@promptowl/contextnest-community 1.25.0 → 1.26.0

package/README.md

@@ -150,7 +150,7 @@ Keys are minted in the app (Workspace → API keys, or the Connect dialog) — o
 | Activity trace — every governance action, per nest and server-wide | ✅ | ✅ |
 | Notifications — Slack, Microsoft Teams, email | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) — [admin guide](./CONFIGURATION.md#single-sign-on-oidc) | ✅ | ✅ |
 | SAML / SCIM provisioning | — | ✅ |
 | Audit log streaming | — | ✅ |
 | Policy transforms (redaction, summarization) | — | ✅ |
@@ -165,6 +165,7 @@ Release notes live in [CHANGELOG.md](./CHANGELOG.md).
 ## Documentation
 
 - [CONFIGURATION.md](./CONFIGURATION.md) — every environment variable (port, auth mode, storage, notifications, telemetry)
+- [Single sign-on admin guide](./CONFIGURATION.md#single-sign-on-oidc) — connect Microsoft Entra ID, Google, Okta, Keycloak or any OIDC provider; what happens to existing accounts, API keys and agents; every `sso_error` code with its fix
 - [API.md](./API.md) — complete REST reference with request and response bodies
 - [STEWARDSHIP.md](./STEWARDSHIP.md) — the governance model: modes, stewards, scopes, prime documents, teams, super-admins
 - `<server>/llms.txt` — the agent manual the running server publishes; rendered as **Docs** in the app
@@ -217,4 +218,4 @@ The Software injects content into large language models. AI output may be inaccu
 **Copyright © 2026 Promptowl LLC.** All rights reserved.
 "ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
 
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-32SZCH36.js → chunk-2QOJE7A5.js}

@@ -6,10 +6,10 @@ import {
   markIndexStale,
   resolveNestPath,
   syncSuggestionRows
-} from "./chunk-7FROMOZM.js";
+} from "./chunk-SWA5M5XX.js";
 import {
   getDb
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-TRSGPS27.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -83,7 +83,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-X4FAG2OZ.js");
+  const { hasUnsealedDraft } = await import("./version-service-C3JTZLJH.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -254,7 +254,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-X4FAG2OZ.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-C3JTZLJH.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{chunk-2KHM5C7V.js → chunk-DGPTJXIV.js}

@@ -1,28 +1,30 @@
 import {
   buildTitleMap,
-  canApproveWith,
-  canEditWith,
-  canViewWith,
-  collabPermToRole,
   docLink,
   isSuperAdmin,
   nestAllowsSelfApprove,
   nestName,
-  primaryRole,
   resolveNestAccess,
   resolveNestPermission,
-  resolveTeamRolesForUser,
-  sendEmailToRecipient
-} from "./chunk-7FROMOZM.js";
+  resolveTeamRolesForUser
+} from "./chunk-SWA5M5XX.js";
 import {
   ConflictError,
   ValidationError
 } from "./chunk-LHWOJPFE.js";
+import {
+  canApproveWith,
+  canEditWith,
+  canViewWith,
+  collabPermToRole,
+  primaryRole,
+  sendEmailToRecipient
+} from "./chunk-I5EDEZBQ.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-TRSGPS27.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -231,12 +233,8 @@ async function createStewardRecord(params) {
     );
     let userId = userRow?.id;
     if (!userId) {
-      const { hashPassword } = await import("./keys-CTOGAG3W.js");
-      userId = uuid();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword(uuid())]
-      );
+      const { findOrCreateInvitedUser } = await import("./invited-user-AM6A3WGO.js");
+      userId = (await findOrCreateInvitedUser(email)).id;
     }
     const created = await assignSteward({
       nestId: params.nestId,

package/dist/chunk-I5EDEZBQ.js

@@ -0,0 +1,523 @@
+import {
+  config,
+  getDb
+} from "./chunk-TRSGPS27.js";
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+function teamRoleToPermission(role) {
+  switch (role) {
+    case "admin":
+      return "admin";
+    case "editor":
+      return "write";
+    case "viewer":
+      return "read";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+function permissionLabel(permission) {
+  const role = collabPermToRole(permission);
+  return role ? role[0].toUpperCase() + role.slice(1) : "Collaborator";
+}
+
+// src/notify/email-render.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var EVENT = {
+  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
+  ":x:": { icon: "\u274C", color: "#dc2626" },
+  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
+  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
+};
+var ALL_EMOJI = Object.fromEntries(
+  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
+);
+function renderText(message) {
+  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
+}
+var STATUS_META = {
+  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
+  mention: { subjectWord: "mentioned you", label: "Mention", color: "#7c3aed" },
+  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
+  pending_review: {
+    subjectWord: "awaiting review",
+    label: "Pending review",
+    color: "#d97706"
+  },
+  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" },
+  invited: { subjectWord: "invited you", label: "Invitation", color: "#2563eb" },
+  steward: { subjectWord: "steward", label: "Steward", color: "#7c3aed" },
+  deletion_requested: {
+    subjectWord: "flagged for deletion",
+    label: "Deletion requested",
+    color: "#d97706"
+  },
+  deletion_declined: {
+    subjectWord: "kept",
+    label: "Deletion rejected",
+    color: "#d97706"
+  },
+  deletion_deleted: {
+    subjectWord: "deleted",
+    label: "Deleted",
+    color: "#dc2626"
+  },
+  // An honoured ARCHIVE request. Deliberately not the deletion palette: the
+  // nest is intact and restorable, and red "Deleted" would tell the requester
+  // the opposite of what happened.
+  deletion_archived: {
+    subjectWord: "archived",
+    label: "Archived",
+    color: "#0891b2"
+  }
+};
+var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+var shareRole = (permission) => permission ? permissionLabel(permission) : "collaborator";
+var detailRow = (label, valueHtml) => `<tr>
+      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
+      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
+    </tr>`;
+var plainRow = (label, value) => ({
+  label,
+  text: value,
+  html: escapeHtml(value)
+});
+var governanceRows = (x) => [
+  plainRow("Path", x.d.path),
+  { label: "Status", text: x.meta.label, html: x.statusBadge },
+  ...x.d.version != null ? [plainRow("Version", `v${x.d.version}`)] : []
+];
+var PROMPTOWL_LINE = " Or choose Sign in with PromptOwl, using a PromptOwl account under this same email.";
+var TEMPLATES = {
+  approved: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `${x.title}${x.vT} has been approved${x.byT}${x.noteT}.`,
+    lineH: (x) => `${x.doc}${x.vH} has been approved${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  // A mention names one person, so this is the one template addressed to
+  // "you". `note` carries the comment's own words when there are any — a
+  // mention with no context reads as a summons.
+  mention: {
+    heading: (x) => `${x.d.actor || "Someone"} mentioned you in ${x.title}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `You were mentioned in ${x.title}${x.byT}${x.noteT}.`,
+    lineH: (x) => `You were mentioned in ${x.doc}${x.byH}${x.noteH}.`,
+    rows: (x) => [plainRow("Nest", x.d.path)]
+  },
+  rejected: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `${x.title}${x.vT} has been rejected${x.byT}${x.noteT}.`,
+    lineH: (x) => `${x.doc}${x.vH} has been rejected${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  pending_review: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `A review has been requested for ${x.title}${x.vT}${x.byT}${x.noteT}.`,
+    lineH: (x) => `A review has been requested for ${x.doc}${x.vH}${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  shared: {
+    heading: (x) => `You've been added to ${x.title}`,
+    detailsHeader: "Details",
+    linkLabel: "Open nest",
+    lineT: (x) => `You've been given ${shareRole(x.d.permission)} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
+    lineH: (x) => `You've been given <strong>${escapeHtml(shareRole(x.d.permission))}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
+    rows: (x) => [
+      plainRow("Nest", x.d.path),
+      ...x.d.permission ? [plainRow("Role", shareRole(x.d.permission))] : []
+    ]
+  },
+  invited: {
+    heading: (x) => `You've been invited to ${x.title}`,
+    detailsHeader: "Sign-in details",
+    linkLabel: "Sign in",
+    lineT: (x) => `You've been invited to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Sign in with your email and the temporary password below, then choose your own password.${x.d.promptowlSignIn ? PROMPTOWL_LINE : ""}`,
+    lineH: (x) => `You've been invited to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Sign in with your email and the temporary password below, then choose your own password.${x.d.promptowlSignIn ? PROMPTOWL_LINE : ""}`,
+    rows: (x) => [
+      plainRow("Email", x.d.actor || ""),
+      ...x.d.tempPassword ? [
+        {
+          label: "Temporary password",
+          text: x.d.tempPassword,
+          html: x.codeValue(x.d.tempPassword)
+        }
+      ] : []
+    ]
+  },
+  // Deletion requests reuse the governance details block — same "what/where/
+  // status" shape, and the reason/note rides in `note` like a review note.
+  deletion_requested: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Review the request",
+    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or reject the request from the nest.`,
+    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or reject the request from the nest.`,
+    rows: governanceRows
+  },
+  deletion_declined: {
+    heading: (x) => `Your deletion request for ${x.title} was rejected`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `Your request to delete ${x.title} was rejected${x.byT}${x.noteT}. The document stays.`,
+    lineH: (x) => `Your request to delete ${x.doc} was rejected${x.byH}${x.noteH}. The document stays.`,
+    rows: governanceRows
+  },
+  deletion_deleted: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been deleted${x.byT}${x.noteT} \u2014 your deletion request was accepted.`,
+    lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
+    rows: governanceRows
+  },
+  deletion_archived: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Nest details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been archived${x.byT}${x.noteT} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    lineH: (x) => `${x.doc} has been archived${x.byH}${x.noteH} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
+    rows: governanceRows
+  },
+  steward: {
+    heading: (x) => `You're now a steward of ${x.title}`,
+    detailsHeader: "Details",
+    linkLabel: "Open nest",
+    lineT: (x) => `You've been assigned as a ${x.d.permission || "reviewer"} steward of ${x.d.scopeLabel || x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open the nest below to start reviewing.`,
+    lineH: (x) => `You've been assigned as a <strong>${escapeHtml(x.d.permission || "reviewer")}</strong> steward of ${x.d.scopeLabel ? escapeHtml(x.d.scopeLabel) : x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open the nest below to start reviewing.`,
+    rows: (x) => [
+      plainRow("Nest", x.d.path),
+      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : [],
+      ...x.d.scopeLabel ? [plainRow("Scope", cap(x.d.scopeLabel))] : []
+    ]
+  }
+};
+function renderEmail(d) {
+  const meta = STATUS_META[d.status];
+  const t = TEMPLATES[d.status];
+  const title = d.docTitle.replace(/[\r\n]+/g, " ").trim();
+  const vLabel = d.version != null ? `v${d.version}` : "";
+  const ctx = {
+    d,
+    title,
+    doc: `<strong>${escapeHtml(title)}</strong>`,
+    byT: d.actor ? ` by ${d.actor}` : "",
+    byH: d.actor ? ` by ${escapeHtml(d.actor)}` : "",
+    noteT: d.note ? ` with the note: "${d.note}"` : "",
+    noteH: d.note ? ` with the note: &ldquo;${escapeHtml(d.note)}&rdquo;` : "",
+    vT: vLabel ? ` ${vLabel}` : "",
+    vH: vLabel ? ` ${vLabel}` : "",
+    meta,
+    statusBadge: `<span style="display:inline-block;padding:2px 9px;border-radius:9999px;background:#f3f4f6;color:${meta.color};font-size:12px;font-weight:600;">${meta.label}</span>`,
+    codeValue: (v) => `<span style="font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;font-weight:600;color:#111827;background:#f3f4f6;padding:2px 8px;border-radius:6px;">${escapeHtml(v)}</span>`
+  };
+  const heading = t.heading(ctx).replace(/[\r\n]+/g, " ").trim();
+  const subject = heading;
+  const detailsHeader = t.detailsHeader;
+  const linkLabel = t.linkLabel;
+  const lineH = t.lineH(ctx);
+  const rows = t.rows(ctx);
+  const detailLines = [
+    `${detailsHeader}:`,
+    ...rows.map((r) => `  ${r.label}: ${r.text}`),
+    ...d.link ? [`  ${linkLabel}: ${d.link}`] : []
+  ];
+  const text = ["Hi,", "", t.lineT(ctx), "", ...detailLines, "", "Regards,", "Community Nest"].join("\n");
+  const detailRows = rows.map((r) => detailRow(r.label, r.html)).join("");
+  const buttonRow = d.link ? `<tr><td style="padding:20px 24px 0;">
+        <table role="presentation" cellpadding="0" cellspacing="0" border="0"><tr>
+          <td bgcolor="${meta.color}" style="border-radius:6px;">
+            <a href="${escapeHtml(d.link)}" target="_blank" style="display:inline-block;padding:10px 20px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;">${linkLabel}</a>
+          </td>
+        </tr></table>
+      </td></tr>` : "";
+  const html = `<div style="margin:0;padding:24px;background:#f6f8fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#111827;">
+  <table role="presentation" width="480" cellpadding="0" cellspacing="0" border="0" align="center" style="width:100%;max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;">
+    <tr><td style="padding:20px 24px 0;">
+      <div style="font-size:12px;font-weight:700;color:#6b7280;letter-spacing:0.06em;text-transform:uppercase;">ContextNest</div>
+    </td></tr>
+    <tr><td style="padding:10px 24px 0;">
+      <h1 style="margin:0;font-size:19px;line-height:1.35;font-weight:700;color:#111827;">${escapeHtml(heading)}</h1>
+    </td></tr>
+    <tr><td style="padding:16px 24px 0;font-size:14px;line-height:1.6;color:#374151;">
+      Hi,<br><br>${lineH}
+    </td></tr>
+    <tr><td style="padding:20px 24px 0;">
+      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border:1px solid #eef0f2;border-radius:8px;">
+        <tr><td style="padding:12px 16px;">
+          <div style="font-size:11px;font-weight:600;color:#9ca3af;letter-spacing:0.04em;text-transform:uppercase;padding-bottom:4px;">${detailsHeader}</div>
+          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">${detailRows}</table>
+        </td></tr>
+      </table>
+    </td></tr>
+    ${buttonRow}
+    <tr><td style="padding:22px 24px 24px;font-size:14px;line-height:1.6;color:#374151;">
+      Regards,<br>Community Nest
+    </td></tr>
+  </table>
+</div>`;
+  return { subject, text, html };
+}
+function renderHtml(message, nestName) {
+  const lead = message.match(/^(:[a-z_]+:)\s*/);
+  const meta = lead && EVENT[lead[1]] || { icon: "\u{1F514}", color: "#475569" };
+  const rest = lead ? message.slice(lead[0].length) : message;
+  const body = escapeHtml(rest).replace(/\*([^*]+)\*/g, "<strong>$1</strong>").replace(/\n/g, "<br>");
+  const safeNest = escapeHtml(nestName);
+  return `<div style="background:#f6f8fa;padding:24px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden;">
+    <tr><td style="padding:20px 24px 16px;border-bottom:1px solid #f0f0f0;">
+      <div style="font-size:15px;font-weight:700;color:#111827;letter-spacing:-0.01em;">ContextNest</div>
+      <div style="font-size:13px;color:#6b7280;margin-top:2px;">${safeNest}</div>
+    </td></tr>
+    <tr><td style="padding:24px;">
+      <table role="presentation" cellpadding="0" cellspacing="0"><tr>
+        <td valign="top" style="font-size:22px;line-height:1;padding-right:14px;">${meta.icon}</td>
+        <td valign="top" style="font-size:15px;line-height:1.55;color:#111827;border-left:3px solid ${meta.color};padding-left:14px;">${body}</td>
+      </tr></table>
+    </td></tr>
+  </table>
+</div>`;
+}
+
+// src/notify/email.ts
+var transporterPromise = null;
+var configuredKey = null;
+var warnedOnce = false;
+var SMTP_TIMEOUT_DEFAULTS = [
+  ["connectionTimeout", 5e3],
+  ["greetingTimeout", 5e3],
+  ["socketTimeout", 1e4]
+];
+function withTimeouts(url) {
+  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+  const missing = SMTP_TIMEOUT_DEFAULTS.filter(
+    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
+  ).map(([name, ms]) => `${name}=${ms}`);
+  if (missing.length === 0) return url;
+  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
+}
+var POOL_DEFAULTS = [
+  ["pool", "true"],
+  ["maxConnections", "1"],
+  ["rateDelta", "1000"],
+  ["rateLimit", "8"]
+  // messages per second
+];
+function withPool(url) {
+  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+  const missing = POOL_DEFAULTS.filter(
+    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
+  ).map(([name, val]) => `${name}=${val}`);
+  if (missing.length === 0) return url;
+  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
+}
+function transportSettings(over = {}) {
+  const v = (name, current) => name in over ? over[name] : current;
+  if (v("EMAIL_PROVIDER", config.EMAIL_PROVIDER) === "ses") {
+    const region = v("SES_REGION", config.SES_REGION);
+    return region ? {
+      provider: "ses",
+      region,
+      accessKeyId: v("SES_ACCESS_KEY_ID", config.SES_ACCESS_KEY_ID),
+      secretAccessKey: v("SES_SECRET_ACCESS_KEY", config.SES_SECRET_ACCESS_KEY)
+    } : null;
+  }
+  const url = v("SMTP_URL", config.SMTP_URL);
+  return url ? { provider: "smtp", url } : null;
+}
+async function createTransport(s, pooled) {
+  const nodemailer = (await import("nodemailer")).default;
+  const hardening = { disableFileAccess: true, disableUrlAccess: true };
+  if (s.provider === "smtp") {
+    const url = withTimeouts(s.url);
+    return nodemailer.createTransport(pooled ? withPool(url) : url, hardening);
+  }
+  const ses = await import("@aws-sdk/client-sesv2");
+  const sesClient = new ses.SESv2Client({
+    region: s.region,
+    ...s.accessKeyId && s.secretAccessKey ? { credentials: { accessKeyId: s.accessKeyId, secretAccessKey: s.secretAccessKey } } : {}
+  });
+  return nodemailer.createTransport({
+    SES: { sesClient, SendEmailCommand: ses.SendEmailCommand },
+    ...hardening
+  });
+}
+async function verifyEmailTransport(s) {
+  let transporter = null;
+  try {
+    transporter = await createTransport(s, false);
+    await transporter.verify();
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    try {
+      transporter?.close?.();
+    } catch {
+    }
+  }
+}
+async function getTransporter() {
+  const s = transportSettings();
+  if (!s) return null;
+  const key = JSON.stringify(s);
+  if (!transporterPromise || configuredKey !== key) {
+    configuredKey = key;
+    transporterPromise = createTransport(s, true);
+    transporterPromise.catch(() => {
+      transporterPromise = null;
+      configuredKey = null;
+    });
+  }
+  return transporterPromise;
+}
+async function notifyEmailForNest(nestId, message, details) {
+  const from = config.NOTIFY_EMAIL_FROM;
+  const to = config.NOTIFY_EMAIL_TO;
+  if (!transportSettings() || !from || !to) return;
+  try {
+    const transporter = await getTransporter();
+    if (!transporter) return;
+    let subject;
+    let text;
+    let html;
+    if (details) {
+      ({ subject, text, html } = renderEmail(details));
+    } else {
+      let name = nestId;
+      try {
+        const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+          nestId
+        ]);
+        if (row?.name) name = row.name;
+      } catch {
+      }
+      const safeName = name.replace(/[\r\n]+/g, " ").trim();
+      subject = `ContextNest \xB7 ${safeName}`;
+      text = renderText(message);
+      html = renderHtml(message, safeName);
+    }
+    await transporter.sendMail({
+      from,
+      to,
+      subject,
+      text,
+      html,
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+  } catch (err) {
+    if (!warnedOnce) {
+      warnedOnce = true;
+      console.warn(
+        "[email] notification failed (suppressing further warnings):",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+function isEmailConfigured() {
+  return !!transportSettings() && !!config.NOTIFY_EMAIL_FROM;
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function recipientEnvelope(to, from) {
+  const recipients = Array.isArray(to) ? to : [to];
+  return recipients.length > 1 ? { to: from, bcc: recipients } : { to: recipients[0] };
+}
+function isRateLimited(err) {
+  const msg = String(err?.message ?? err);
+  const code = Number(err?.responseCode);
+  return /too many|rate limit|rate exceeded|throttl|try again|4\.7\.\d|too many emails/i.test(msg) || code === 421 || code === 429 || code === 450 || code === 451 || code === 550 && /too many|rate/i.test(msg);
+}
+async function sendMailWithRetry(transporter, msg, attempts = 5) {
+  for (let i = 0; ; i++) {
+    try {
+      return await transporter.sendMail(msg);
+    } catch (err) {
+      if (i >= attempts - 1 || !isRateLimited(err)) throw err;
+      const wait = 1e3 * 2 ** i;
+      await sleep(wait);
+    }
+  }
+}
+async function sendEmailToRecipient(to, details) {
+  const from = config.NOTIFY_EMAIL_FROM;
+  const hasRecipient = Array.isArray(to) ? to.length > 0 : !!to;
+  if (!transportSettings() || !from || !hasRecipient) return;
+  try {
+    const transporter = await getTransporter();
+    if (!transporter) return;
+    const { subject, text, html } = renderEmail(details);
+    await sendMailWithRetry(transporter, {
+      from,
+      ...recipientEnvelope(to, from),
+      subject,
+      text,
+      html,
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+  } catch (err) {
+    if (!warnedOnce) {
+      warnedOnce = true;
+      console.warn(
+        "[email] notification failed (suppressing further warnings):",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+
+export {
+  collabPermToRole,
+  teamRoleToPermission,
+  canViewWith,
+  canEditWith,
+  canApproveWith,
+  primaryRole,
+  permissionLabel,
+  transportSettings,
+  verifyEmailTransport,
+  notifyEmailForNest,
+  isEmailConfigured,
+  sendEmailToRecipient
+};

package/dist/{chunk-TI7HMP64.js → chunk-IEAWRHMV.js}

@@ -2,13 +2,13 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-7FROMOZM.js";
+} from "./chunk-SWA5M5XX.js";
 import {
   ValidationError
 } from "./chunk-LHWOJPFE.js";
 import {
   getDb
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-TRSGPS27.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";