@promptowl/contextnest-community 1.25.0 → 1.27.0

package/dist/{chunk-DTLMBF4W.js → chunk-VRLAP4HB.js}

@@ -4,23 +4,24 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-2KHM5C7V.js";
+} from "./chunk-MB52DWWP.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-KPGNZLZL.js";
+} from "./chunk-VHEMGQ3I.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-TI7HMP64.js";
+} from "./chunk-NFFUZF2B.js";
 import {
   buildDocContext,
   buildTitleMap,
   describeNode,
+  encryptSecret,
   engineApi,
   engineCache,
   insertOrReplace,
@@ -28,25 +29,29 @@ import {
   isStewardshipEnabled,
   markNotificationsReadBySubject,
   nestName,
-  notifyEmailForNest,
   notifyReviewRequested,
   notifyReviewResolved,
   nowExpr,
   opContext,
   prettyFolderPath,
   resolveNestPermission,
-  sendEmailToRecipient,
-  titleForNode
-} from "./chunk-7FROMOZM.js";
+  titleForNode,
+  tryDecryptSecret
+} from "./chunk-QMQDWRHN.js";
 import {
   ConflictError,
   NotFoundError,
   ValidationError
 } from "./chunk-LHWOJPFE.js";
+import {
+  notifyEmailForNest,
+  sendEmailToRecipient,
+  transportSettings
+} from "./chunk-RXCVXG34.js";
 import {
   config,
   getDb
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-H3W72HN3.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -359,12 +364,18 @@ envRoutes.get("/", requireWorkflowPlane, async (c) => {
   );
   return c.json({
     count: rows.length,
-    env: rows.map((r) => ({
-      key: r.key,
-      value_masked: mask(r.value),
-      updated_by: r.updated_by,
-      updated_at: r.updated_at
-    }))
+    env: await Promise.all(
+      rows.map(async (r) => ({
+        key: r.key,
+        // A value this server can't open still has a name worth listing, so
+        // the admin can see what to re-enter.
+        value_masked: mask(
+          await tryDecryptSecret(r.value, `${r.key} on nest ${nestId}`) ?? ""
+        ),
+        updated_by: r.updated_by,
+        updated_at: r.updated_at
+      }))
+    )
   });
 });
 envRoutes.put("/", requireWorkflowPlane, async (c) => {
@@ -382,11 +393,12 @@ envRoutes.put("/", requireWorkflowPlane, async (c) => {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const by = await resolveCallerEmail(c.get("userId"));
   const db = getDb();
+  const sealed = await encryptSecret(body.value);
   await db.run(
     `INSERT INTO nest_env (nest_id, key, value, updated_by, updated_at)
      VALUES (?, ?, ?, ?, ?)
      ON CONFLICT(nest_id, key) DO UPDATE SET value = ?, updated_by = ?, updated_at = ?`,
-    [nestId, key, body.value, by, now, body.value, by, now]
+    [nestId, key, sealed, by, now, sealed, by, now]
   );
   return c.json({ key, value_masked: mask(body.value) }, 201);
 });
@@ -409,7 +421,16 @@ async function envValues(nestId) {
   );
   const base = {};
   if (process.env.ANTHROPIC_API_KEY) base.ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
-  return { ...base, ...Object.fromEntries(rows.map((r) => [r.key, r.value])) };
+  if (config.ANTHROPIC_BASE_URL) base.ANTHROPIC_BASE_URL = config.ANTHROPIC_BASE_URL;
+  const stored = (await Promise.all(
+    rows.map(
+      async (r) => [
+        r.key,
+        await tryDecryptSecret(r.value, `${r.key} on nest ${nestId}`)
+      ]
+    )
+  )).filter((e) => e[1] !== null);
+  return { ...base, ...Object.fromEntries(stored) };
 }
 
 // src/notify/webhook.ts
@@ -712,7 +733,7 @@ async function flush(nestId) {
   ]);
 }
 async function notifyNestEvent(nestId, message, details, opts) {
-  if (!config.SLACK_WEBHOOK_URL && !config.MSTEAMS_WEBHOOK_URL && !config.SMTP_URL)
+  if (!config.SLACK_WEBHOOK_URL && !config.MSTEAMS_WEBHOOK_URL && !transportSettings())
     return;
   const buf = buffers.get(nestId);
   if (buf) {
@@ -1131,6 +1152,10 @@ async function getReviewQueue(params) {
     );
     args.push(...statuses);
   }
+  if (params.requestedByEmail) {
+    whereClauses.push("requested_by = ?");
+    args.push(params.requestedByEmail);
+  }
   const where = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
   const total = Number(
     (await db.get(

package/dist/{engine-TER6FDBP.js → engine-HLYQLP5T.js}

@@ -2,9 +2,10 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-7FROMOZM.js";
+} from "./chunk-QMQDWRHN.js";
 import "./chunk-LHWOJPFE.js";
-import "./chunk-JDAOA5KP.js";
+import "./chunk-RXCVXG34.js";
+import "./chunk-H3W72HN3.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-CAGENHDJ.js → external-edit-service-3DFQ4EZZ.js}

@@ -11,10 +11,11 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-32SZCH36.js";
-import "./chunk-7FROMOZM.js";
+} from "./chunk-SE5U4J4T.js";
+import "./chunk-QMQDWRHN.js";
 import "./chunk-LHWOJPFE.js";
-import "./chunk-JDAOA5KP.js";
+import "./chunk-RXCVXG34.js";
+import "./chunk-H3W72HN3.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-2OTFS7EH.js → grants-service-WICV4Y2J.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-KPGNZLZL.js";
+} from "./chunk-VHEMGQ3I.js";
 import "./chunk-LHWOJPFE.js";
-import "./chunk-JDAOA5KP.js";
+import "./chunk-H3W72HN3.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,