@promptowl/contextnest-community 1.9.0 → 1.10.0

package/dist/{chunk-VC3QNHHB.js → chunk-ZM4F7MY7.js}

@@ -1,14 +1,29 @@
+import {
+  grantCoversNode,
+  listUserGrants,
+  resolveNodeGrant
+} from "./chunk-7PQREKSM.js";
 import {
   createVersion,
+  getApprovedVersion,
   setApprovedVersion
-} from "./chunk-HRQWNRVI.js";
+} from "./chunk-UHUU3VAK.js";
 import {
   buildDocContext,
   buildTitleMap,
+  canUserAccess,
   canUserApprove,
+  describeNode,
   engineCache,
+  isPublicReader,
+  isStewardshipEnabled,
   resolveStewardsForNode
-} from "./chunk-BYS4HDME.js";
+} from "./chunk-KFGZIECB.js";
+import {
+  ConflictError,
+  NotFoundError,
+  ValidationError
+} from "./chunk-3JTODC3Y.js";
 import {
   insertOrReplace,
   nowExpr
@@ -16,10 +31,593 @@ import {
 import {
   config,
   getDb
-} from "./chunk-DPHV6Q26.js";
+} from "./chunk-BC6KFUZH.js";
 
 // src/governance/review-service.ts
+import { v4 as uuid3 } from "uuid";
+
+// src/governance/notify-service.ts
 import { v4 as uuid } from "uuid";
+async function listWatchers(nestId, nodeId) {
+  return await getDb().all(
+    `SELECT id, node_id, user_email, created_by, created_at
+       FROM watchers WHERE nest_id = ? AND node_id = ? ORDER BY created_at`,
+    [nestId, nodeId]
+  );
+}
+async function addWatcher(nestId, nodeId, userEmail, createdBy) {
+  await getDb().run(
+    `INSERT INTO watchers (id, nest_id, node_id, user_email, created_by, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(nest_id, node_id, user_email) DO NOTHING`,
+    [uuid(), nestId, nodeId, userEmail.toLowerCase(), createdBy, (/* @__PURE__ */ new Date()).toISOString()]
+  );
+}
+async function removeWatcher(nestId, nodeId, userEmail) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT id FROM watchers WHERE nest_id = ? AND node_id = ? AND LOWER(user_email) = LOWER(?)",
+    [nestId, nodeId, userEmail]
+  );
+  if (!row) return false;
+  await db.run("DELETE FROM watchers WHERE id = ?", [row.id]);
+  return true;
+}
+async function notifyReviewRequested(params) {
+  const { nestId, nodeId, requestedBy, reviewId } = params;
+  const db = getDb();
+  try {
+    const rows = await db.all(
+      `SELECT DISTINCT w.user_email, w.node_id AS via
+         FROM watchers w
+        WHERE w.nest_id = ?
+          AND (w.node_id = ?
+               OR w.node_id IN (
+                 SELECT e.from_node FROM edges e
+                   JOIN edge_types t ON t.id = e.type_id
+                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
+               ))`,
+      [nestId, nodeId, nestId, nodeId]
+    );
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let created = 0;
+    for (const r of rows) {
+      if (r.user_email.toLowerCase() === requestedBy.toLowerCase()) continue;
+      await db.run(
+        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+         VALUES (?, ?, ?, 'review_requested', ?, ?, ?)`,
+        [
+          uuid(),
+          nestId,
+          r.user_email.toLowerCase(),
+          reviewId,
+          r.via === nodeId ? `"${nodeId}" has a new version awaiting review (submitted by ${requestedBy})` : `Agent "${r.via}" produced output on "${nodeId}" \u2014 awaiting review`,
+          now
+        ]
+      );
+      created++;
+    }
+    return created;
+  } catch (err) {
+    console.error("[notify] review fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
+async function notifyReviewResolved(params) {
+  const { nestId, nodeId, status, resolvedBy, requestedBy, reviewId } = params;
+  const db = getDb();
+  try {
+    const rows = await db.all(
+      `SELECT DISTINCT w.user_email
+         FROM watchers w
+        WHERE w.nest_id = ?
+          AND (w.node_id = ?
+               OR w.node_id IN (
+                 SELECT e.from_node FROM edges e
+                   JOIN edge_types t ON t.id = e.type_id
+                  WHERE e.nest_id = ? AND e.to_node = ? AND t.is_flow = 1
+               ))`,
+      [nestId, nodeId, nestId, nodeId]
+    );
+    const recipients = new Set(rows.map((r) => r.user_email.toLowerCase()));
+    recipients.add(requestedBy.toLowerCase());
+    recipients.delete(resolvedBy.toLowerCase());
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let created = 0;
+    for (const email of recipients) {
+      await db.run(
+        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [
+          uuid(),
+          nestId,
+          email,
+          `review_${status}`,
+          reviewId,
+          `"${nodeId}" was ${status} by ${resolvedBy}`,
+          now
+        ]
+      );
+      created++;
+    }
+    return created;
+  } catch (err) {
+    console.error("[notify] resolution fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
+async function listNotifications(userEmail, opts = {}) {
+  const limit = Math.min(opts.limit ?? 50, 200);
+  return await getDb().all(
+    `SELECT id, nest_id, kind, subject_id, message, created_at, read_at
+       FROM notifications
+      WHERE LOWER(user_email) = LOWER(?)${opts.unreadOnly ? " AND read_at IS NULL" : ""}
+      ORDER BY created_at DESC LIMIT ${limit}`,
+    [userEmail]
+  );
+}
+async function markNotificationsRead(userEmail, ids) {
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  if (ids === "all") {
+    await db.run(
+      "UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND read_at IS NULL",
+      [now, userEmail]
+    );
+    return;
+  }
+  for (const id of ids.slice(0, 200)) {
+    await db.run(
+      "UPDATE notifications SET read_at = ? WHERE id = ? AND LOWER(user_email) = LOWER(?)",
+      [now, id, userEmail]
+    );
+  }
+}
+
+// src/workflow/env-routes.ts
+import { Hono as Hono2 } from "hono";
+
+// src/governance/access-guard.ts
+async function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
+  const db = getDb();
+  const row = await db.get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
+  return row?.email || "admin@localhost";
+}
+async function canReadNode(nestId, nodeId, userId, userEmail) {
+  if (await isPublicReader(nestId, userId)) {
+    return await getApprovedVersion(nestId, nodeId) !== null;
+  }
+  if (!await isStewardshipEnabled(nestId)) return true;
+  if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
+  return await resolveNodeGrant(nestId, userId, nodeId) !== null;
+}
+async function filterAccessible(nestId, userId, userEmail, nodes) {
+  if (await isPublicReader(nestId, userId)) {
+    const filtered = [];
+    for (const n of nodes) {
+      if (await getApprovedVersion(nestId, n.id) !== null) {
+        filtered.push(n);
+      }
+    }
+    return filtered;
+  }
+  if (!await isStewardshipEnabled(nestId)) return nodes;
+  const grants = await listUserGrants(nestId, userId);
+  const accessible = [];
+  for (const n of nodes) {
+    if ((await canUserAccess(nestId, n.id, userEmail)).allowed || grantCoversNode(grants, n.id)) {
+      accessible.push(n);
+    }
+  }
+  return accessible;
+}
+
+// src/workflow/edge-type-routes.ts
+import { Hono } from "hono";
+import { v4 as uuid2 } from "uuid";
+
+// src/shared/json.ts
+var safeJson = (s) => {
+  if (!s) return null;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+};
+
+// src/workflow/flow-graph.ts
+async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT e.from_node, e.to_node FROM edges e
+       JOIN edge_types t ON t.id = e.type_id
+      WHERE e.nest_id = ? AND (t.is_flow = 1 OR t.id = ?)`,
+    [nestId, extraFlowTypeId ?? ""]
+  );
+  const adj = /* @__PURE__ */ new Map();
+  const indeg = /* @__PURE__ */ new Map();
+  const nodes = /* @__PURE__ */ new Set();
+  for (const r of rows) {
+    if (r.from_node === r.to_node) {
+      throw new ConflictError(
+        `cycle: ["${r.from_node}"] \u2014 a flow edge cannot be a self-loop`
+      );
+    }
+    nodes.add(r.from_node);
+    nodes.add(r.to_node);
+    (adj.get(r.from_node) ?? adj.set(r.from_node, []).get(r.from_node)).push(
+      r.to_node
+    );
+    indeg.set(r.to_node, (indeg.get(r.to_node) ?? 0) + 1);
+    if (!indeg.has(r.from_node)) indeg.set(r.from_node, 0);
+  }
+  const queue = [...nodes].filter((n) => (indeg.get(n) ?? 0) === 0);
+  let removed = 0;
+  while (queue.length) {
+    const cur = queue.shift();
+    removed++;
+    for (const nb of adj.get(cur) ?? []) {
+      indeg.set(nb, (indeg.get(nb) ?? 0) - 1);
+      if ((indeg.get(nb) ?? 0) === 0) queue.push(nb);
+    }
+  }
+  if (removed < nodes.size) {
+    throw new ConflictError(
+      "cycle: enabling flow on this edge type would create a cycle in the flow graph \u2014 flow edges must form a DAG"
+    );
+  }
+}
+
+// src/workflow/edge-type-routes.ts
+var requireWorkflowPlane = async (c, next) => {
+  if (!config.FEATURE_WORKFLOW_PLANE) {
+    return c.json(
+      {
+        error: "The workflow plane is not enabled on this server. An admin can turn it on with FEATURE_WORKFLOW_PLANE=true."
+      },
+      404
+    );
+  }
+  return next();
+};
+async function seedDefaultEdgeTypes(nestId) {
+  const db = getDb();
+  const existing = await db.get(
+    "SELECT COUNT(*) as c FROM edge_types WHERE nest_id = ?",
+    [nestId]
+  );
+  if (existing.c > 0) return;
+  const owner = await db.get(
+    "SELECT u.email FROM nests n JOIN users u ON u.id = n.user_id WHERE n.id = ?",
+    [nestId]
+  );
+  const createdBy = owner?.email ?? "admin@localhost";
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const defaults = [
+    ["next", "Unconditional flow: after the source completes, run the target.", 1, "#16a34a"],
+    ["on-success", "Follow only when the source step succeeded.", 1, "#16a34a"],
+    ["on-failure", "Follow only when the source step failed.", 1, "#ef4444"],
+    ["depends-on", "The source requires the target (ordering/lineage; not conditional flow).", 0, "#3b82f6"],
+    ["owned-by", "Ownership: the target person/team is accountable for the source node.", 0, "#64748b"]
+  ];
+  for (const [name, description, isFlow, color] of defaults) {
+    await db.run(
+      `INSERT INTO edge_types
+         (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
+       VALUES (?, ?, ?, ?, 'directed', ?, NULL, ?, ?, ?, ?)
+       ON CONFLICT DO NOTHING`,
+      [uuid2(), nestId, name, description, isFlow, color, createdBy, now, now]
+    );
+  }
+}
+function parseConditionSchema(raw) {
+  if (raw === void 0 || raw === null || raw === "") return null;
+  const obj = typeof raw === "string" ? safeJson(raw) : raw;
+  if (!obj || typeof obj !== "object" || !Array.isArray(obj.params) || !obj.params.every((p) => typeof p === "string")) {
+    throw new ValidationError(
+      'condition_schema must be {"params": [string\u2026], "mode_default"?: "structured"|"nl"|"open"}'
+    );
+  }
+  const mode = obj.mode_default;
+  if (mode !== void 0 && !["structured", "nl", "open"].includes(mode)) {
+    throw new ValidationError(
+      "condition_schema.mode_default must be structured | nl | open"
+    );
+  }
+  return JSON.stringify({ params: obj.params, mode_default: mode ?? "structured" });
+}
+var edgeTypeToResponse = (r) => ({
+  ...r,
+  is_flow: !!r.is_flow,
+  condition_schema: r.condition_schema ? safeJson(r.condition_schema) : null
+});
+var edgeTypeRoutes = new Hono();
+edgeTypeRoutes.get("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  await seedDefaultEdgeTypes(nestId);
+  const rows = await getDb().all(
+    "SELECT * FROM edge_types WHERE nest_id = ? ORDER BY LOWER(name)",
+    [nestId]
+  );
+  return c.json({ count: rows.length, edge_types: rows.map(edgeTypeToResponse) });
+});
+edgeTypeRoutes.post("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  if (typeof body.name !== "string" || !body.name.trim()) {
+    throw new ValidationError("name is required");
+  }
+  if (typeof body.description !== "string" || !body.description.trim()) {
+    throw new ValidationError("description (the articulation) is required");
+  }
+  const name = body.name.trim();
+  if (name.length > 100 || !/^[a-z0-9][a-z0-9-]*$/i.test(name)) {
+    throw new ValidationError(
+      "name must be alphanumeric-with-dashes, 100 chars max (e.g. escalates-when)"
+    );
+  }
+  const direction = String(body.direction ?? "directed");
+  if (!["directed", "undirected"].includes(direction)) {
+    throw new ValidationError("direction must be directed | undirected");
+  }
+  const conditionSchema = parseConditionSchema(body.condition_schema);
+  const isFlow = body.is_flow === true ? 1 : 0;
+  let color = null;
+  if (body.color !== void 0 && body.color !== null && body.color !== "") {
+    if (typeof body.color !== "string" || !/^#[0-9a-f]{6}$/i.test(body.color)) {
+      throw new ValidationError("color must be a 6-digit hex, e.g. #16a34a");
+    }
+    color = body.color;
+  }
+  const db = getDb();
+  const definedBy = await resolveCallerEmail(c.get("userId"));
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await seedDefaultEdgeTypes(nestId);
+  let created = false;
+  await db.transaction(async (tx) => {
+    const existing = await tx.get(
+      "SELECT id, is_flow FROM edge_types WHERE nest_id = ? AND LOWER(name) = LOWER(?)",
+      [nestId, name]
+    );
+    if (existing && !existing.is_flow && isFlow) {
+      await assertFlowGraphAcyclic(nestId, existing.id);
+    }
+    if (existing) {
+      await tx.run(
+        `UPDATE edge_types SET name = ?, description = ?, direction = ?, is_flow = ?,
+           condition_schema = ?, color = ?, updated_at = ? WHERE id = ?`,
+        [name, body.description.trim(), direction, isFlow, conditionSchema, color, now, existing.id]
+      );
+    } else {
+      created = true;
+      await tx.run(
+        `INSERT INTO edge_types
+           (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        [uuid2(), nestId, name, body.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+      );
+    }
+  });
+  const row = await db.get(
+    "SELECT * FROM edge_types WHERE nest_id = ? AND LOWER(name) = LOWER(?)",
+    [nestId, name]
+  );
+  return c.json({ edge_type: edgeTypeToResponse(row) }, created ? 201 : 200);
+});
+edgeTypeRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  await getDb().transaction(async (tx) => {
+    const row = await tx.get(
+      "SELECT id FROM edge_types WHERE id = ? AND nest_id = ?",
+      [id, nestId]
+    );
+    if (!row) throw new NotFoundError("Edge type not found");
+    const inUse = await tx.get(
+      "SELECT COUNT(*) as c FROM edges WHERE type_id = ?",
+      [id]
+    );
+    if (inUse.c > 0) {
+      throw new ValidationError(
+        `Edge type is in use by ${inUse.c} edge${inUse.c === 1 ? "" : "s"} \u2014 delete those first.`
+      );
+    }
+    await tx.run("DELETE FROM edge_types WHERE id = ?", [id]);
+  });
+  return c.json({ deleted: true });
+});
+
+// src/workflow/env-routes.ts
+var KEY_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
+var mask = (v) => v.length <= 4 ? "\u2022\u2022\u2022\u2022" : `\u2022\u2022\u2022\u2022${v.slice(-4)}`;
+var envRoutes = new Hono2();
+envRoutes.get("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const rows = await getDb().all(
+    "SELECT key, value, updated_by, updated_at FROM nest_env WHERE nest_id = ? ORDER BY key",
+    [nestId]
+  );
+  return c.json({
+    count: rows.length,
+    env: rows.map((r) => ({
+      key: r.key,
+      value_masked: mask(r.value),
+      updated_by: r.updated_by,
+      updated_at: r.updated_at
+    }))
+  });
+});
+envRoutes.put("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const key = typeof body.key === "string" ? body.key.trim() : "";
+  if (!KEY_RE.test(key)) {
+    throw new ValidationError(
+      "key must look like an env var: A-Z, digits, underscores (e.g. SLACK_TOKEN)"
+    );
+  }
+  if (typeof body.value !== "string" || !body.value) {
+    throw new ValidationError("value is required");
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const by = await resolveCallerEmail(c.get("userId"));
+  const db = getDb();
+  await db.run(
+    `INSERT INTO nest_env (nest_id, key, value, updated_by, updated_at)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(nest_id, key) DO UPDATE SET value = ?, updated_by = ?, updated_at = ?`,
+    [nestId, key, body.value, by, now, body.value, by, now]
+  );
+  return c.json({ key, value_masked: mask(body.value) }, 201);
+});
+envRoutes.delete("/:key", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const key = c.req.param("key");
+  const db = getDb();
+  const row = await db.get(
+    "SELECT key FROM nest_env WHERE nest_id = ? AND key = ?",
+    [nestId, key]
+  );
+  if (!row) throw new NotFoundError("No such env key");
+  await db.run("DELETE FROM nest_env WHERE nest_id = ? AND key = ?", [nestId, key]);
+  return c.json({ deleted: true });
+});
+async function envValues(nestId) {
+  const rows = await getDb().all(
+    "SELECT key, value FROM nest_env WHERE nest_id = ?",
+    [nestId]
+  );
+  const base = {};
+  if (process.env.ANTHROPIC_API_KEY) base.ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
+  return { ...base, ...Object.fromEntries(rows.map((r) => [r.key, r.value])) };
+}
+
+// src/notify/dispatch.ts
+function escapeMrkdwn(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var EVENT_EMOJI = {
+  review_requested: ":memo:",
+  review_approved: ":white_check_mark:",
+  review_rejected: ":x:",
+  run_failed: ":rotating_light:"
+};
+function formatBody(channel, nestName, ev) {
+  const line = `[${nestName}] ${ev.message}`;
+  if (channel === "slack") {
+    return { text: escapeMrkdwn(`${EVENT_EMOJI[ev.kind] ?? ""} *[${nestName}]* ${ev.message}`) };
+  }
+  if (channel === "teams") {
+    return { text: line };
+  }
+  return {
+    kind: ev.kind,
+    nest_id: ev.nestId,
+    nest_name: nestName,
+    message: ev.message,
+    subject_id: ev.subjectId ?? null,
+    actor: ev.actor ?? null,
+    at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function isForbiddenConnectorHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local") || h.endsWith(".internal"))
+    return true;
+  if (h === "::1" || h === "0.0.0.0" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd"))
+    return true;
+  const m = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  if (!m) return false;
+  const [a, b] = [Number(m[1]), Number(m[2])];
+  if (a === 127 || a === 10 || a === 0) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
+}
+function isSafeConnectorUrl(raw) {
+  if (!/^https:\/\//i.test(raw)) return false;
+  try {
+    return !isForbiddenConnectorHost(new URL(raw).hostname);
+  } catch {
+    return false;
+  }
+}
+async function resolveUrl(nestId, raw) {
+  if (raw.startsWith("env:")) {
+    const key = raw.slice(4).trim();
+    const env = await envValues(nestId);
+    const v = env[key];
+    return v && isSafeConnectorUrl(v) ? v : null;
+  }
+  return isSafeConnectorUrl(raw) ? raw : null;
+}
+var warned = /* @__PURE__ */ new Set();
+async function post(url, body, who) {
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 3e3);
+    try {
+      await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch (err) {
+    if (!warned.has(who)) {
+      warned.add(who);
+      console.warn(
+        `[connectors] delivery failed for ${who} (muting further warnings):`,
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+}
+async function dispatchEvent(ev) {
+  const db = getDb();
+  let nestName = ev.nestId;
+  try {
+    const row = await db.get("SELECT name FROM nests WHERE id = ?", [ev.nestId]);
+    if (row?.name) nestName = row.name;
+  } catch {
+  }
+  if (config.SLACK_WEBHOOK_URL) {
+    void post(
+      config.SLACK_WEBHOOK_URL,
+      formatBody("slack", nestName, ev),
+      "server-slack"
+    );
+  }
+  let rows = [];
+  try {
+    rows = await db.all(
+      "SELECT id, channel, url, events, enabled FROM connectors WHERE nest_id = ? AND enabled = 1",
+      [ev.nestId]
+    );
+  } catch {
+    return;
+  }
+  for (const r of rows) {
+    let kinds = [];
+    try {
+      kinds = JSON.parse(r.events);
+    } catch {
+    }
+    if (!kinds.includes("*") && !kinds.includes(ev.kind)) continue;
+    const url = await resolveUrl(ev.nestId, r.url);
+    if (!url) continue;
+    void post(url, formatBody(r.channel, nestName, ev), `connector:${r.id}`);
+  }
+}
 
 // src/notify/slack.ts
 var warnedOnce = false;
@@ -35,7 +633,7 @@ async function notifySlackForNest(nestId, message) {
   }
   return notifySlack(`*[${nestName}]* ${message}`);
 }
-function escapeMrkdwn(s) {
+function escapeMrkdwn2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 async function notifySlack(text) {
@@ -48,7 +646,7 @@ async function notifySlack(text) {
       await fetch(url, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ text: escapeMrkdwn(text) }),
+        body: JSON.stringify({ text: escapeMrkdwn2(text) }),
         signal: ctrl.signal
       });
     } finally {
@@ -237,6 +835,25 @@ function withTimeouts(url) {
   if (missing.length === 0) return url;
   return url + (url.includes("?") ? "&" : "?") + missing.join("&");
 }
+async function verifySmtp(url) {
+  let transporter = null;
+  try {
+    const nodemailer = await import("nodemailer");
+    transporter = nodemailer.default.createTransport(withTimeouts(url), {
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+    await transporter.verify();
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    try {
+      transporter?.close?.();
+    } catch {
+    }
+  }
+}
 async function getTransporter() {
   const url = config.SMTP_URL;
   if (!url) return null;
@@ -373,7 +990,7 @@ async function submitForReview(params) {
   if (existing) {
     throw new Error("A review is already pending for this node");
   }
-  const id = uuid();
+  const id = uuid3();
   await db.run(
     `INSERT INTO review_requests
      (id, nest_id, node_id, version, requested_by, request_note, priority)
@@ -393,6 +1010,13 @@ async function submitForReview(params) {
     [params.nestId, params.nodeId, params.version]
   );
   const reviewCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
+  void dispatchEvent({
+    kind: "review_requested",
+    nestId: params.nestId,
+    subjectId: params.nodeId,
+    actor: params.requestedBy,
+    message: `Review requested on *${reviewCtx.label}* (v${params.version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
+  });
   void notifyNestEvent(
     params.nestId,
     `:memo: Review requested on *${reviewCtx.label}* (v${params.version}) by ${params.requestedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`,
@@ -406,6 +1030,12 @@ async function submitForReview(params) {
       note: params.note || null
     }
   );
+  await notifyReviewRequested({
+    nestId: params.nestId,
+    nodeId: params.nodeId,
+    requestedBy: params.requestedBy,
+    reviewId: id
+  });
   return await getReviewRequest(id);
 }
 async function approve(params) {
@@ -434,6 +1064,21 @@ async function approve(params) {
      WHERE id = ?`,
     [params.approvedBy, params.note || null, params.override ? 1 : 0, pending.id]
   );
+  void dispatchEvent({
+    kind: "review_approved",
+    nestId: params.nestId,
+    subjectId: params.nodeId,
+    actor: params.approvedBy,
+    message: `*${await describeNode(params.nestId, params.nodeId)}* v${params.version} approved by ${params.approvedBy}`
+  });
+  await notifyReviewResolved({
+    nestId: params.nestId,
+    nodeId: params.nodeId,
+    status: "approved",
+    resolvedBy: params.approvedBy,
+    requestedBy: pending.requested_by,
+    reviewId: pending.id
+  });
   await db.run(
     "UPDATE node_versions SET status = 'published' WHERE nest_id = ? AND node_id = ? AND version = ?",
     [params.nestId, params.nodeId, params.version]
@@ -524,6 +1169,13 @@ async function reject(params) {
     [params.nestId, params.nodeId, params.version]
   );
   const rejectCtx = await buildDocContext(params.nestId, params.nodeId, params.baseUrl);
+  void dispatchEvent({
+    kind: "review_rejected",
+    nestId: params.nestId,
+    subjectId: params.nodeId,
+    actor: params.rejectedBy,
+    message: `*${rejectCtx.label}* v${params.version} rejected by ${params.rejectedBy}${params.note ? ` \u2014 "${params.note}"` : ""}`
+  });
   void notifyNestEvent(
     params.nestId,
     `:x: *${rejectCtx.label}* v${params.version} rejected by ${params.rejectedBy} \u2014 "${params.note}"`,
@@ -537,6 +1189,14 @@ async function reject(params) {
       note: params.note || null
     }
   );
+  await notifyReviewResolved({
+    nestId: params.nestId,
+    nodeId: params.nodeId,
+    status: "rejected",
+    resolvedBy: params.rejectedBy,
+    requestedBy: pending.requested_by,
+    reviewId: pending.id
+  });
   return await getReviewRequest(pending.id);
 }
 async function cancelReview(params) {
@@ -653,6 +1313,25 @@ function rowToReviewRequest(row) {
 
 export {
   safePublishDocument,
+  listWatchers,
+  addWatcher,
+  removeWatcher,
+  listNotifications,
+  markNotificationsRead,
+  resolveCallerEmail,
+  canReadNode,
+  filterAccessible,
+  safeJson,
+  requireWorkflowPlane,
+  seedDefaultEdgeTypes,
+  parseConditionSchema,
+  edgeTypeToResponse,
+  edgeTypeRoutes,
+  envRoutes,
+  envValues,
+  isSafeConnectorUrl,
+  dispatchEvent,
+  verifySmtp,
   notifyNestEvent,
   submitForReview,
   approve,