@promptowl/contextnest-community 1.7.0 → 1.9.0

package/dist/{chunk-QMLAXQES.js → chunk-DPHV6Q26.js}

@@ -2,6 +2,11 @@ import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
 
+// src/db/client.ts
+import Database from "better-sqlite3";
+import { mkdirSync, readFileSync } from "fs";
+import { dirname as dirname2 } from "path";
+
 // src/config.ts
 import { join, dirname } from "path";
 import { existsSync } from "fs";
@@ -20,6 +25,15 @@ if (envFileLoaded && !isTestRun) {
 }
 var canonicalEnvFile = process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
 var canonicalEnvLoaded = null;
+var slackUrlWarned = false;
+var emailFromWarned = false;
+var emailToWarned = false;
+function isEmailish(v) {
+  return /^[^\s@]+@[^\s@]+$/.test(v) && !/[\r\n]/.test(v);
+}
+function isEmailListish(v) {
+  return v.split(",").every((e) => isEmailish(e.trim()));
+}
 if (!isTestRun && canonicalEnvFile !== envFileLoaded && existsSync(canonicalEnvFile)) {
   dotenv.config({ path: canonicalEnvFile, override: true });
   canonicalEnvLoaded = canonicalEnvFile;
@@ -186,9 +200,133 @@ var config = {
     }
     return raw;
   },
+  /**
+   * Workflow plane ("turing" track): typed edges, edge-type registry, runs.
+   * OFF by default — an optional feature an admin turns on (env or Settings).
+   * This flag is also the future license-tier hook: gating a paid tier here
+   * is a one-line change because every plane route checks it per request.
+   */
+  get FEATURE_WORKFLOW_PLANE() {
+    return process.env.FEATURE_WORKFLOW_PLANE === "true";
+  },
+  /**
+   * Sub-agent runs: lets a run spawn nested runs (an external runner calling
+   * back into POST /run for a child agent). Gated SEPARATELY from the base
+   * plane because recursion is the risky surface — unbounded fan-out,
+   * re-entrancy, resource exhaustion. Off by default; must clear a security
+   * review before an operator turns it on. Requires FEATURE_WORKFLOW_PLANE too.
+   */
+  get FEATURE_SUBAGENT_RUNS() {
+    return process.env.FEATURE_SUBAGENT_RUNS === "true";
+  },
+  /** Hard ceiling on sub-agent nesting depth — keeps the call tree finite
+   *  (haltable / statically bounded). Clamped to [1, 32]. */
+  get SUBAGENT_MAX_DEPTH() {
+    const n = parseInt(process.env.SUBAGENT_MAX_DEPTH || "8", 10);
+    return Number.isFinite(n) ? Math.min(32, Math.max(1, n)) : 8;
+  },
+  /** Max direct children a single run may spawn. Depth bounds the tree's
+   *  height; this bounds its width — together they cap total size so a
+   *  runner can't fork-bomb the DB. Clamped to [1, 128]. */
+  get SUBAGENT_MAX_CHILDREN() {
+    const n = parseInt(process.env.SUBAGENT_MAX_CHILDREN || "16", 10);
+    return Number.isFinite(n) ? Math.min(128, Math.max(1, n)) : 16;
+  },
+  /** Max steps a single run may accumulate — bounds a runaway/hostile
+   *  runner's step log. Clamped to [10, 100000]. */
+  get RUN_MAX_STEPS() {
+    const n = parseInt(process.env.RUN_MAX_STEPS || "10000", 10);
+    return Number.isFinite(n) ? Math.min(1e5, Math.max(10, n)) : 1e4;
+  },
   get AUTH_MODE() {
     return process.env.AUTH_MODE || "key";
   },
+  /**
+   * Optional SMTP connection URL for email notifications, e.g.
+   * smtps://user:pass@smtp.example.com:465. smtp:// or smtps:// only.
+   * Empty/unset = email connector off. Requires NOTIFY_EMAIL_FROM/_TO.
+   */
+  get SMTP_URL() {
+    const raw = process.env.SMTP_URL?.trim();
+    if (!raw) return null;
+    if (!/^smtps?:\/\//i.test(raw)) {
+      console.warn(
+        "[config] SMTP_URL rejected: must be an smtp:// or smtps:// URL. Email notifications disabled."
+      );
+      return null;
+    }
+    return raw;
+  },
+  /**
+   * From address for notification emails. Shape-validated here (not only in
+   * the /admin/settings PATCH) so a value set directly via env/Docker can't
+   * reach nodemailer's envelope unchecked. Invalid = connector off.
+   */
+  get NOTIFY_EMAIL_FROM() {
+    const raw = process.env.NOTIFY_EMAIL_FROM?.trim();
+    if (!raw) return null;
+    if (!isEmailish(raw)) {
+      if (!emailFromWarned) {
+        emailFromWarned = true;
+        console.warn(
+          "[config] NOTIFY_EMAIL_FROM rejected: must be a plain email address. Email notifications disabled."
+        );
+      }
+      return null;
+    }
+    return raw;
+  },
+  /**
+   * Comma-separated recipient list for notification emails. Shape-validated
+   * here for the same env-bypass reason as NOTIFY_EMAIL_FROM. Invalid (any
+   * entry malformed) = connector off.
+   */
+  get NOTIFY_EMAIL_TO() {
+    const raw = process.env.NOTIFY_EMAIL_TO?.trim();
+    if (!raw) return null;
+    if (!isEmailListish(raw)) {
+      if (!emailToWarned) {
+        emailToWarned = true;
+        console.warn(
+          "[config] NOTIFY_EMAIL_TO rejected: must be a comma-separated list of email addresses. Email notifications disabled."
+        );
+      }
+      return null;
+    }
+    return raw;
+  },
+  /**
+   * Optional Slack incoming-webhook URL for team notifications (review
+   * submitted/approved/rejected, nest shared). Empty/unset = connector off.
+   * https only — a webhook carries an implicit secret in its path, so it
+   * never travels plaintext.
+   */
+  get SLACK_WEBHOOK_URL() {
+    const raw = process.env.SLACK_WEBHOOK_URL?.trim();
+    if (!raw) return null;
+    if (!/^https:\/\//i.test(raw)) {
+      if (!slackUrlWarned) {
+        slackUrlWarned = true;
+        console.warn(
+          "[config] SLACK_WEBHOOK_URL rejected: must be an https:// URL. Slack notifications disabled."
+        );
+      }
+      return null;
+    }
+    return raw;
+  },
+  /**
+   * Per-nest notification digest window in milliseconds. A burst of governance
+   * events on one nest inside this window collapses into a single digest
+   * message instead of one post per event. Empty / non-numeric / negative /
+   * unset → 15000 (15s).
+   */
+  get NOTIFY_DEBOUNCE_MS() {
+    const raw = process.env.NOTIFY_DEBOUNCE_MS?.trim();
+    if (!raw) return 15e3;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : 15e3;
+  },
   /**
    * CORS origin allowlist. Comma-separated list of origins or "*".
    * Defaults to "*" in open mode (read-heavy, no credentials to steal)
@@ -210,11 +348,6 @@ var config = {
   }
 };
 
-// src/db/client.ts
-import Database from "better-sqlite3";
-import { mkdirSync, readFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-
 // src/db/migrations.ts
 function runMigrations(db) {
   db.exec(`
@@ -781,6 +914,170 @@ function runMigrations(db) {
     })();
     recordMigration("012_merge_case_colliding_users");
   }
+  if (!hasMigration("019_grants")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS grants (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          target_type TEXT NOT NULL CHECK(target_type IN ('document', 'folder')),
+          target TEXT NOT NULL,        -- node id (document) or path prefix (folder)
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          role TEXT NOT NULL CHECK(role IN ('read', 'write')),
+          granted_by TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_grants_unique
+          ON grants(nest_id, target_type, target, user_id);
+        CREATE INDEX IF NOT EXISTS idx_grants_user ON grants(nest_id, user_id);
+      `);
+    })();
+    recordMigration("019_grants");
+  }
+  if (!hasMigration("013_node_deletion_tombstones")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS node_deletions (
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          deleted_by TEXT,
+          deleted_at TEXT NOT NULL,
+          PRIMARY KEY (nest_id, node_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_node_deletions_time
+          ON node_deletions(nest_id, deleted_at);
+      `);
+    })();
+    recordMigration("013_node_deletion_tombstones");
+  }
+  if (!hasMigration("014_api_events")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS api_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          kind TEXT NOT NULL CHECK(kind IN ('api', 'mcp')),
+          method TEXT,                 -- HTTP method (api rows)
+          path TEXT,                   -- request path (api rows)
+          tool TEXT,                   -- tool name (mcp rows)
+          nest_id TEXT,
+          user_id TEXT,
+          user_email TEXT,
+          status INTEGER,              -- HTTP status (api rows)
+          duration_ms INTEGER
+        );
+        CREATE INDEX IF NOT EXISTS idx_api_events_ts ON api_events(ts);
+      `);
+    })();
+    recordMigration("014_api_events");
+  }
+  if (!hasMigration("015_definitions")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS definitions (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          term TEXT NOT NULL,
+          definition TEXT NOT NULL,
+          linked_tag TEXT,               -- optional #tag this term maps to
+          defined_by TEXT NOT NULL,      -- email
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_definitions_term
+          ON definitions(nest_id, term COLLATE NOCASE);
+      `);
+    })();
+    recordMigration("015_definitions");
+  }
+  if (!hasMigration("016_workflow_edges")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS edge_types (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          description TEXT NOT NULL,
+          direction TEXT NOT NULL DEFAULT 'directed'
+            CHECK(direction IN ('directed', 'undirected')),
+          is_flow INTEGER NOT NULL DEFAULT 0,   -- flow types form the DAG
+          condition_schema TEXT,                -- JSON template | NULL
+          color TEXT,
+          created_by TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_edge_types_name
+          ON edge_types(nest_id, LOWER(name));
+
+        CREATE TABLE IF NOT EXISTS edges (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          from_node TEXT NOT NULL,
+          to_node TEXT NOT NULL,
+          -- RESTRICT (not CASCADE): the app refuses to delete an edge type
+          -- while edges reference it; the DB backs that invariant instead of
+          -- silently cascade-deleting live edges if the app check is bypassed.
+          type_id TEXT NOT NULL REFERENCES edge_types(id) ON DELETE RESTRICT,
+          condition_mode TEXT
+            CHECK(condition_mode IN ('structured', 'nl', 'open')),
+          condition TEXT,
+          metadata TEXT,
+          created_by TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_edges_from ON edges(nest_id, from_node);
+        CREATE INDEX IF NOT EXISTS idx_edges_to   ON edges(nest_id, to_node);
+        CREATE INDEX IF NOT EXISTS idx_edges_type ON edges(nest_id, type_id);
+      `);
+    })();
+    recordMigration("016_workflow_edges");
+  }
+  if (!hasMigration("017_workflow_runs")) {
+    db.transaction(() => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS runs (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          agent_node TEXT NOT NULL,
+          triggered_by TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'running'
+            CHECK(status IN ('running', 'succeeded', 'failed', 'cancelled')),
+          inputs TEXT,
+          trace TEXT,
+          started_at TEXT NOT NULL,
+          finished_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_runs_nest ON runs(nest_id, started_at);
+        CREATE INDEX IF NOT EXISTS idx_runs_agent ON runs(nest_id, agent_node);
+
+        CREATE TABLE IF NOT EXISTS run_steps (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+          seq INTEGER NOT NULL,
+          node_id TEXT,
+          edge_id TEXT,
+          action TEXT NOT NULL,
+          detail TEXT,
+          at TEXT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_run_steps ON run_steps(run_id, seq);
+      `);
+    })();
+    recordMigration("017_workflow_runs");
+  }
+  if (!hasMigration("018_subagent_runs")) {
+    db.transaction(() => {
+      db.exec(`
+        ALTER TABLE runs ADD COLUMN parent_run_id TEXT;
+        ALTER TABLE runs ADD COLUMN depth INTEGER NOT NULL DEFAULT 0;
+        CREATE INDEX IF NOT EXISTS idx_runs_parent ON runs(parent_run_id);
+      `);
+    })();
+    recordMigration("018_subagent_runs");
+  }
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -998,7 +1295,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-3HMGLKOV.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-ORSV7UFJ.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);
@@ -1018,23 +1315,18 @@ function getDb() {
   }
   return adapter;
 }
-
-// src/db/sql.ts
-function nowExpr(db) {
-  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
-}
-function insertOrIgnore(db, insertSql) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
-}
-function insertOrReplace(db, insertSql, conflictCols, set) {
-  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
+async function resetDb() {
+  if (adapter) {
+    await adapter.close();
+    adapter = null;
+  }
 }
 
 export {
+  isEmailish,
+  isEmailListish,
   config,
   initDb,
   getDb,
-  nowExpr,
-  insertOrIgnore,
-  insertOrReplace
+  resetDb
 };

package/dist/chunk-FRQJWGN3.js

@@ -0,0 +1,8 @@
+// src/shared/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+
+export {
+  normalizeEmail
+};

package/dist/{chunk-VD5QX2ZQ.js → chunk-HRQWNRVI.js}

@@ -1,8 +1,10 @@
 import {
-  getDb,
   insertOrReplace,
   nowExpr
-} from "./chunk-QMLAXQES.js";
+} from "./chunk-XQ46F76G.js";
+import {
+  getDb
+} from "./chunk-DPHV6Q26.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/chunk-TIO5XOFD.js

@@ -0,0 +1,103 @@
+import {
+  ValidationError
+} from "./chunk-3JTODC3Y.js";
+import {
+  getDb
+} from "./chunk-DPHV6Q26.js";
+
+// src/governance/grants-service.ts
+import { v4 as uuid } from "uuid";
+var rank = (r) => r === "write" ? 2 : 1;
+async function resolveNodeGrant(nestId, userId, nodeId) {
+  if (!userId || !nodeId) return null;
+  const rows = await getDb().all(
+    "SELECT target, role FROM grants WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
+  let best = null;
+  for (const r of rows) {
+    if (nodeId === r.target || nodeId.startsWith(r.target + "/")) {
+      if (!best || rank(r.role) > rank(best)) best = r.role;
+    }
+  }
+  return best;
+}
+async function hasAnyGrant(nestId, userId) {
+  if (!userId) return false;
+  const row = await getDb().get(
+    "SELECT 1 AS x FROM grants WHERE nest_id = ? AND user_id = ? LIMIT 1",
+    [nestId, userId]
+  );
+  return !!row;
+}
+async function listUserGrants(nestId, userId) {
+  if (!userId) return [];
+  return await getDb().all(
+    "SELECT target, role FROM grants WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
+}
+function grantCoversNode(grants, nodeId) {
+  return grants.some(
+    (g) => nodeId === g.target || nodeId.startsWith(g.target + "/")
+  );
+}
+async function createGrant(params) {
+  const { nestId, targetType, target, userId, role, grantedBy } = params;
+  if (!["document", "folder"].includes(targetType)) {
+    throw new ValidationError("target_type must be document | folder");
+  }
+  if (!["read", "write"].includes(role)) {
+    throw new ValidationError("role must be read | write");
+  }
+  if (!target.trim()) throw new ValidationError("target is required");
+  if (targetType === "folder") {
+    const t = target.trim().replace(/\/+$/, "");
+    if (t === "nodes" || t === "") {
+      throw new ValidationError("folder target must name a subfolder, not the nest root");
+    }
+  }
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = await db.get(
+    "SELECT id FROM grants WHERE nest_id = ? AND target_type = ? AND target = ? AND user_id = ?",
+    [nestId, targetType, target, userId]
+  );
+  if (existing) {
+    await db.run(
+      "UPDATE grants SET role = ?, granted_by = ?, updated_at = ? WHERE id = ?",
+      [role, grantedBy, now, existing.id]
+    );
+    return await db.get("SELECT * FROM grants WHERE id = ?", [existing.id]);
+  }
+  const id = uuid();
+  await db.run(
+    `INSERT INTO grants (id, nest_id, target_type, target, user_id, role, granted_by, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [id, nestId, targetType, target, userId, role, grantedBy, now, now]
+  );
+  return await db.get("SELECT * FROM grants WHERE id = ?", [id]);
+}
+async function listGrants(nestId) {
+  return await getDb().all(
+    "SELECT * FROM grants WHERE nest_id = ? ORDER BY target_type, target",
+    [nestId]
+  );
+}
+async function deleteGrant(nestId, id) {
+  const db = getDb();
+  const row = await db.get("SELECT id FROM grants WHERE id = ? AND nest_id = ?", [id, nestId]);
+  if (!row) return false;
+  await db.run("DELETE FROM grants WHERE id = ?", [id]);
+  return true;
+}
+
+export {
+  resolveNodeGrant,
+  hasAnyGrant,
+  listUserGrants,
+  grantCoversNode,
+  createGrant,
+  listGrants,
+  deleteGrant
+};