balloon:",
   review_requested: ":memo:",
   review_approved: ":white_check_mark:",
   review_rejected: ":x:",
@@ -610,6 +614,27 @@ async function resolveUrl(nestId, raw) {
   }
   return isSafeConnectorUrl(raw) ? raw : null;
 }
+async function hasAnyConnector(nestId, kind) {
+  if ((config.SLACK_WEBHOOK_URL || config.MSTEAMS_WEBHOOK_URL) && !DIGEST_DELIVERED_KINDS.has(kind)) {
+    return true;
+  }
+  try {
+    const rows = await getDb().all(
+      "SELECT events FROM connectors WHERE nest_id = ? AND enabled = 1",
+      [nestId]
+    );
+    return rows.some((r) => {
+      try {
+        const kinds = JSON.parse(r.events);
+        return kinds.includes("*") || kinds.includes(kind);
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
 async function dispatchEvent(ev) {
   const db = getDb();
   const nestName2 = await resolveNestName(ev.nestId);
@@ -1211,7 +1236,8 @@ async function deletionTargetContext(request, baseUrl) {
 async function notifyDeletionRequested(request, baseUrl) {
   try {
     const ctx = await deletionTargetContext(request, baseUrl);
-    const line = `Deletion requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"`;
+    const isArchiveRequest = request.targetType === "nest_archive";
+    const line = isArchiveRequest ? `Archive requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"` : `Deletion requested for ${ctx.noun} *${ctx.label}* by ${request.requestedBy} \u2014 "${request.reason}"`;
     const admins = (await nestAdminEmails(request.nestId)).filter(
       (e) => e !== request.requestedBy.toLowerCase()
     );
@@ -1220,7 +1246,7 @@ async function notifyDeletionRequested(request, baseUrl) {
       admins,
       "deletion_requested",
       request.id,
-      `${ctx.noun === "document" ? "" : `${ctx.noun} `}"${ctx.docTitle}" was flagged for deletion by ${request.requestedBy} \u2014 "${request.reason}"`
+      isArchiveRequest ? `${ctx.noun} "${ctx.docTitle}" was requested to be archived by ${request.requestedBy} \u2014 "${request.reason}"` : `${ctx.noun === "document" ? "" : `${ctx.noun} `}"${ctx.docTitle}" was flagged for deletion by ${request.requestedBy} \u2014 "${request.reason}"`
     );
     void dispatchEvent({
       kind: "deletion_requested",
@@ -1267,9 +1293,11 @@ async function notifyDeletionResolved(params) {
   try {
     const { outcome, resolvedBy, note } = params;
     const archivedInstead = outcome === "deleted" && params.targetType === "nest_archive";
-    const verb = archivedInstead ? "archived" : outcome === "deleted" ? "deleted" : "rejected the deletion of";
+    const isArchiveRequest = params.targetType === "nest_archive";
+    const verb = archivedInstead ? "archived" : outcome === "deleted" ? "deleted" : isArchiveRequest ? "declined the archive request for" : "rejected the deletion of";
     const line = `${resolvedBy} ${verb} *${params.docTitle}*${note ? ` \u2014 "${note}"` : ""}`;
     const recipient = params.requestedBy.toLowerCase();
+    await markNotificationsReadBySubject(params.requestId, "deletion_requested");
     const canInbox = !(params.targetType === "nest" && outcome === "deleted");
     if (canInbox && recipient !== resolvedBy.toLowerCase()) {
       await inboxInsert(
@@ -1277,7 +1305,7 @@ async function notifyDeletionResolved(params) {
         [recipient],
         `deletion_${outcome}`,
         params.requestId,
-        outcome === "deleted" ? `"${params.docTitle}" was ${archivedInstead ? "archived" : "deleted"} by ${resolvedBy} \u2014 your request was accepted` : `Your deletion request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
+        outcome === "deleted" ? `"${params.docTitle}" was ${archivedInstead ? "archived" : "deleted"} by ${resolvedBy} \u2014 your request was accepted` : `Your ${isArchiveRequest ? "archive" : "deletion"} request for "${params.docTitle}" was rejected by ${resolvedBy}${note ? ` \u2014 "${note}"` : ""}`
       );
     }
     void dispatchEvent({
@@ -1446,6 +1474,7 @@ async function declineDeletion(params) {
       requestedBy: declined.requestedBy,
       resolvedBy: params.declinedBy,
       requestId: declined.id,
+      targetType: declined.targetType,
       note: params.note,
       baseUrl: params.baseUrl
     });
@@ -1507,6 +1536,7 @@ export {
   envRoutes,
   envValues,
   isSafeConnectorUrl,
+  hasAnyConnector,
   dispatchEvent,
   sendTestNotification,
   notifyNestEvent,

package/dist/{chunk-W5ILNGPD.js → chunk-QLXC6542.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -138,6 +138,12 @@ function startTelemetryLoop() {
 function nowExpr(db) {
   return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
 }
+function suffixOf(db, column, length) {
+  return db.dialect === "sqlite" ? `substr(${column}, -${length})` : `right(${column}, ${length})`;
+}
+function nowMsExpr(db) {
+  return db.dialect === "sqlite" ? "strftime('%Y-%m-%d %H:%M:%f','now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS.MS')";
+}
 function insertOrIgnore(db, insertSql) {
   return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
 }
@@ -657,6 +663,7 @@ function renderText(message) {
 }
 var STATUS_META = {
   approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
+  mention: { subjectWord: "mentioned you", label: "Mention", color: "#7c3aed" },
   rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
   pending_review: {
     subjectWord: "awaiting review",
@@ -715,6 +722,17 @@ var TEMPLATES = {
     lineH: (x) => `${x.doc}${x.vH} has been approved${x.byH}${x.noteH}.`,
     rows: governanceRows
   },
+  // A mention names one person, so this is the one template addressed to
+  // "you". `note` carries the comment's own words when there are any — a
+  // mention with no context reads as a summons.
+  mention: {
+    heading: (x) => `${x.d.actor || "Someone"} mentioned you in ${x.title}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `You were mentioned in ${x.title}${x.byT}${x.noteT}.`,
+    lineH: (x) => `You were mentioned in ${x.doc}${x.byH}${x.noteH}.`,
+    rows: (x) => [plainRow("Nest", x.d.path)]
+  },
   rejected: {
     heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
     detailsHeader: "Document details",
@@ -1304,6 +1322,12 @@ async function markNotificationsRead(userEmail, ids) {
     );
   }
 }
+async function markNotificationsReadBySubject(subjectId, kind) {
+  await getDb().run(
+    "UPDATE notifications SET read_at = ? WHERE subject_id = ? AND kind = ? AND read_at IS NULL",
+    [(/* @__PURE__ */ new Date()).toISOString(), subjectId, kind]
+  );
+}
 
 // src/governance/teams-service.ts
 var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
@@ -2195,22 +2219,23 @@ var LIVE_ONLY_N = "n.archived_at IS NULL";
 async function listNests(userId, opts = {}) {
   const db = getDb();
   const scope = opts.archived ? "archived_at IS NOT NULL" : LIVE_ONLY;
+  const orderBy = opts.archived ? "archived_at DESC" : "created_at DESC";
   if (userId === ANON_USER_ID) {
     return await db.all(
-      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY ${orderBy}`,
       [ANON_USER_ID]
     );
   }
   const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
     return await db.all(
-      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY created_at DESC`,
+      `SELECT * FROM nests WHERE user_id = ? AND ${scope} ORDER BY ${orderBy}`,
       [userId]
     );
   }
   return await db.all(
     `SELECT * FROM nests WHERE (user_id = ? OR user_id = ?) AND ${scope}
-      ORDER BY created_at DESC`,
+      ORDER BY ${orderBy}`,
     [userId, ANON_USER_ID]
   );
 }
@@ -2591,8 +2616,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-XKRP7GOQ.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-TXW7SXSF.js");
+  const { engineCache: engineCache2 } = await import("./engine-QFF2IA3G.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-F7D3VSA2.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2826,6 +2851,8 @@ async function opContext(nestId, actor, onProgress) {
 
 export {
   nowExpr,
+  suffixOf,
+  nowMsExpr,
   insertOrIgnore,
   insertOrReplace,
   trackEvent,
@@ -2914,6 +2941,7 @@ export {
   notifyNestInvite,
   listNotifications,
   markNotificationsRead,
+  markNotificationsReadBySubject,
   createTeam,
   findTeamByExternalId,
   listTeamsForUser,

package/dist/{chunk-J2OQ3MEB.js → chunk-QWNXWRWO.js}

@@ -334,6 +334,28 @@ var config = {
   get OIDC_DEPARTMENT_TAGGING() {
     return process.env.OIDC_DEPARTMENT_TAGGING === "true";
   },
+  /**
+   * Widen the add-a-person suggestions (GET /people/suggest) from "people you
+   * already work with" to every registered account on this server.
+   *
+   * OFF BY DEFAULT, and the default is the point. On a single-company
+   * self-hosted server every account is a colleague, so the whole directory is
+   * the useful answer and this saves asking someone for their address. On the
+   * PromptOwl-hosted deployment, one server holds many unrelated customers —
+   * so the same list is one customer's staff being offered another customer's
+   * email addresses. The hosted deployment leaves this unset; a self-hosted
+   * operator who knows their user table is their own staff turns it on.
+   *
+   * Narrows nothing when off: the default scoping (shared nests and teams,
+   * plus everything for a server admin, who administers the accounts anyway)
+   * is unchanged. Suggestions never gate the add either way — an address that
+   * appears in no list is still valid to type, so this only ever affects what
+   * is *offered*, never who can be invited. Superadmin-togglable at runtime
+   * via /admin/settings.
+   */
+  get PEOPLE_SUGGEST_ALL_USERS() {
+    return process.env.PEOPLE_SUGGEST_ALL_USERS === "true";
+  },
   /**
    * Path to the .env file the server reads its config from and the license
    * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
@@ -1719,6 +1741,22 @@ function runMigrations(db) {
     widenNestVisibilityWithGuard(db);
     recordMigration("041_nest_visibility_org");
   }
+  if (!hasMigration("042_community_sites")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS community_sites (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          url TEXT NOT NULL UNIQUE,
+          secret TEXT NOT NULL,
+          is_active INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+      `);
+      recordMigration("042_community_sites");
+    })();
+  }
 }
 function fkViolationCounts(db) {
   const rows = db.pragma("foreign_key_check");
@@ -1993,7 +2031,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-KKICIH2C.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-APCVSYUE.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-MY4JIWQD.js → chunk-UOMW7TT6.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YVMSM7LS.js";
 import {
   getDb
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-ZAV4QUZA.js → chunk-XYD6V2LH.js}

@@ -5,10 +5,10 @@ import {
   markIndexStale,
   resolveNestPath,
   setSuggestionFlag
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import {
   getDb
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -82,7 +82,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-TKNYJMCM.js");
+  const { hasUnsealedDraft } = await import("./version-service-RJ6CWZ3O.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -259,7 +259,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-TKNYJMCM.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-RJ6CWZ3O.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{client-CSCHXUNX.js → client-LWDMNKX3.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 export {
   getDb,

package/dist/{engine-XKRP7GOQ.js → engine-QFF2IA3G.js}

@@ -2,9 +2,9 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-J2OQ3MEB.js";
+import "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-TXW7SXSF.js → external-edit-service-F7D3VSA2.js}

@@ -11,10 +11,10 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-ZAV4QUZA.js";
-import "./chunk-W5ILNGPD.js";
+} from "./chunk-XYD6V2LH.js";
+import "./chunk-QLXC6542.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-J2OQ3MEB.js";
+import "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-UZ2MGDO5.js → grants-service-TBGTCO5K.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-MY4JIWQD.js";
+} from "./chunk-UOMW7TT6.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-J2OQ3MEB.js";
+import "./chunk-QWNXWRWO.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,