@promptowl/contextnest-community 0.1.0-alpha.1

package/CONFIGURATION.md

@@ -0,0 +1,118 @@
+# Configuration
+
+All server configuration is driven by environment variables. Set them in your shell, in a `.env` file, in a Docker image, or via your process manager — however you deploy the rest of your stack.
+
+## Auth modes
+
+The server supports two authentication modes. You pick one per instance with `AUTH_MODE`.
+
+### `AUTH_MODE=key` (default)
+
+Every request requires an `Authorization: Bearer cnst_...` header. Use this for any multi-user or internet-facing deployment.
+
+- Users register via `POST /auth/register` (email + password) or log in with PromptOwl via `POST /auth/device` → `POST /auth/promptowl`.
+- API keys are per-user (`cnst_<64-hex>`) and can be scoped to a single nest for service-account use.
+- Rate-limited login / register / device-auth endpoints (sliding window, per IP + per email).
+- First PromptOwl-authenticated user becomes the server admin (atomic claim). Admin can invite teammates at `POST /auth/invite`.
+
+Clients include the token on every request:
+
+```bash
+curl -H 'Authorization: Bearer cnst_<your-token>' http://your-server/nests
+```
+
+### `AUTH_MODE=open`
+
+No authentication required. Every request is attributed to the anonymous admin user (`00000000-...`). Everyone effectively owns every anon-created nest.
+
+**Use this only when:**
+- You're running locally for yourself (`bind 127.0.0.1`), or
+- You're on a trusted LAN and don't care about access controls, or
+- You're behind an upstream reverse proxy that already authenticates.
+
+**Don't use this when:**
+- The port is reachable from the public internet
+- Multiple people share the deployment and need isolated data
+- You need audit trails (every write shows up under "anonymous admin")
+
+The server prints a loud warning at startup when `AUTH_MODE=open` is active.
+
+---
+
+## Full env var reference
+
+| Var | Default | Purpose |
+|---|---|---|
+| `PORT` | `3838` | HTTP port the server listens on. |
+| `DATA_ROOT` | `./data` (relative to cwd) | Root directory for SQLite DB + nest filesystem vaults. Set to an absolute path in production so it's independent of where you `cd`'d from. |
+| `DATABASE_PATH` | `$DATA_ROOT/community.db` | Override the SQLite file location explicitly. |
+| `AUTH_MODE` | `key` | `key` or `open`. See above. |
+| `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
+| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community Server license key (`pk_...`). Unlicensed instances still run but some features may be limited. |
+| `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
+| `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
+| `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
+| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+
+---
+
+## Typical deployments
+
+### Local dev / single user
+
+```bash
+AUTH_MODE=open DATA_ROOT=./my-data pnpm dev
+```
+
+Or the default dev mode if `pnpm dev` already sets `AUTH_MODE=open` in your scripts.
+
+### Team / multi-user behind a reverse proxy
+
+```bash
+AUTH_MODE=key \
+CORS_ORIGINS="https://team.example.com,https://admin.example.com" \
+DATA_ROOT=/var/lib/contextnest \
+PROMPTOWL_KEY=pk_... \
+pnpm start
+```
+
+Terminate TLS at the proxy, forward `X-Forwarded-For` and `X-Real-IP` headers (the rate limiter reads them), and bind the server to `127.0.0.1` so only the proxy can reach it.
+
+### Hosted / commercial SaaS
+
+Same as team, plus:
+- Run N instances behind a load balancer sharing a network-attached `DATA_ROOT` (note: SQLite + shared filesystem is not a great long-term story — migrate to the MongoDB storage adapter when scaling beyond one box).
+- Set `TELEMETRY_ENABLED=true` and a valid `PROMPTOWL_KEY` so usage rolls up to PromptOwl.
+- Rotate keys regularly via `DELETE /auth/keys/:id` + `POST /auth/keys`.
+
+---
+
+## access.yaml (optional, open + key mode)
+
+Drop an `access.yaml` at `$DATA_ROOT/access.yaml` to add a server-level ABAC layer — useful even in key mode for super-admins and group-based defaults.
+
+```yaml
+mode: restricted
+allowed_users:
+  - "*.acme.com"                # email wildcard — anyone @acme.com
+  - "partner@vendor.com"         # exact match
+super_admins:
+  - "ceo@acme.com"               # always allowed on every nest
+groups:
+  engineering:
+    default_permission: write
+    members:
+      - "*.eng.acme.com"
+  viewers:
+    default_permission: read
+    members:
+      - "*.contractor.acme.com"
+```
+
+See `STEWARDSHIP.md` for how super-admins and groups interact with per-nest stewardship.
+
+---
+
+## Reload
+
+Changing env vars requires a restart — the server reads them at boot. `tsx watch` in dev will pick up code changes automatically but not env changes.

package/LICENSE.md

@@ -0,0 +1,142 @@
+# ContextNest Community Edition — Commercial Software License
+
+**Version 1.0 — Effective Date: April 24, 2026**
+
+Copyright © 2026 Promptowl LLC. All rights reserved.
+
+This ContextNest Community Edition Commercial Software License (the **"License"**) is a legal agreement between you (either an individual or a single legal entity, **"You"**) and **Promptowl LLC**, a Georgia limited liability company with its principal place of business at 3060 Mercer University Dr Ste 110, Atlanta, GA 30341, USA (**"Licensor,"** "we," "us," or "our"), governing Your use of the ContextNest Community Edition software, including its command-line interface, server, user interface, source or compiled code, and any related documentation (collectively, the **"Software"**).
+
+**BY INSTALLING, COPYING, EXECUTING, OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THIS LICENSE. IF YOU DO NOT AGREE, DO NOT INSTALL OR USE THE SOFTWARE.**
+
+---
+
+## 1. Software and Service Relationship
+
+The Software is a client that interoperates with the hosted **PromptOwl** platform operated by Licensor (the **"Platform"**). Operation of the Software requires a valid PromptOwl account. Your use of the Platform, and any acceptance of Platform-level terms presented upon login or account creation, is governed separately by:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+(collectively, the **"Platform Terms"**). The Platform Terms are incorporated into this License by reference with respect to any use of the Platform. In the event of a conflict between this License and the Platform Terms regarding the Software itself (as distinct from the Platform), this License controls.
+
+## 2. License Grant
+
+Subject to Your continued compliance with this License and the Platform Terms, Licensor grants You a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to:
+
+**(a)** install and execute the Software on computing devices that You own or control;
+
+**(b)** use the Software solely for Your own internal business purposes or personal non-commercial purposes, in connection with a valid PromptOwl account; and
+
+**(c)** make a reasonable number of copies of the Software solely for backup, archival, or internal deployment purposes, provided that all copyright, trademark, and other proprietary notices are preserved intact.
+
+## 3. Restrictions
+
+You shall not, and shall not permit any third party to:
+
+**(a) Redistribution.** Sell, rent, lease, lend, sublicense, assign, distribute, publish, or otherwise make the Software available to any third party, whether standalone, bundled, or as part of a derivative work.
+
+**(b) Hosting-as-a-Service.** Offer, operate, or make available the Software, or any substantial portion of its functionality, as a hosted, managed, software-as-a-service, or similar service to any third party. Hosting the Software for Your own internal use is permitted; hosting it for use by any person or entity outside Your legal entity is not.
+
+**(c) Competitive Use.** Use the Software, in whole or in part, to develop, train, operate, or support any product or service that competes with ContextNest, PromptOwl, or any Licensor product.
+
+**(d) Reverse Engineering.** Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying ideas, algorithms, file formats, or non-public APIs of the Software, except and only to the extent this restriction is expressly prohibited by applicable law.
+
+**(e) Modification.** Modify, adapt, translate, or create derivative works of the Software, except for configuration files and integration code that You author and that are clearly separable from the Software itself.
+
+**(f) Circumvention.** Circumvent, disable, or interfere with any license, authentication, metering, telemetry, or security mechanism of the Software or the Platform, including but not limited to the PromptOwl login requirement.
+
+**(g) Notice Removal.** Remove, obscure, or alter any copyright, trademark, license, or other proprietary notice contained in or displayed by the Software.
+
+**(h) Trademark Use.** Use the names, logos, or trademarks of Licensor, including "PromptOwl," "ContextNest," or any confusingly similar mark, in any forked, modified, or derivative distribution, or in a manner suggesting endorsement, affiliation, or sponsorship that does not exist.
+
+**(i) Unlawful Use.** Use the Software in violation of any applicable law or regulation, or in any manner that violates the Acceptable Use Policy.
+
+**(j) Regulated Industry Use.** Use the Software in environments subject to HIPAA, FISMA, GLBA, PCI-DSS, or similar industry-specific regulations, unless You have obtained express written authorization from Licensor. The Software is not certified for such environments.
+
+## 4. Ownership and Intellectual Property
+
+The Software is licensed, not sold. Licensor and its licensors retain all right, title, and interest in and to the Software, including all intellectual property rights therein. No rights are granted to You other than those expressly set forth in this License. All rights not expressly granted are reserved by Licensor. "PromptOwl" and "ContextNest" are trademarks of Promptowl LLC.
+
+## 5. Account Requirement and Suspension
+
+The Software's functionality is conditioned on a valid, active PromptOwl account in good standing. Licensor may suspend, terminate, or restrict account access (and, consequently, Software functionality) in accordance with the Platform Terms. Termination or suspension of Your PromptOwl account does not, by itself, waive Licensor's rights under this License.
+
+## 6. Updates
+
+Licensor may, but is not obligated to, provide updates, patches, or new versions of the Software. Any such update is deemed part of the Software and is governed by this License unless accompanied by a separate license.
+
+## 7. Third-Party Components
+
+The Software may include or depend upon open-source or third-party components, each of which is governed by its own license. A listing of such components and their licenses is provided in the Software distribution or in accompanying documentation. Nothing in this License limits Your rights or obligations under those third-party licenses.
+
+## 8. Commercial Licensing for Restricted Uses
+
+If You wish to use the Software in a manner not permitted by Section 3 — including redistribution, hosting-as-a-service, embedding in a commercial product, or use in regulated-industry environments — You must obtain a separate written commercial license from Licensor. Contact: **hoot@promptowl.ai**.
+
+## 9. Term and Termination
+
+**9.1** This License is effective upon Your first installation or use of the Software and continues until terminated.
+
+**9.2** This License terminates automatically and without notice if You breach any term of this License. Licensor may also terminate this License at any time for material breach upon notice.
+
+**9.3** Upon termination, You shall immediately (i) cease all use of the Software, (ii) delete or destroy all copies of the Software in Your possession or control, and (iii) certify such destruction in writing upon Licensor's request.
+
+**9.4** Sections 3, 4, 9.3, 10, 11, 12, 13, and 14 survive termination.
+
+## 10. Disclaimer of Warranties
+
+THE SOFTWARE IS PROVIDED **"AS IS"** AND **"AS AVAILABLE,"** WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, OR UNINTERRUPTED OPERATION. LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, OR BE ERROR-FREE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, IN WHICH CASE THE FOREGOING EXCLUSIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
+
+## 11. AI Output Disclaimer
+
+The Software enables the creation, storage, retrieval, and injection of content into large language models and other AI systems. Licensor makes no representation or warranty regarding the accuracy, legality, completeness, appropriateness, or non-infringement of any output generated by such systems. You are solely responsible for reviewing, validating, and determining the fitness of AI-generated output for Your intended use. You agree not to deploy the Software in high-risk contexts (including medical, legal, financial advisory, safety-critical, or life-critical environments) without appropriate human oversight and independent safeguards.
+
+## 12. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL LICENSOR, ITS AFFILIATES, OR ITS LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+LICENSOR'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US $100.00) OR THE AMOUNT PAID BY YOU TO LICENSOR FOR THE SOFTWARE IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, WHICHEVER IS GREATER.
+
+THE LIMITATIONS IN THIS SECTION APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS OF LIABILITY, IN WHICH CASE THE FOREGOING LIMITATIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
+
+## 13. Indemnification
+
+You agree to indemnify, defend, and hold harmless Licensor, its affiliates, and its officers, directors, employees, and agents from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to (a) Your use of the Software in breach of this License, (b) Your violation of any applicable law or third-party right, or (c) content or data You process through the Software.
+
+## 14. Governing Law and Venue
+
+This License is governed by the laws of the State of Georgia, United States of America, without regard to its conflict-of-laws principles. The exclusive venue for any dispute arising under or related to this License shall be the state or federal courts located in Fulton County, Georgia, and the parties consent to the personal jurisdiction of such courts. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
+
+## 15. Export Compliance
+
+You represent and warrant that (a) You are not located in a country subject to a U.S. Government embargo or designated as a "terrorist supporting" country, and (b) You are not listed on any U.S. Government list of prohibited or restricted parties. You shall comply with all applicable export-control laws and regulations in Your use of the Software.
+
+## 16. Assignment
+
+You may not assign or transfer this License, in whole or in part, without Licensor's prior written consent. Any attempted assignment in violation of this Section is void. Licensor may assign this License freely.
+
+## 17. Severability and Waiver
+
+If any provision of this License is held unenforceable, the remaining provisions shall remain in full force and effect, and the unenforceable provision shall be reformed to the extent necessary to render it enforceable while preserving the parties' intent. No waiver of any term shall be deemed a waiver of any other term or of a subsequent breach.
+
+## 18. Entire Agreement
+
+This License, together with the Platform Terms to the extent applicable to Your use of the Platform, constitutes the entire agreement between You and Licensor regarding the Software and supersedes all prior or contemporaneous understandings, whether written or oral. Any modification must be in writing and signed by an authorized representative of Licensor.
+
+## 19. Contact
+
+**Promptowl LLC**
+3060 Mercer University Dr Ste 110
+Atlanta, GA 30341, USA
+Email: **hoot@promptowl.ai**
+Web: <https://promptowl.ai>
+
+For commercial licensing inquiries (redistribution, hosted-service offerings, OEM, or regulated-industry use), contact **hoot@promptowl.ai** with subject line "ContextNest Commercial License."
+
+---
+
+*"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC. All rights reserved.*

package/README.md

@@ -0,0 +1,105 @@
+# ContextNest Community Edition
+
+**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
+
+> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
+
+---
+
+## What it is
+
+ContextNest Community Edition is a self-hosted server that lets you:
+
+- Store, version, and govern markdown-based context documents ("nests")
+- Apply stewardship workflows — draft, pending review, approved
+- Serve approved context to AI agents via MCP, HTTP, or CLI
+- Sync with the PromptOwl hosted platform for multi-user collaboration
+
+The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
+
+## Quickstart
+
+```bash
+# 1. Get a license key — sign up free at https://app.promptowl.ai
+#    Settings → License Keys → Create a Community Server key
+
+# 2. (Optional) Scaffold a local nest with the open-source CLI
+npx @promptowl/contextnest-cli init
+
+# 3. Run the community server
+PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
+```
+
+The server listens on `http://localhost:3000` by default. Without a valid `PROMPTOWL_KEY` the server still runs but some features are limited. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+## System requirements
+
+- **Node.js** 20.x or later
+- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
+- **OS:** Windows, macOS, or Linux
+- **Disk:** ~200 MB for the server, plus storage for your nests
+
+## What you get
+
+| Feature | Community Edition | Enterprise |
+|---|:---:|:---:|
+| Self-hosted context server | ✅ | ✅ |
+| Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| MCP server for AI agents | ✅ | ✅ |
+| Multi-user governance UI | — | ✅ |
+| SSO / SAML / SCIM | — | ✅ |
+| Audit log streaming | — | ✅ |
+| Policy transforms (redaction, summarization) | — | ✅ |
+| Priority support and SLA | — | ✅ |
+
+For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
+
+## Licensing
+
+ContextNest Community Edition is **commercial software**. It is **not open source**.
+
+**You may:**
+- Install and run the Software on devices You own or control
+- Use the Software for internal business purposes, tied to a valid PromptOwl account
+- Make backup and archival copies
+
+**You may not:**
+- Redistribute, resell, rent, lease, or sublicense the Software
+- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
+- Reverse engineer, decompile, or create derivative works
+- Use the Software to build a competing product or service
+- Remove copyright, trademark, or license notices
+
+Full license text: [LICENSE.md](./LICENSE.md)
+
+**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
+
+## Platform terms
+
+Because the Software requires a PromptOwl account, the following terms also apply to Your use:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+## Support
+
+- **Documentation:** <https://promptowl.ai/contextnest/>
+- **Product questions:** <https://promptowl.ai/contact-us/>
+- **Support & bugs:** `hoot@promptowl.ai`
+- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
+
+## AI output disclaimer
+
+The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
+
+---
+
+**Copyright © 2026 Promptowl LLC.** All rights reserved.
+"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
+
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/chunk-7K2LLJXK.js

@@ -0,0 +1,58 @@
+// src/auth/keys.ts
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
+import bcrypt from "bcryptjs";
+var KEY_PREFIX = "cnst_";
+var BCRYPT_ROUNDS = 12;
+function generateApiKey() {
+  return KEY_PREFIX + randomBytes(32).toString("hex");
+}
+function hashApiKey(key) {
+  return createHash("sha256").update(key).digest("hex");
+}
+function getKeyPrefix(key) {
+  return key.slice(0, 12) + "...";
+}
+function parseBearerToken(header) {
+  if (!header) return null;
+  const BEARER = "Bearer ";
+  if (!header.startsWith(BEARER)) return null;
+  const token = header.slice(BEARER.length);
+  if (!token.startsWith(KEY_PREFIX)) return null;
+  if (token.length < KEY_PREFIX.length + 32) return null;
+  return token;
+}
+async function hashPassword(password) {
+  return bcrypt.hash(password, BCRYPT_ROUNDS);
+}
+async function verifyPassword(password, stored) {
+  if (isBcrypt(stored)) {
+    return { ok: await bcrypt.compare(password, stored), needsRehash: false };
+  }
+  const [salt, hash] = stored.split(":");
+  if (!salt || !hash) return { ok: false, needsRehash: false };
+  const attempt = createHash("sha256").update(salt + password).digest("hex");
+  return {
+    ok: timingSafeEqualHex(hash, attempt),
+    needsRehash: true
+  };
+}
+function isBcrypt(stored) {
+  return stored.startsWith("$2a$") || stored.startsWith("$2b$") || stored.startsWith("$2y$");
+}
+function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+
+export {
+  generateApiKey,
+  hashApiKey,
+  getKeyPrefix,
+  parseBearerToken,
+  hashPassword,
+  verifyPassword
+};

package/dist/chunk-DJFEV4ET.js

@@ -0,0 +1,199 @@
+import {
+  canUserApprove,
+  resolveStewardsForNode
+} from "./chunk-Q2DCOS7V.js";
+import {
+  getDb
+} from "./chunk-USIDOGVJ.js";
+
+// src/governance/review-service.ts
+import { v4 as uuid } from "uuid";
+function submitForReview(params) {
+  const db = getDb();
+  const existing = db.prepare(
+    "SELECT id FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending'"
+  ).get(params.nestId, params.nodeId);
+  if (existing) {
+    throw new Error("A review is already pending for this node");
+  }
+  const id = uuid();
+  db.prepare(
+    `INSERT INTO review_requests
+     (id, nest_id, node_id, version, requested_by, request_note, priority)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    params.nestId,
+    params.nodeId,
+    params.version,
+    params.requestedBy,
+    params.note || null,
+    params.priority || "normal"
+  );
+  db.prepare(
+    "UPDATE node_versions SET status = 'pending_review' WHERE nest_id = ? AND node_id = ? AND version = ?"
+  ).run(params.nestId, params.nodeId, params.version);
+  return getReviewRequest(id);
+}
+function approve(params) {
+  const db = getDb();
+  const pending = db.prepare(
+    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
+  ).get(params.nestId, params.nodeId);
+  if (!pending) {
+    throw new Error("No pending review for this node");
+  }
+  if (!params.override) {
+    const check = canUserApprove(
+      params.nestId,
+      params.nodeId,
+      params.approvedBy
+    );
+    if (!check.allowed) {
+      throw new Error(check.reason);
+    }
+  }
+  db.prepare(
+    `UPDATE review_requests
+     SET status = 'approved', resolved_by = ?, resolved_at = datetime('now'),
+         resolution_note = ?, is_override = ?
+     WHERE id = ?`
+  ).run(
+    params.approvedBy,
+    params.note || null,
+    params.override ? 1 : 0,
+    pending.id
+  );
+  db.prepare(
+    "UPDATE node_versions SET status = 'approved' WHERE nest_id = ? AND node_id = ? AND version = ?"
+  ).run(params.nestId, params.nodeId, params.version);
+  db.prepare(
+    `INSERT OR REPLACE INTO approved_versions (nest_id, node_id, approved_version, approved_by)
+     VALUES (?, ?, ?, ?)`
+  ).run(params.nestId, params.nodeId, params.version, params.approvedBy);
+  return getReviewRequest(pending.id);
+}
+function reject(params) {
+  const db = getDb();
+  const pending = db.prepare(
+    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
+  ).get(params.nestId, params.nodeId);
+  if (!pending) {
+    throw new Error("No pending review for this node");
+  }
+  const check = canUserApprove(
+    params.nestId,
+    params.nodeId,
+    params.rejectedBy
+  );
+  if (!check.allowed) {
+    throw new Error(check.reason);
+  }
+  db.prepare(
+    `UPDATE review_requests
+     SET status = 'rejected', resolved_by = ?, resolved_at = datetime('now'), resolution_note = ?
+     WHERE id = ?`
+  ).run(params.rejectedBy, params.note, pending.id);
+  db.prepare(
+    "UPDATE node_versions SET status = 'rejected' WHERE nest_id = ? AND node_id = ? AND version = ?"
+  ).run(params.nestId, params.nodeId, params.version);
+  return getReviewRequest(pending.id);
+}
+function cancelReview(params) {
+  const db = getDb();
+  const pending = db.prepare(
+    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
+  ).get(params.nestId, params.nodeId);
+  if (!pending) return null;
+  db.prepare(
+    `UPDATE review_requests
+     SET status = 'cancelled', resolved_by = ?, resolved_at = datetime('now')
+     WHERE id = ?`
+  ).run(params.cancelledBy, pending.id);
+  db.prepare(
+    "UPDATE node_versions SET status = 'draft' WHERE nest_id = ? AND node_id = ? AND version = ?"
+  ).run(params.nestId, params.nodeId, pending.version);
+  return getReviewRequest(pending.id);
+}
+function getReviewQueue(params) {
+  const db = getDb();
+  let whereClauses = [];
+  const args = [];
+  if (params.nestId) {
+    whereClauses.push("nest_id = ?");
+    args.push(params.nestId);
+  }
+  if (params.status) {
+    const statuses = Array.isArray(params.status) ? params.status : [params.status];
+    whereClauses.push(
+      `status IN (${statuses.map(() => "?").join(",")})`
+    );
+    args.push(...statuses);
+  }
+  const where = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
+  const total = db.prepare(`SELECT COUNT(*) as c FROM review_requests ${where}`).get(...args).c;
+  const limit = params.limit || 50;
+  const offset = params.offset || 0;
+  const rows = db.prepare(
+    `SELECT * FROM review_requests ${where}
+       ORDER BY
+         CASE priority WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 WHEN 'normal' THEN 2 ELSE 3 END,
+         requested_at DESC
+       LIMIT ? OFFSET ?`
+  ).all(...args, limit, offset);
+  let requests = rows.map(rowToReviewRequest);
+  if (params.stewardEmail) {
+    requests = requests.filter((r) => {
+      const stewards = resolveStewardsForNode(r.nestId, r.nodeId);
+      return stewards.some(
+        (s) => s.steward.userEmail === params.stewardEmail
+      );
+    });
+  }
+  return { requests, total };
+}
+function getReviewHistory(nestId, nodeId) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? ORDER BY requested_at DESC"
+  ).all(nestId, nodeId);
+  return rows.map(rowToReviewRequest);
+}
+function getPendingReview(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
+  ).get(nestId, nodeId);
+  return row ? rowToReviewRequest(row) : null;
+}
+function getReviewRequest(id) {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM review_requests WHERE id = ?").get(id);
+  return row ? rowToReviewRequest(row) : null;
+}
+function rowToReviewRequest(row) {
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    version: row.version,
+    requestedBy: row.requested_by,
+    requestedAt: row.requested_at,
+    requestNote: row.request_note || void 0,
+    status: row.status,
+    resolvedBy: row.resolved_by || void 0,
+    resolvedAt: row.resolved_at || void 0,
+    resolutionNote: row.resolution_note || void 0,
+    priority: row.priority
+  };
+}
+
+export {
+  submitForReview,
+  approve,
+  reject,
+  cancelReview,
+  getReviewQueue,
+  getReviewHistory,
+  getPendingReview
+};