@promptowl/contextnest-community 1.25.0 → 1.27.0

package/dist/{chunk-7FROMOZM.js → chunk-QMQDWRHN.js}

@@ -4,11 +4,16 @@ import {
   NotFoundError,
   ValidationError
 } from "./chunk-LHWOJPFE.js";
+import {
+  permissionLabel,
+  sendEmailToRecipient,
+  teamRoleToPermission
+} from "./chunk-RXCVXG34.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-H3W72HN3.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -151,6 +156,102 @@ function insertOrReplace(db, insertSql, conflictCols, set) {
   return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
 }
 
+// src/shared/secret-box.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash2,
+  randomBytes
+} from "crypto";
+var PREFIX = "enc.v1.";
+var b64 = (b) => b.toString("base64url");
+var MASTER_KEY_SETTING = "SECRETS_MASTER_KEY";
+var SECRET_SETTINGS = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "OIDC_CLIENT_SECRET",
+  "MCP_SIGNING_SECRET",
+  "SMTP_URL",
+  "SLACK_WEBHOOK_URL",
+  "MSTEAMS_WEBHOOK_URL",
+  "SES_SECRET_ACCESS_KEY",
+  "PROMPTOWL_KEY"
+]);
+function isSecretSetting(name) {
+  return SECRET_SETTINGS.has(name);
+}
+function isEncrypted(value) {
+  return value.startsWith(PREFIX);
+}
+async function encryptSecret(plain) {
+  if (isEncrypted(plain)) return plain;
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", await masterKey(), iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return PREFIX + [b64(iv), b64(cipher.getAuthTag()), b64(ct)].join(".");
+}
+async function decryptSecret(stored) {
+  if (!isEncrypted(stored)) return stored;
+  const [iv, tag, ct] = stored.slice(PREFIX.length).split(".");
+  if (!iv || !tag || !ct) throw new Error("malformed encrypted value");
+  const decipher = createDecipheriv(
+    "aes-256-gcm",
+    await masterKey(),
+    Buffer.from(iv, "base64url")
+  );
+  decipher.setAuthTag(Buffer.from(tag, "base64url"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(ct, "base64url")),
+    decipher.final()
+  ]).toString("utf8");
+}
+async function tryDecryptSecret(stored, label) {
+  try {
+    return await decryptSecret(stored);
+  } catch {
+    console.error(
+      `[secrets] cannot decrypt ${label} \u2014 SECRETS_KEY does not match the key this value was written with. Unset it to fall back to the stored key, or re-enter the value to replace it.`
+    );
+    return null;
+  }
+}
+var cached = null;
+var inFlight = null;
+async function masterKey() {
+  const fromEnv = (process.env.SECRETS_KEY || "").trim();
+  if (fromEnv) {
+    if (cached?.id !== fromEnv) {
+      cached = { id: fromEnv, key: createHash2("sha256").update(fromEnv).digest() };
+    }
+    return cached.key;
+  }
+  const db = getDb();
+  const id = `db:${db.dialect}:${dbIdentity(db)}`;
+  if (cached?.id === id) return cached.key;
+  if (!inFlight) inFlight = loadOrCreateKey(id).finally(() => inFlight = null);
+  return inFlight;
+}
+async function loadOrCreateKey(id) {
+  const db = getDb();
+  const read = async () => await db.get("SELECT value FROM server_settings WHERE key = ?", [
+    MASTER_KEY_SETTING
+  ]);
+  let row = await read();
+  if (!row?.value) {
+    const sql = db.dialect === "sqlite" ? `INSERT OR IGNORE INTO server_settings (key, value, env_at_write, updated_at)
+           VALUES (?, ?, NULL, ${nowExpr(db)})` : `INSERT INTO server_settings (key, value, env_at_write, updated_at)
+           VALUES (?, ?, NULL, ${nowExpr(db)}) ON CONFLICT (key) DO NOTHING`;
+    await db.run(sql, [MASTER_KEY_SETTING, randomBytes(32).toString("hex")]);
+    row = await read();
+  }
+  if (!row?.value) throw new Error("could not establish an encryption key");
+  const key = Buffer.from(row.value, "hex");
+  cached = { id, key };
+  return key;
+}
+function dbIdentity(db) {
+  return process.env.DATABASE_URL || process.env.DATA_ROOT || db.dialect;
+}
+
 // src/db/settings.ts
 var deployBaseline = null;
 function norm(v) {
@@ -163,6 +264,9 @@ function baseline() {
 async function persistSetting(name, value) {
   const db = getDb();
   const envAtWrite = norm(baseline()[name]);
+  const seal = async (v) => v !== null && isSecretSetting(name) ? await encryptSecret(v) : v;
+  const sealedValue = await seal(value);
+  const sealedBaseline = await seal(envAtWrite);
   await db.run(
     insertOrReplace(
       db,
@@ -171,7 +275,7 @@ async function persistSetting(name, value) {
       ["key"],
       `value = excluded.value, env_at_write = excluded.env_at_write, updated_at = ${nowExpr(db)}`
     ),
-    [name, value, envAtWrite]
+    [name, sealedValue, sealedBaseline]
   );
 }
 async function loadServerSettings() {
@@ -183,7 +287,12 @@ async function loadServerSettings() {
   );
   let applied = 0;
   for (const row of rows) {
+    if (row.key === MASTER_KEY_SETTING) continue;
     const envVal = norm(base[row.key]);
+    if (isSecretSetting(row.key)) {
+      row.value = row.value === null ? null : await tryDecryptSecret(row.value, row.key);
+      row.env_at_write = row.env_at_write === null ? null : await tryDecryptSecret(row.env_at_write, `${row.key} (baseline)`);
+    }
     if (envVal !== norm(row.env_at_write)) {
       await persistSetting(row.key, envVal);
       if (envVal === null) delete process.env[row.key];
@@ -226,7 +335,7 @@ async function installLicenseKey(key) {
   }
   const previousKey = process.env.PROMPTOWL_KEY || "";
   process.env.PROMPTOWL_KEY = trimmed;
-  const info = await validateLicense({ forceFresh: true });
+  const info = await validateLicense({ forceFresh: true, strict: true });
   if (!info.valid) {
     process.env.PROMPTOWL_KEY = previousKey;
     if (previousKey) {
@@ -309,12 +418,26 @@ function isSuspended() {
 function getSuspensionReason() {
   return suspensionReason;
 }
+var REJECTION_STRIKES_TO_REVOKE = 3;
+var rejectionStreak = 0;
+var rejectionKey = null;
+function fromCache(cached2) {
+  return {
+    valid: true,
+    tier: cached2.tier,
+    org: cached2.org,
+    limits: cached2.limits_json ? JSON.parse(cached2.limits_json) : null,
+    suspended: suspensionConfirmed,
+    suspendedReason: suspensionReason,
+    ownerEmail: cached2.owner_email || null
+  };
+}
 async function validateLicense(opts = {}) {
-  const info = await _validateLicenseImpl(!!opts.forceFresh);
+  const info = await _validateLicenseImpl(!!opts.forceFresh, !!opts.strict);
   currentLicense = info;
   return info;
 }
-async function _validateLicenseImpl(forceFresh) {
+async function _validateLicenseImpl(forceFresh, strict) {
   const key = config.PROMPTOWL_KEY;
   if (!key) {
     return {
@@ -328,22 +451,14 @@ async function _validateLicenseImpl(forceFresh) {
     };
   }
   const db = getDb();
-  const cached = await db.get(
+  const cached2 = await db.get(
     "SELECT * FROM license_cache WHERE key = ?",
     [key]
   );
-  if (cached && !forceFresh) {
-    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
+  if (cached2 && !forceFresh) {
+    const age = Date.now() - (/* @__PURE__ */ new Date(cached2.validated_at + "Z")).getTime();
     if (age < CACHE_TTL_MS) {
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
+      return fromCache(cached2);
     }
   }
   try {
@@ -354,19 +469,11 @@ async function _validateLicenseImpl(forceFresh) {
       body: JSON.stringify({ key })
     });
     if (!res.ok) {
-      if (cached) {
+      if (cached2) {
         console.warn(
           "  PromptOwl unreachable, using cached license (grace period)"
         );
-        return {
-          valid: true,
-          tier: cached.tier,
-          org: cached.org,
-          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-          suspended: suspensionConfirmed,
-          suspendedReason: suspensionReason,
-          ownerEmail: cached.owner_email || null
-        };
+        return fromCache(cached2);
       }
       return {
         valid: false,
@@ -412,6 +519,20 @@ async function _validateLicenseImpl(forceFresh) {
 `
         );
       }
+      if (data.valid !== true) {
+        rejectionStreak = 0;
+        rejectionKey = null;
+        if (cached2) return fromCache(cached2);
+        return {
+          valid: false,
+          tier: "none",
+          org: null,
+          limits: null,
+          suspended: suspensionConfirmed,
+          suspendedReason: suspensionReason,
+          ownerEmail: data.owner_email || null
+        };
+      }
     } else {
       if (suspensionFirstSeen) {
         console.log("  Suspension flag cleared by PromptOwl.");
@@ -421,6 +542,18 @@ async function _validateLicenseImpl(forceFresh) {
       suspensionReason = null;
     }
     if (!data.valid && !data.suspended) {
+      if (cached2 && !strict) {
+        rejectionStreak = rejectionKey === key ? rejectionStreak + 1 : 1;
+        rejectionKey = key;
+        if (rejectionStreak < REJECTION_STRIKES_TO_REVOKE) {
+          console.warn(
+            `[license] PromptOwl rejected the license (${rejectionStreak}/${REJECTION_STRIKES_TO_REVOKE}); keeping the cached license until the rejection is confirmed`
+          );
+          return fromCache(cached2);
+        }
+      }
+      rejectionStreak = 0;
+      rejectionKey = null;
       await db.run("DELETE FROM license_cache WHERE key = ?", [key]);
       return {
         valid: false,
@@ -433,6 +566,8 @@ async function _validateLicenseImpl(forceFresh) {
       };
     }
     if (data.valid) {
+      rejectionStreak = 0;
+      rejectionKey = null;
       const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
       await db.run(
         insertOrReplace(
@@ -461,19 +596,11 @@ async function _validateLicenseImpl(forceFresh) {
       ownerEmail: data.owner_email || null
     };
   } catch (err) {
-    if (cached) {
+    if (cached2) {
       console.warn(
         `  PromptOwl validation failed (${err.message}), using cached license`
       );
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
+      return fromCache(cached2);
     }
     return {
       valid: false,
@@ -598,491 +725,6 @@ function parseAccessYaml(content) {
 // src/governance/teams-service.ts
 import { v4 as uuid2 } from "uuid";
 
-// src/governance/roles.ts
-function collabPermToRole(permission) {
-  switch (permission) {
-    case "owner":
-      return "owner";
-    case "admin":
-      return "admin";
-    case "write":
-      return "editor";
-    case "read":
-      return "viewer";
-    default:
-      return null;
-  }
-}
-function teamRoleToPermission(role) {
-  switch (role) {
-    case "admin":
-      return "admin";
-    case "editor":
-      return "write";
-    case "viewer":
-      return "read";
-    default:
-      return null;
-  }
-}
-var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
-var canViewWith = (roles) => roles.length > 0;
-var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
-var PRECEDENCE = [
-  "owner",
-  "admin",
-  "editor",
-  "reviewer",
-  "viewer"
-];
-function primaryRole(roles) {
-  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
-  return null;
-}
-function permissionLabel(permission) {
-  const role = collabPermToRole(permission);
-  return role ? role[0].toUpperCase() + role.slice(1) : "Collaborator";
-}
-
-// src/notify/email-render.ts
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-var EVENT = {
-  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
-  ":x:": { icon: "\u274C", color: "#dc2626" },
-  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
-  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
-};
-var ALL_EMOJI = Object.fromEntries(
-  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
-);
-function renderText(message) {
-  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
-}
-var STATUS_META = {
-  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
-  mention: { subjectWord: "mentioned you", label: "Mention", color: "#7c3aed" },
-  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
-  pending_review: {
-    subjectWord: "awaiting review",
-    label: "Pending review",
-    color: "#d97706"
-  },
-  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" },
-  invited: { subjectWord: "invited you", label: "Invitation", color: "#2563eb" },
-  steward: { subjectWord: "steward", label: "Steward", color: "#7c3aed" },
-  deletion_requested: {
-    subjectWord: "flagged for deletion",
-    label: "Deletion requested",
-    color: "#d97706"
-  },
-  deletion_declined: {
-    subjectWord: "kept",
-    label: "Deletion rejected",
-    color: "#d97706"
-  },
-  deletion_deleted: {
-    subjectWord: "deleted",
-    label: "Deleted",
-    color: "#dc2626"
-  },
-  // An honoured ARCHIVE request. Deliberately not the deletion palette: the
-  // nest is intact and restorable, and red "Deleted" would tell the requester
-  // the opposite of what happened.
-  deletion_archived: {
-    subjectWord: "archived",
-    label: "Archived",
-    color: "#0891b2"
-  }
-};
-var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
-var shareRole = (permission) => permission ? permissionLabel(permission) : "collaborator";
-var detailRow = (label, valueHtml) => `<tr>
-      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
-      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
-    </tr>`;
-var plainRow = (label, value) => ({
-  label,
-  text: value,
-  html: escapeHtml(value)
-});
-var governanceRows = (x) => [
-  plainRow("Path", x.d.path),
-  { label: "Status", text: x.meta.label, html: x.statusBadge },
-  ...x.d.version != null ? [plainRow("Version", `v${x.d.version}`)] : []
-];
-var TEMPLATES = {
-  approved: {
-    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
-    detailsHeader: "Document details",
-    linkLabel: "Open document",
-    lineT: (x) => `${x.title}${x.vT} has been approved${x.byT}${x.noteT}.`,
-    lineH: (x) => `${x.doc}${x.vH} has been approved${x.byH}${x.noteH}.`,
-    rows: governanceRows
-  },
-  // A mention names one person, so this is the one template addressed to
-  // "you". `note` carries the comment's own words when there are any — a
-  // mention with no context reads as a summons.
-  mention: {
-    heading: (x) => `${x.d.actor || "Someone"} mentioned you in ${x.title}`,
-    detailsHeader: "Document details",
-    linkLabel: "Open document",
-    lineT: (x) => `You were mentioned in ${x.title}${x.byT}${x.noteT}.`,
-    lineH: (x) => `You were mentioned in ${x.doc}${x.byH}${x.noteH}.`,
-    rows: (x) => [plainRow("Nest", x.d.path)]
-  },
-  rejected: {
-    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
-    detailsHeader: "Document details",
-    linkLabel: "Open document",
-    lineT: (x) => `${x.title}${x.vT} has been rejected${x.byT}${x.noteT}.`,
-    lineH: (x) => `${x.doc}${x.vH} has been rejected${x.byH}${x.noteH}.`,
-    rows: governanceRows
-  },
-  pending_review: {
-    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
-    detailsHeader: "Document details",
-    linkLabel: "Open document",
-    lineT: (x) => `A review has been requested for ${x.title}${x.vT}${x.byT}${x.noteT}.`,
-    lineH: (x) => `A review has been requested for ${x.doc}${x.vH}${x.byH}${x.noteH}.`,
-    rows: governanceRows
-  },
-  shared: {
-    heading: (x) => `You've been added to ${x.title}`,
-    detailsHeader: "Details",
-    linkLabel: "Open nest",
-    lineT: (x) => `You've been given ${shareRole(x.d.permission)} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
-    lineH: (x) => `You've been given <strong>${escapeHtml(shareRole(x.d.permission))}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
-    rows: (x) => [
-      plainRow("Nest", x.d.path),
-      ...x.d.permission ? [plainRow("Role", shareRole(x.d.permission))] : []
-    ]
-  },
-  invited: {
-    heading: (x) => `You've been invited to ${x.title}`,
-    detailsHeader: "Sign-in details",
-    linkLabel: "Sign in",
-    lineT: (x) => `You've been invited to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Sign in with your email and the temporary password below, then choose your own password.`,
-    lineH: (x) => `You've been invited to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Sign in with your email and the temporary password below, then choose your own password.`,
-    rows: (x) => [
-      plainRow("Email", x.d.actor || ""),
-      ...x.d.tempPassword ? [
-        {
-          label: "Temporary password",
-          text: x.d.tempPassword,
-          html: x.codeValue(x.d.tempPassword)
-        }
-      ] : []
-    ]
-  },
-  // Deletion requests reuse the governance details block — same "what/where/
-  // status" shape, and the reason/note rides in `note` like a review note.
-  deletion_requested: {
-    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
-    detailsHeader: "Document details",
-    linkLabel: "Review the request",
-    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or reject the request from the nest.`,
-    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or reject the request from the nest.`,
-    rows: governanceRows
-  },
-  deletion_declined: {
-    heading: (x) => `Your deletion request for ${x.title} was rejected`,
-    detailsHeader: "Document details",
-    linkLabel: "Open document",
-    lineT: (x) => `Your request to delete ${x.title} was rejected${x.byT}${x.noteT}. The document stays.`,
-    lineH: (x) => `Your request to delete ${x.doc} was rejected${x.byH}${x.noteH}. The document stays.`,
-    rows: governanceRows
-  },
-  deletion_deleted: {
-    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
-    detailsHeader: "Document details",
-    linkLabel: "Open nest",
-    lineT: (x) => `${x.title} has been deleted${x.byT}${x.noteT} \u2014 your deletion request was accepted.`,
-    lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
-    rows: governanceRows
-  },
-  deletion_archived: {
-    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
-    detailsHeader: "Nest details",
-    linkLabel: "Open nest",
-    lineT: (x) => `${x.title} has been archived${x.byT}${x.noteT} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
-    lineH: (x) => `${x.doc} has been archived${x.byH}${x.noteH} \u2014 your request was accepted. Nothing was deleted: every document and version is intact, and an owner can restore it.`,
-    rows: governanceRows
-  },
-  steward: {
-    heading: (x) => `You're now a steward of ${x.title}`,
-    detailsHeader: "Details",
-    linkLabel: "Open nest",
-    lineT: (x) => `You've been assigned as a ${x.d.permission || "reviewer"} steward of ${x.d.scopeLabel || x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open the nest below to start reviewing.`,
-    lineH: (x) => `You've been assigned as a <strong>${escapeHtml(x.d.permission || "reviewer")}</strong> steward of ${x.d.scopeLabel ? escapeHtml(x.d.scopeLabel) : x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open the nest below to start reviewing.`,
-    rows: (x) => [
-      plainRow("Nest", x.d.path),
-      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : [],
-      ...x.d.scopeLabel ? [plainRow("Scope", cap(x.d.scopeLabel))] : []
-    ]
-  }
-};
-function renderEmail(d) {
-  const meta = STATUS_META[d.status];
-  const t = TEMPLATES[d.status];
-  const title = d.docTitle.replace(/[\r\n]+/g, " ").trim();
-  const vLabel = d.version != null ? `v${d.version}` : "";
-  const ctx = {
-    d,
-    title,
-    doc: `<strong>${escapeHtml(title)}</strong>`,
-    byT: d.actor ? ` by ${d.actor}` : "",
-    byH: d.actor ? ` by ${escapeHtml(d.actor)}` : "",
-    noteT: d.note ? ` with the note: "${d.note}"` : "",
-    noteH: d.note ? ` with the note: &ldquo;${escapeHtml(d.note)}&rdquo;` : "",
-    vT: vLabel ? ` ${vLabel}` : "",
-    vH: vLabel ? ` ${vLabel}` : "",
-    meta,
-    statusBadge: `<span style="display:inline-block;padding:2px 9px;border-radius:9999px;background:#f3f4f6;color:${meta.color};font-size:12px;font-weight:600;">${meta.label}</span>`,
-    codeValue: (v) => `<span style="font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;font-weight:600;color:#111827;background:#f3f4f6;padding:2px 8px;border-radius:6px;">${escapeHtml(v)}</span>`
-  };
-  const heading = t.heading(ctx).replace(/[\r\n]+/g, " ").trim();
-  const subject = heading;
-  const detailsHeader = t.detailsHeader;
-  const linkLabel = t.linkLabel;
-  const lineH = t.lineH(ctx);
-  const rows = t.rows(ctx);
-  const detailLines = [
-    `${detailsHeader}:`,
-    ...rows.map((r) => `  ${r.label}: ${r.text}`),
-    ...d.link ? [`  ${linkLabel}: ${d.link}`] : []
-  ];
-  const text = ["Hi,", "", t.lineT(ctx), "", ...detailLines, "", "Regards,", "Community Nest"].join("\n");
-  const detailRows = rows.map((r) => detailRow(r.label, r.html)).join("");
-  const buttonRow = d.link ? `<tr><td style="padding:20px 24px 0;">
-        <table role="presentation" cellpadding="0" cellspacing="0" border="0"><tr>
-          <td bgcolor="${meta.color}" style="border-radius:6px;">
-            <a href="${escapeHtml(d.link)}" target="_blank" style="display:inline-block;padding:10px 20px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;">${linkLabel}</a>
-          </td>
-        </tr></table>
-      </td></tr>` : "";
-  const html = `<div style="margin:0;padding:24px;background:#f6f8fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#111827;">
-  <table role="presentation" width="480" cellpadding="0" cellspacing="0" border="0" align="center" style="width:100%;max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;">
-    <tr><td style="padding:20px 24px 0;">
-      <div style="font-size:12px;font-weight:700;color:#6b7280;letter-spacing:0.06em;text-transform:uppercase;">ContextNest</div>
-    </td></tr>
-    <tr><td style="padding:10px 24px 0;">
-      <h1 style="margin:0;font-size:19px;line-height:1.35;font-weight:700;color:#111827;">${escapeHtml(heading)}</h1>
-    </td></tr>
-    <tr><td style="padding:16px 24px 0;font-size:14px;line-height:1.6;color:#374151;">
-      Hi,<br><br>${lineH}
-    </td></tr>
-    <tr><td style="padding:20px 24px 0;">
-      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border:1px solid #eef0f2;border-radius:8px;">
-        <tr><td style="padding:12px 16px;">
-          <div style="font-size:11px;font-weight:600;color:#9ca3af;letter-spacing:0.04em;text-transform:uppercase;padding-bottom:4px;">${detailsHeader}</div>
-          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">${detailRows}</table>
-        </td></tr>
-      </table>
-    </td></tr>
-    ${buttonRow}
-    <tr><td style="padding:22px 24px 24px;font-size:14px;line-height:1.6;color:#374151;">
-      Regards,<br>Community Nest
-    </td></tr>
-  </table>
-</div>`;
-  return { subject, text, html };
-}
-function renderHtml(message, nestName2) {
-  const lead = message.match(/^(:[a-z_]+:)\s*/);
-  const meta = lead && EVENT[lead[1]] || { icon: "\u{1F514}", color: "#475569" };
-  const rest = lead ? message.slice(lead[0].length) : message;
-  const body = escapeHtml(rest).replace(/\*([^*]+)\*/g, "<strong>$1</strong>").replace(/\n/g, "<br>");
-  const safeNest = escapeHtml(nestName2);
-  return `<div style="background:#f6f8fa;padding:24px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden;">
-    <tr><td style="padding:20px 24px 16px;border-bottom:1px solid #f0f0f0;">
-      <div style="font-size:15px;font-weight:700;color:#111827;letter-spacing:-0.01em;">ContextNest</div>
-      <div style="font-size:13px;color:#6b7280;margin-top:2px;">${safeNest}</div>
-    </td></tr>
-    <tr><td style="padding:24px;">
-      <table role="presentation" cellpadding="0" cellspacing="0"><tr>
-        <td valign="top" style="font-size:22px;line-height:1;padding-right:14px;">${meta.icon}</td>
-        <td valign="top" style="font-size:15px;line-height:1.55;color:#111827;border-left:3px solid ${meta.color};padding-left:14px;">${body}</td>
-      </tr></table>
-    </td></tr>
-  </table>
-</div>`;
-}
-
-// src/notify/email.ts
-var transporterPromise = null;
-var configuredUrl = null;
-var warnedOnce = false;
-var SMTP_TIMEOUT_DEFAULTS = [
-  ["connectionTimeout", 5e3],
-  ["greetingTimeout", 5e3],
-  ["socketTimeout", 1e4]
-];
-function withTimeouts(url) {
-  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-  const missing = SMTP_TIMEOUT_DEFAULTS.filter(
-    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
-  ).map(([name, ms]) => `${name}=${ms}`);
-  if (missing.length === 0) return url;
-  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
-}
-var POOL_DEFAULTS = [
-  ["pool", "true"],
-  ["maxConnections", "1"],
-  ["rateDelta", "1000"],
-  ["rateLimit", "8"]
-  // messages per second
-];
-function withPool(url) {
-  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-  const missing = POOL_DEFAULTS.filter(
-    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
-  ).map(([name, val]) => `${name}=${val}`);
-  if (missing.length === 0) return url;
-  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
-}
-async function verifySmtp(url) {
-  let transporter = null;
-  try {
-    const nodemailer = await import("nodemailer");
-    transporter = nodemailer.default.createTransport(withTimeouts(url), {
-      disableFileAccess: true,
-      disableUrlAccess: true
-    });
-    await transporter.verify();
-    return { ok: true };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  } finally {
-    try {
-      transporter?.close?.();
-    } catch {
-    }
-  }
-}
-async function getTransporter() {
-  const url = config.SMTP_URL;
-  if (!url) return null;
-  if (!transporterPromise || configuredUrl !== url) {
-    configuredUrl = url;
-    transporterPromise = import("nodemailer").then(
-      (nodemailer) => (
-        // withPool → connection pool + per-second rate limit, so a burst queues
-        // instead of tripping the provider's "too many emails" 550.
-        nodemailer.default.createTransport(withPool(withTimeouts(url)), {
-          // Per-message defaults (belt-and-braces; also set on each sendMail).
-          disableFileAccess: true,
-          disableUrlAccess: true
-        })
-      )
-    );
-    transporterPromise.catch(() => {
-      transporterPromise = null;
-      configuredUrl = null;
-    });
-  }
-  return transporterPromise;
-}
-async function notifyEmailForNest(nestId, message, details) {
-  const from = config.NOTIFY_EMAIL_FROM;
-  const to = config.NOTIFY_EMAIL_TO;
-  if (!config.SMTP_URL || !from || !to) return;
-  try {
-    const transporter = await getTransporter();
-    if (!transporter) return;
-    let subject;
-    let text;
-    let html;
-    if (details) {
-      ({ subject, text, html } = renderEmail(details));
-    } else {
-      let name = nestId;
-      try {
-        const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-          nestId
-        ]);
-        if (row?.name) name = row.name;
-      } catch {
-      }
-      const safeName = name.replace(/[\r\n]+/g, " ").trim();
-      subject = `ContextNest \xB7 ${safeName}`;
-      text = renderText(message);
-      html = renderHtml(message, safeName);
-    }
-    await transporter.sendMail({
-      from,
-      to,
-      subject,
-      text,
-      html,
-      disableFileAccess: true,
-      disableUrlAccess: true
-    });
-  } catch (err) {
-    if (!warnedOnce) {
-      warnedOnce = true;
-      console.warn(
-        "[email] notification failed (suppressing further warnings):",
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
-}
-function isEmailConfigured() {
-  return !!config.SMTP_URL && !!config.NOTIFY_EMAIL_FROM;
-}
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-function recipientEnvelope(to, from) {
-  const recipients = Array.isArray(to) ? to : [to];
-  return recipients.length > 1 ? { to: from, bcc: recipients } : { to: recipients[0] };
-}
-function isRateLimited(err) {
-  const msg = String(err?.message ?? err);
-  const code = Number(err?.responseCode);
-  return /too many|rate limit|throttl|try again|4\.7\.\d|too many emails/i.test(msg) || code === 421 || code === 429 || code === 450 || code === 451 || code === 550 && /too many|rate/i.test(msg);
-}
-async function sendMailWithRetry(transporter, msg, attempts = 5) {
-  for (let i = 0; ; i++) {
-    try {
-      return await transporter.sendMail(msg);
-    } catch (err) {
-      if (i >= attempts - 1 || !isRateLimited(err)) throw err;
-      const wait = 1e3 * 2 ** i;
-      await sleep(wait);
-    }
-  }
-}
-async function sendEmailToRecipient(to, details) {
-  const from = config.NOTIFY_EMAIL_FROM;
-  const hasRecipient = Array.isArray(to) ? to.length > 0 : !!to;
-  if (!config.SMTP_URL || !from || !hasRecipient) return;
-  try {
-    const transporter = await getTransporter();
-    if (!transporter) return;
-    const { subject, text, html } = renderEmail(details);
-    await sendMailWithRetry(transporter, {
-      from,
-      ...recipientEnvelope(to, from),
-      subject,
-      text,
-      html,
-      disableFileAccess: true,
-      disableUrlAccess: true
-    });
-  } catch (err) {
-    if (!warnedOnce) {
-      warnedOnce = true;
-      console.warn(
-        "[email] notification failed (suppressing further warnings):",
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
-}
-
 // src/governance/title-resolver.ts
 async function buildTitleMap(nestId) {
   try {
@@ -1519,23 +1161,9 @@ async function resolveMemberIdentity(params) {
   if (!requested) {
     throw new ValidationError("user_id or email is required");
   }
-  const existing = await db.get(
-    "SELECT id, email FROM users WHERE LOWER(email) = ?",
-    [requested]
-  );
-  if (existing) {
-    return {
-      userId: existing.id,
-      email: normalizeEmail(existing.email ?? requested)
-    };
-  }
-  const { hashPassword } = await import("./keys-CTOGAG3W.js");
-  const userId = uuid2();
-  await db.run(
-    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [userId, requested, null, await hashPassword(uuid2())]
-  );
-  return { userId, email: requested };
+  const { findOrCreateInvitedUser } = await import("./invited-user-XEBX6BM4.js");
+  const { id } = await findOrCreateInvitedUser(requested);
+  return { userId: id, email: requested };
 }
 async function replaceTeamRoster(params) {
   for (const m of params.members) assertValidRole(m.role);
@@ -2153,7 +1781,15 @@ async function renameNest(nestId, patch) {
   );
   return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]);
 }
+async function assertCanCreateNest(userId) {
+  if (config.AUTH_MODE === "open" || config.NEST_CREATION === "everyone" || await isServerAdminUserId(userId))
+    return;
+  throw new ForbiddenError(
+    "Only a server admin can create nests on this server. Ask your admin to share a nest with you."
+  );
+}
 async function createNest(userId, name, description) {
+  await assertCanCreateNest(userId);
   const id = uuid3();
   const db = getDb();
   const trimmed = plainName(name);
@@ -2181,6 +1817,7 @@ async function createNest(userId, name, description) {
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
 async function importNest(userId, name) {
+  await assertCanCreateNest(userId);
   const nm = plainName(name || "", "name is required");
   const db = getDb();
   const id = uuid3();
@@ -2637,8 +2274,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-TER6FDBP.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-CAGENHDJ.js");
+  const { engineCache: engineCache2 } = await import("./engine-HLYQLP5T.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-3DFQ4EZZ.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2896,6 +2533,8 @@ export {
   insertOrReplace,
   trackEvent,
   startTelemetryLoop,
+  encryptSecret,
+  tryDecryptSecret,
   persistSetting,
   loadServerSettings,
   getCurrentLicense,
@@ -2911,15 +2550,6 @@ export {
   getAccessConfig,
   isSuperAdmin,
   isConfigSuperAdmin,
-  collabPermToRole,
-  canViewWith,
-  canEditWith,
-  canApproveWith,
-  primaryRole,
-  verifySmtp,
-  notifyEmailForNest,
-  isEmailConfigured,
-  sendEmailToRecipient,
   nestStorageRoot,
   resolveNestPath,
   normalizeTag,