@promptowl/contextnest-community 1.24.0 → 1.26.0

package/dist/{chunk-LA3VTQ22.js → chunk-TRSGPS27.js}

@@ -2,11 +2,6 @@ import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
 
-// src/db/client.ts
-import Database from "better-sqlite3";
-import { mkdirSync, readFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-
 // src/config.ts
 import { join, dirname } from "path";
 import { existsSync } from "fs";
@@ -356,6 +351,30 @@ var config = {
   get PEOPLE_SUGGEST_ALL_USERS() {
     return process.env.PEOPLE_SUGGEST_ALL_USERS === "true";
   },
+  /**
+   * Who may create nests. "admins" (default): server admins only, until the
+   * server is on a paid plan. "everyone": any signed-in user. Open mode is
+   * unaffected (everyone is admin there).
+   */
+  get NEST_CREATION() {
+    return process.env.NEST_CREATION?.trim().toLowerCase() === "everyone" ? "everyone" : "admins";
+  },
+  /**
+   * This server hosts several unrelated organizations (the PromptOwl-hosted
+   * deployment) rather than one company (a self-hosted install).
+   *
+   * OFF BY DEFAULT. Nest visibility 'org' means "every authenticated account
+   * on this deployment" (src/shared/access.ts) — on a single-company server
+   * that IS the organization, so the tier is safe to flip in one click. On a
+   * shared server it is every customer, so with this on: flipping a nest to
+   * 'org' needs the same explicit acknowledgement 'public' always needs
+   * (PATCH /nests/:id/visibility 409s without it — the server enforces it, not only the UI), and
+   * the UI words both tiers to say so. Exposed on /health as
+   * `shared_deployment`. Superadmin-togglable at runtime via /admin/settings.
+   */
+  get SHARED_DEPLOYMENT() {
+    return process.env.SHARED_DEPLOYMENT === "true";
+  },
   /**
    * Path to the .env file the server reads its config from and the license
    * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
@@ -537,6 +556,27 @@ var config = {
     }
     return raw;
   },
+  /**
+   * Email transport: "smtp" (SMTP_URL, default) or "ses" (AWS SES via the SDK,
+   * for deployments that can't use SMTP). Anything else falls back to smtp.
+   */
+  get EMAIL_PROVIDER() {
+    return process.env.EMAIL_PROVIDER?.trim().toLowerCase() === "ses" ? "ses" : "smtp";
+  },
+  /** AWS region for SES, e.g. us-east-1. Required when EMAIL_PROVIDER=ses. */
+  get SES_REGION() {
+    return process.env.SES_REGION?.trim() || null;
+  },
+  /**
+   * Optional static SES credentials. Both unset → the AWS default credential
+   * chain (IAM role, AWS_* env, shared profile). The secret is write-only.
+   */
+  get SES_ACCESS_KEY_ID() {
+    return process.env.SES_ACCESS_KEY_ID?.trim() || null;
+  },
+  get SES_SECRET_ACCESS_KEY() {
+    return process.env.SES_SECRET_ACCESS_KEY?.trim() || null;
+  },
   /**
    * From address for notification emails. Shape-validated here (not only in
    * the /admin/settings PATCH) so a value set directly via env/Docker can't
@@ -640,9 +680,25 @@ var config = {
   get VIDEO_MAX_BYTES() {
     const mb = parseInt(process.env.VIDEO_MAX_MB || "30", 10);
     return (Number.isFinite(mb) && mb > 0 ? mb : 30) * 1024 * 1024;
+  },
+  /**
+   * Max PDF upload size in bytes (POST /nests/:id/nodes/pdf). Default 25 MB —
+   * under Cloud Run's 32 MiB HTTP/1 request-body limit, with room for the
+   * multipart framing, so an oversized PDF is refused by our own check (413
+   * with a clear message) rather than by the platform. Read per request, so a
+   * change takes effect without a restart. Override via PDF_MAX_MB.
+   */
+  get PDF_MAX_BYTES() {
+    const mb = parseInt(process.env.PDF_MAX_MB || "25", 10);
+    return (Number.isFinite(mb) && mb > 0 ? mb : 25) * 1024 * 1024;
   }
 };
 
+// src/db/client.ts
+import Database from "better-sqlite3";
+import { mkdirSync, readFileSync } from "fs";
+import { dirname as dirname2 } from "path";
+
 // src/db/migrations.ts
 function runMigrations(db) {
   db.exec(`
@@ -828,6 +884,9 @@ function runMigrations(db) {
   if (!nestCols.includes("prime_tags")) {
     db.exec("ALTER TABLE nests ADD COLUMN prime_tags TEXT NOT NULL DEFAULT 'prime-document'");
   }
+  if (!nestCols.includes("creator_is_reviewer")) {
+    db.exec("ALTER TABLE nests ADD COLUMN creator_is_reviewer INTEGER NOT NULL DEFAULT 0");
+  }
   if (!nestCols.includes("index_synced_at")) {
     db.exec("ALTER TABLE nests ADD COLUMN index_synced_at TEXT");
   }
@@ -837,6 +896,9 @@ function runMigrations(db) {
   if (!nestCols.includes("reader_home_node")) {
     db.exec("ALTER TABLE nests ADD COLUMN reader_home_node TEXT");
   }
+  if (!nestCols.includes("branding_json")) {
+    db.exec("ALTER TABLE nests ADD COLUMN branding_json TEXT");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -1781,6 +1843,18 @@ function runMigrations(db) {
       recordMigration("043_node_suggestion_details");
     })();
   }
+  if (!hasMigration("044_client_attribution")) {
+    for (const [table, col] of [
+      ["node_versions", "client_json"],
+      ["api_events", "client_json"]
+    ]) {
+      const cols = db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+      if (cols.length && !cols.includes(col)) {
+        db.exec(`ALTER TABLE ${table} ADD COLUMN ${col} TEXT`);
+      }
+    }
+    recordMigration("044_client_attribution");
+  }
 }
 function fkViolationCounts(db) {
   const rows = db.pragma("foreign_key_check");
@@ -2055,7 +2129,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-AIQ7WSU7.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-HGSQ7IA5.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);
@@ -2075,18 +2149,11 @@ function getDb() {
   }
   return adapter;
 }
-async function resetDb() {
-  if (adapter) {
-    await adapter.close();
-    adapter = null;
-  }
-}
 
 export {
   isEmailish,
   isEmailListish,
   config,
   initDb,
-  getDb,
-  resetDb
+  getDb
 };

package/dist/{engine-S3QBQ7LH.js → engine-QNMFDIBV.js}

@@ -2,9 +2,10 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-KIAAEHWL.js";
-import "./chunk-YVMSM7LS.js";
-import "./chunk-LA3VTQ22.js";
+} from "./chunk-SWA5M5XX.js";
+import "./chunk-LHWOJPFE.js";
+import "./chunk-I5EDEZBQ.js";
+import "./chunk-TRSGPS27.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-6FNFPOJJ.js → external-edit-service-4MEGPT4D.js}

@@ -11,10 +11,11 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-XUIWAWDO.js";
-import "./chunk-KIAAEHWL.js";
-import "./chunk-YVMSM7LS.js";
-import "./chunk-LA3VTQ22.js";
+} from "./chunk-2QOJE7A5.js";
+import "./chunk-SWA5M5XX.js";
+import "./chunk-LHWOJPFE.js";
+import "./chunk-I5EDEZBQ.js";
+import "./chunk-TRSGPS27.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-UT3EQ3R7.js → grants-service-24GLUBY4.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-I3CSD6CK.js";
-import "./chunk-YVMSM7LS.js";
-import "./chunk-LA3VTQ22.js";
+} from "./chunk-RPGFHESR.js";
+import "./chunk-LHWOJPFE.js";
+import "./chunk-TRSGPS27.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,