@promptowl/contextnest-community 0.1.0-alpha.1

package/dist/index.js

@@ -0,0 +1,2867 @@
+#!/usr/bin/env node
+import {
+  generateApiKey,
+  getKeyPrefix,
+  hashApiKey,
+  hashPassword,
+  parseBearerToken,
+  verifyPassword
+} from "./chunk-7K2LLJXK.js";
+import {
+  checkConflict,
+  createVersion,
+  getApprovedVersion,
+  getCurrentVersion,
+  getVersions,
+  setApprovedVersion
+} from "./chunk-P6NG56CO.js";
+import {
+  approve,
+  cancelReview,
+  getReviewHistory,
+  getReviewQueue,
+  reject,
+  submitForReview
+} from "./chunk-DJFEV4ET.js";
+import {
+  assignSteward,
+  canUserAccess,
+  canUserApprove,
+  canUserEdit,
+  createStewardRecord,
+  getStewardsForNest,
+  isSuperAdmin,
+  listStewards,
+  loadAccessConfig,
+  removeSteward,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  syncFromConfig
+} from "./chunk-Q2DCOS7V.js";
+import {
+  config,
+  getDb
+} from "./chunk-USIDOGVJ.js";
+
+// src/index.ts
+import { serve } from "@hono/node-server";
+
+// src/app.ts
+import { Hono as Hono8 } from "hono";
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+import { logger } from "hono/logger";
+import { cors } from "hono/cors";
+
+// src/auth/routes.ts
+import { Hono } from "hono";
+import { v4 as uuid } from "uuid";
+
+// src/auth/middleware.ts
+import { createMiddleware } from "hono/factory";
+var authMiddleware = createMiddleware(async (c, next) => {
+  const key = parseBearerToken(c.req.header("Authorization"));
+  if (!key) {
+    return c.json({ error: "Missing or invalid API key" }, 401);
+  }
+  const keyHash = hashApiKey(key);
+  const db = getDb();
+  const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
+  if (!record) {
+    return c.json({ error: "Invalid API key" }, 401);
+  }
+  db.prepare(
+    "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
+  ).run(keyHash);
+  c.set("userId", record.user_id);
+  c.set("nestScope", record.nest_id);
+  await next();
+});
+
+// src/shared/errors.ts
+var AppError = class extends Error {
+  constructor(statusCode, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "AppError";
+  }
+};
+var NotFoundError = class extends AppError {
+  constructor(message = "Not found") {
+    super(404, message);
+    this.name = "NotFoundError";
+  }
+};
+var ValidationError = class extends AppError {
+  constructor(message) {
+    super(400, message);
+    this.name = "ValidationError";
+  }
+};
+
+// src/telemetry/tracker.ts
+function trackEvent(event, data) {
+  if (!config.TELEMETRY_ENABLED) return;
+  try {
+    const db = getDb();
+    db.prepare(
+      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)"
+    ).run(event, data ? JSON.stringify(data) : null);
+  } catch {
+  }
+}
+async function flushTelemetry() {
+  if (!config.TELEMETRY_ENABLED || !config.PROMPTOWL_KEY) return;
+  const db = getDb();
+  const userCount = db.prepare("SELECT COUNT(*) as c FROM users").get()?.c || 0;
+  const nestCount = db.prepare("SELECT COUNT(*) as c FROM nests").get()?.c || 0;
+  const events = db.prepare(
+    "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
+  ).all();
+  if (events.length === 0 && userCount === 0) return;
+  const payload = {
+    server_key: config.PROMPTOWL_KEY,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    stats: { users: userCount, nests: nestCount },
+    events: events.map((e) => ({
+      event: e.event,
+      data: e.data_json ? JSON.parse(e.data_json) : null,
+      at: e.created_at
+    }))
+  };
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (res.ok && events.length > 0) {
+      const ids = events.map((e) => e.id);
+      db.prepare(
+        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
+      ).run(...ids);
+    }
+  } catch {
+  }
+}
+var telemetryTimer = null;
+function startTelemetryLoop() {
+  if (!config.TELEMETRY_ENABLED) return;
+  setTimeout(() => flushTelemetry(), 3e4);
+  telemetryTimer = setInterval(
+    () => flushTelemetry(),
+    config.TELEMETRY_INTERVAL_MS
+  );
+}
+
+// src/shared/rate-limit.ts
+var buckets = /* @__PURE__ */ new Map();
+function tryConsume(key, cfg) {
+  const now = Date.now();
+  const cutoff = now - cfg.windowMs;
+  let bucket = buckets.get(key);
+  if (!bucket) {
+    bucket = { hits: [] };
+    buckets.set(key, bucket);
+  }
+  while (bucket.hits.length && bucket.hits[0] < cutoff) {
+    bucket.hits.shift();
+  }
+  if (bucket.hits.length >= cfg.max) {
+    return false;
+  }
+  bucket.hits.push(now);
+  return true;
+}
+
+// src/auth/routes.ts
+var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
+var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
+var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+function clientIp(c) {
+  const xff = c.req.header("x-forwarded-for");
+  if (xff) return xff.split(",")[0].trim();
+  const realIp = c.req.header("x-real-ip");
+  if (realIp) return realIp.trim();
+  return "unknown";
+}
+var authRoutes = new Hono();
+authRoutes.post("/register", async (c) => {
+  const body = await c.req.json();
+  if (!body.email || !body.password) {
+    throw new ValidationError("email and password are required");
+  }
+  const ip = clientIp(c);
+  if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
+    return c.json({ error: "Too many registration attempts, try again later" }, 429);
+  }
+  const db = getDb();
+  const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
+  if (existing) {
+    throw new ValidationError("Email already registered");
+  }
+  const userId = uuid();
+  const passwordHash = await hashPassword(body.password);
+  db.prepare(
+    "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+  ).run(userId, body.email, body.name || null, passwordHash);
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  db.prepare(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+  ).run(keyId, userId, hashApiKey(apiKey), getKeyPrefix(apiKey), "default");
+  trackEvent("user.register", { userId, email: body.email });
+  return c.json(
+    {
+      user: { id: userId, email: body.email, name: body.name || null },
+      api_key: apiKey
+    },
+    201
+  );
+});
+authRoutes.post("/login", async (c) => {
+  const body = await c.req.json();
+  if (!body.email || !body.password) {
+    throw new ValidationError("email and password are required");
+  }
+  const ip = clientIp(c);
+  const emailLower = body.email.toLowerCase();
+  if (!tryConsume(`login:ip:${ip}`, LOGIN_LIMIT) || !tryConsume(`login:email:${emailLower}`, LOGIN_LIMIT)) {
+    return c.json({ error: "Too many login attempts, try again later" }, 429);
+  }
+  const db = getDb();
+  const user = db.prepare(
+    "SELECT id, email, name, password_hash FROM users WHERE email = ?"
+  ).get(body.email);
+  const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
+  if (!user || !check.ok) {
+    return c.json({ error: "Invalid credentials" }, 401);
+  }
+  if (check.needsRehash) {
+    try {
+      const newHash = await hashPassword(body.password);
+      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+        newHash,
+        user.id
+      );
+    } catch {
+    }
+  }
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  db.prepare(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+  ).run(
+    keyId,
+    user.id,
+    hashApiKey(apiKey),
+    getKeyPrefix(apiKey),
+    body.label || "login"
+  );
+  trackEvent("user.login", { userId: user.id });
+  return c.json({ api_key: apiKey });
+});
+authRoutes.post("/keys", authMiddleware, async (c) => {
+  const body = await c.req.json();
+  const db = getDb();
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  db.prepare(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
+  ).run(
+    keyId,
+    c.get("userId"),
+    hashApiKey(apiKey),
+    getKeyPrefix(apiKey),
+    body.nest_id || null,
+    body.label || null
+  );
+  return c.json(
+    { api_key: apiKey, key_prefix: getKeyPrefix(apiKey) },
+    201
+  );
+});
+authRoutes.get("/keys", authMiddleware, async (c) => {
+  const db = getDb();
+  const keys = db.prepare(
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?"
+  ).all(c.get("userId"));
+  return c.json({ keys });
+});
+authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
+  const db = getDb();
+  const result = db.prepare("DELETE FROM api_keys WHERE id = ? AND user_id = ?").run(c.req.param("keyId"), c.get("userId"));
+  if (result.changes === 0) {
+    return c.json({ error: "Key not found" }, 404);
+  }
+  return c.json({ deleted: true });
+});
+authRoutes.post("/device", async (c) => {
+  if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
+    return c.json({ error: "Too many device auth attempts, try again later" }, 429);
+  }
+  const body = await c.req.json();
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  const res = await fetch(`${promptowlUrl}/api/auth/device`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      deviceName: body.deviceName || "ContextNest Community",
+      deviceType: body.deviceType || "webapp"
+    })
+  });
+  const data = await res.json();
+  if (!res.ok) return c.json(data, res.status);
+  if (data.verificationUrl && !data.verificationUrl.startsWith("http")) {
+    data.verificationUrl = `${promptowlUrl}${data.verificationUrl}`;
+  }
+  return c.json(data);
+});
+authRoutes.get("/device/poll", async (c) => {
+  const code = c.req.query("code");
+  const clientSecret = c.req.query("client_secret");
+  if (!code || !clientSecret) {
+    return c.json({ error: "code and client_secret are required" }, 400);
+  }
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  const res = await fetch(
+    `${promptowlUrl}/api/auth/device/poll?code=${encodeURIComponent(code)}&client_secret=${encodeURIComponent(clientSecret)}`
+  );
+  const data = await res.json();
+  return c.json(data, res.status);
+});
+authRoutes.post("/promptowl", async (c) => {
+  if (!tryConsume(`promptowl:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
+    return c.json({ error: "Too many exchange attempts, try again later" }, 429);
+  }
+  const body = await c.req.json();
+  if (!body.token) {
+    throw new ValidationError("token is required");
+  }
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  const meRes = await fetch(`${promptowlUrl}/api/user/me`, {
+    headers: { Authorization: `Bearer ${body.token}` }
+  });
+  if (!meRes.ok) {
+    return c.json({ error: "Invalid or expired PromptOwl token" }, 401);
+  }
+  const meData = await meRes.json();
+  const me = meData.user || meData;
+  if (!me.email) {
+    return c.json(
+      { error: "Could not retrieve user email from PromptOwl" },
+      401
+    );
+  }
+  const db = getDb();
+  let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
+  if (!user) {
+    const userId = uuid();
+    const placeholderHash = await hashPassword(uuid());
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, me.email, me.name || null, placeholderHash);
+    user = { id: userId, email: me.email, name: me.name || null };
+    trackEvent("user.register", {
+      userId,
+      email: me.email,
+      method: "promptowl"
+    });
+  } else {
+    trackEvent("user.login", { userId: user.id, method: "promptowl" });
+  }
+  let isAdmin = false;
+  const claim = db.transaction((userId) => {
+    const result = db.prepare(
+      `UPDATE users SET is_admin = 1
+         WHERE id = ?
+           AND NOT EXISTS (SELECT 1 FROM users WHERE is_admin = 1)`
+    ).run(userId);
+    return result.changes > 0;
+  });
+  if (claim(user.id)) {
+    isAdmin = true;
+    trackEvent("admin.claim", { userId: user.id, email: user.email });
+  } else {
+    const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(user.id);
+    isAdmin = !!userRow?.is_admin;
+  }
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  db.prepare(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+  ).run(
+    keyId,
+    user.id,
+    hashApiKey(apiKey),
+    getKeyPrefix(apiKey),
+    "promptowl"
+  );
+  return c.json({
+    api_key: apiKey,
+    user: {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      is_admin: isAdmin
+    }
+  });
+});
+authRoutes.get("/admin-status", async (c) => {
+  const db = getDb();
+  const admin = db.prepare("SELECT email, name FROM users WHERE is_admin = 1 LIMIT 1").get();
+  const callerKey = parseBearerToken(c.req.header("Authorization"));
+  let me = null;
+  if (callerKey) {
+    const keyHash = hashApiKey(callerKey);
+    const row = db.prepare(
+      `SELECT u.email, u.is_admin FROM api_keys k
+         JOIN users u ON u.id = k.user_id
+         WHERE k.key_hash = ?`
+    ).get(keyHash);
+    if (row) {
+      me = { email: row.email, is_admin: !!row.is_admin };
+    }
+  }
+  return c.json({
+    claimed: !!admin,
+    admin: admin ? { email: admin.email, name: admin.name } : null,
+    me
+  });
+});
+authRoutes.post("/invite", async (c) => {
+  const body = await c.req.json();
+  if (!body.email) throw new ValidationError("email is required");
+  const inviteKey = parseBearerToken(c.req.header("Authorization"));
+  if (!inviteKey) {
+    return c.json({ error: "Admin authentication required" }, 401);
+  }
+  const db = getDb();
+  const keyHash = hashApiKey(inviteKey);
+  const caller = db.prepare(
+    `SELECT u.id, u.is_admin FROM api_keys k
+       JOIN users u ON u.id = k.user_id
+       WHERE k.key_hash = ?`
+  ).get(keyHash);
+  if (!caller || !caller.is_admin) {
+    return c.json({ error: "Admin only" }, 403);
+  }
+  let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
+  if (!user) {
+    const userId = uuid();
+    const placeholderHash = await hashPassword(uuid());
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, body.email, null, placeholderHash);
+    user = { id: userId, email: body.email };
+  }
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  db.prepare(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+  ).run(keyId, user.id, hashApiKey(apiKey), getKeyPrefix(apiKey), body.label || "teammate");
+  trackEvent("admin.invite", { adminId: caller.id, email: body.email });
+  return c.json(
+    {
+      api_key: apiKey,
+      user: { id: user.id, email: user.email },
+      message: "Copy this key and share it securely \u2014 it won't be shown again."
+    },
+    201
+  );
+});
+authRoutes.get("/teammates", async (c) => {
+  const teammatesKey = parseBearerToken(c.req.header("Authorization"));
+  if (!teammatesKey) {
+    return c.json({ error: "Admin authentication required" }, 401);
+  }
+  const db = getDb();
+  const keyHash = hashApiKey(teammatesKey);
+  const caller = db.prepare(
+    `SELECT u.is_admin FROM api_keys k
+       JOIN users u ON u.id = k.user_id
+       WHERE k.key_hash = ?`
+  ).get(keyHash);
+  if (!caller || !caller.is_admin) {
+    return c.json({ error: "Admin only" }, 403);
+  }
+  const teammates = db.prepare(
+    `SELECT u.id, u.email, u.name, u.is_admin,
+         (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
+         (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
+       FROM users u
+       WHERE u.id != '00000000-0000-0000-0000-000000000000'
+       ORDER BY u.is_admin DESC, u.created_at DESC`
+  ).all();
+  const pendingStewards = db.prepare(
+    `SELECT DISTINCT s.user_email AS email
+         FROM stewards s
+        WHERE s.is_active = 1
+          AND NOT EXISTS (
+            SELECT 1 FROM users u
+              JOIN api_keys k ON k.user_id = u.id
+             WHERE lower(u.email) = lower(s.user_email)
+          )
+        ORDER BY s.user_email`
+  ).all();
+  return c.json({
+    teammates: teammates.map((t) => ({
+      ...t,
+      is_admin: !!t.is_admin
+    })),
+    pending_stewards: pendingStewards.map((p) => p.email)
+  });
+});
+
+// src/nests/routes.ts
+import { Hono as Hono2 } from "hono";
+
+// src/shared/access.ts
+var PERMISSION_LEVELS = {
+  none: 0,
+  read: 1,
+  write: 2,
+  admin: 3,
+  owner: 4
+};
+function resolveNestPermission(nestId, userId) {
+  const db = getDb();
+  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
+  if (!nest) return "none";
+  if (nest.user_id === userId) return "owner";
+  const directGrant = db.prepare(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+  ).get(nestId, userId);
+  if (directGrant) return directGrant.permission;
+  if (nest.visibility === "public") return "read";
+  return "none";
+}
+function permissionLevel(p) {
+  return PERMISSION_LEVELS[p] ?? 0;
+}
+
+// src/nests/service.ts
+import { join } from "path";
+import { rmSync, mkdirSync } from "fs";
+import { v4 as uuid2 } from "uuid";
+import { NestStorage } from "@promptowl/contextnest-engine";
+function nestPath(nestId) {
+  return join(config.DATA_ROOT, "nests", nestId);
+}
+function toSlug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function isStewardshipEnabled(nestId) {
+  const db = getDb();
+  const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
+  return !!row?.stewardship_enabled;
+}
+function setStewardshipEnabled(nestId, enabled) {
+  const db = getDb();
+  db.prepare("UPDATE nests SET stewardship_enabled = ? WHERE id = ?").run(
+    enabled ? 1 : 0,
+    nestId
+  );
+}
+async function createNest(userId, name, description) {
+  const id = uuid2();
+  const slug = toSlug(name);
+  const db = getDb();
+  db.prepare(
+    "INSERT INTO nests (id, user_id, name, slug, description) VALUES (?, ?, ?, ?, ?)"
+  ).run(id, userId, name, slug, description || null);
+  const path = nestPath(id);
+  mkdirSync(path, { recursive: true });
+  const storage = new NestStorage(path);
+  await storage.init(name);
+  trackEvent("nest.create", { nestId: id, userId });
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+}
+var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
+function listNests(userId) {
+  const db = getDb();
+  if (userId === ANON_USER_ID) {
+    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
+  }
+  return db.prepare(
+    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
+  ).all(userId, ANON_USER_ID);
+}
+function listSharedNests(userId) {
+  const db = getDb();
+  return db.prepare(
+    `SELECT DISTINCT n.* FROM nests n
+       JOIN nest_collaborators nc ON nc.nest_id = n.id
+       WHERE n.user_id != ? AND nc.user_id = ?
+       ORDER BY n.created_at DESC`
+  ).all(userId, userId);
+}
+function getNest(nestId) {
+  const db = getDb();
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId) || null;
+}
+async function deleteNest(nestId) {
+  const db = getDb();
+  db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(nestId);
+  db.prepare("DELETE FROM nests WHERE id = ?").run(nestId);
+  const path = nestPath(nestId);
+  try {
+    rmSync(path, { recursive: true, force: true });
+  } catch {
+  }
+  trackEvent("nest.delete", { nestId });
+}
+
+// src/nests/routes.ts
+var ANON_USER_ID2 = "00000000-0000-0000-0000-000000000000";
+function effectivePermission(nestId, userId) {
+  if (config.AUTH_MODE === "open") {
+    const db = getDb();
+    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+    if (nest && nest.user_id === ANON_USER_ID2) return "owner";
+  }
+  return resolveNestPermission(nestId, userId);
+}
+var nestRoutes = new Hono2();
+nestRoutes.get("/", async (c) => {
+  const userId = c.get("userId");
+  const owned = listNests(userId);
+  const shared = listSharedNests(userId);
+  return c.json({ nests: [...owned, ...shared] });
+});
+nestRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.name) {
+    throw new ValidationError("name is required");
+  }
+  const nest = await createNest(c.get("userId"), body.name, body.description);
+  return c.json({ nest }, 201);
+});
+nestRoutes.get("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const permission = effectivePermission(nestId, c.get("userId"));
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  const nest = getNest(nestId);
+  return c.json({ nest, permission });
+});
+nestRoutes.delete("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const permission = effectivePermission(nestId, c.get("userId"));
+  if (permission !== "owner") {
+    throw new NotFoundError("Nest not found");
+  }
+  await deleteNest(nestId);
+  return c.json({ deleted: true });
+});
+nestRoutes.get("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const permission = effectivePermission(nestId, c.get("userId"));
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  return c.json({
+    stewardship_enabled: isStewardshipEnabled(nestId)
+  });
+});
+nestRoutes.patch("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const db = getDb();
+  const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(userId);
+  const isServerAdmin = !!userRow?.is_admin;
+  const permission = effectivePermission(nestId, userId);
+  if (!isServerAdmin && permission !== "owner") {
+    return c.json({ error: "Admin only" }, 403);
+  }
+  const body = await c.req.json();
+  if (typeof body.stewardship_enabled === "boolean") {
+    setStewardshipEnabled(nestId, body.stewardship_enabled);
+  }
+  return c.json({
+    stewardship_enabled: isStewardshipEnabled(nestId)
+  });
+});
+
+// src/nests/sharing-routes.ts
+import { Hono as Hono3 } from "hono";
+import { v4 as uuid3 } from "uuid";
+var sharingRoutes = new Hono3();
+sharingRoutes.get("/collaborators", async (c) => {
+  const db = getDb();
+  const collabs = db.prepare(
+    `SELECT nc.*, u.email FROM nest_collaborators nc
+       LEFT JOIN users u ON nc.user_id = u.id
+       WHERE nc.nest_id = ?
+       ORDER BY nc.granted_at`
+  ).all(c.req.param("nestId"));
+  return c.json({ collaborators: collabs });
+});
+sharingRoutes.post("/collaborators", async (c) => {
+  const body = await c.req.json();
+  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
+    throw new ValidationError("permission must be read, write, or admin");
+  }
+  const db = getDb();
+  let userId = body.user_id;
+  if (!userId && body.email) {
+    let user = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
+    if (!user) {
+      const { hashPassword: hashPassword2 } = await import("./keys-YV33AJK3.js");
+      userId = uuid3();
+      db.prepare(
+        "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+      ).run(userId, body.email, null, await hashPassword2(uuid3()));
+    } else {
+      userId = user.id;
+    }
+  }
+  if (!userId) {
+    throw new ValidationError("user_id or email is required");
+  }
+  const collabId = uuid3();
+  db.prepare(
+    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
+  ).run(
+    collabId,
+    c.req.param("nestId"),
+    userId,
+    body.permission,
+    c.get("userId")
+  );
+  const collab = db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+  return c.json({ collaborator: collab }, 201);
+});
+sharingRoutes.patch("/collaborators/:collabId", async (c) => {
+  const body = await c.req.json();
+  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
+    throw new ValidationError("permission must be read, write, or admin");
+  }
+  const db = getDb();
+  db.prepare("UPDATE nest_collaborators SET permission = ? WHERE id = ?").run(
+    body.permission,
+    c.req.param("collabId")
+  );
+  return c.json({ updated: true });
+});
+sharingRoutes.delete("/collaborators/:collabId", async (c) => {
+  const db = getDb();
+  db.prepare("DELETE FROM nest_collaborators WHERE id = ?").run(
+    c.req.param("collabId")
+  );
+  return c.json({ removed: true });
+});
+sharingRoutes.patch("/visibility", async (c) => {
+  const body = await c.req.json();
+  if (!body.visibility || !["private", "public"].includes(body.visibility)) {
+    throw new ValidationError("visibility must be private or public");
+  }
+  const db = getDb();
+  db.prepare("UPDATE nests SET visibility = ? WHERE id = ?").run(
+    body.visibility,
+    c.req.param("nestId")
+  );
+  return c.json({ visibility: body.visibility });
+});
+
+// src/nodes/routes.ts
+import { Hono as Hono4 } from "hono";
+import { serializeDocument } from "@promptowl/contextnest-engine";
+
+// src/nodes/engine.ts
+import { join as join2 } from "path";
+import { NestStorage as NestStorage2, GraphQueryEngine } from "@promptowl/contextnest-engine";
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath2 = join2(config.DATA_ROOT, "nests", nestId);
+      const storage = new NestStorage2(nestPath2);
+      const query = new GraphQueryEngine(storage);
+      engine = { storage, query };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+
+// src/governance/tag-index-service.ts
+function normalizeTag(raw) {
+  return raw.trim().replace(/^#+/, "").toLowerCase();
+}
+function syncNodeTags(nestId, nodeId, tags) {
+  const db = getDb();
+  const normalized = Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
+    )
+  );
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    const insert = db.prepare(
+      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+    );
+    for (const tag of normalized) {
+      insert.run(nestId, nodeId, tag);
+    }
+  })();
+}
+function removeNodeFromTagIndex(nestId, nodeId) {
+  const db = getDb();
+  db.prepare(
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+  ).run(nestId, nodeId);
+}
+
+// src/governance/access-guard.ts
+function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
+  const db = getDb();
+  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return row?.email || "admin@localhost";
+}
+function canReadNode(nestId, nodeId, userEmail) {
+  if (!isStewardshipEnabled(nestId)) return true;
+  return canUserAccess(nestId, nodeId, userEmail).allowed;
+}
+function filterAccessible(nestId, userEmail, nodes) {
+  if (!isStewardshipEnabled(nestId)) return nodes;
+  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+}
+
+// src/nodes/routes.ts
+var nodeRoutes = new Hono4();
+function toNodeResponse(node) {
+  return {
+    id: node.id,
+    title: node.frontmatter.title,
+    type: node.frontmatter.type || "document",
+    tags: node.frontmatter.tags || [],
+    status: node.frontmatter.status || "draft",
+    version: node.frontmatter.version || 1,
+    author: node.frontmatter.author,
+    description: node.frontmatter.description,
+    created_at: node.frontmatter.created_at,
+    updated_at: node.frontmatter.updated_at,
+    content: node.body
+  };
+}
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const { storage } = engineCache.get(nestId);
+  const documents = await storage.discoverDocuments();
+  const userEmail = resolveCallerEmail(c.get("userId"));
+  const accessible = filterAccessible(nestId, userEmail, documents);
+  return c.json({
+    count: accessible.length,
+    nodes: accessible.map(toNodeResponse)
+  });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage } = engineCache.get(nestId);
+  const slug = body.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const id = `nodes/${slug}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const tags = body.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
+  const hasStewards = isStewardshipEnabled(nestId);
+  const initialStatus = hasStewards ? "draft" : "approved";
+  const node = {
+    id,
+    filePath: "",
+    frontmatter: {
+      title: body.title,
+      type: body.type || "document",
+      tags,
+      status: body.status || initialStatus,
+      version: 1,
+      created_at: now,
+      updated_at: now,
+      metadata: {
+        owners: ["*"],
+        scope: body.scope || "team"
+      }
+    },
+    body: body.content,
+    rawContent: ""
+  };
+  const serialized = serializeDocument(node);
+  await storage.writeDocument(id, serialized);
+  syncNodeTags(nestId, id, tags);
+  const authorEmail = getUserEmail(c);
+  createVersion({
+    nestId,
+    nodeId: id,
+    version: 1,
+    content: body.content,
+    author: authorEmail,
+    status: initialStatus,
+    tags
+  });
+  if (initialStatus === "approved") {
+    setApprovedVersion(nestId, id, 1, authorEmail);
+  }
+  trackEvent("node.create", { nestId, nodeId: id });
+  const resolved = resolveStewardsForNode(nestId, id);
+  return c.json({
+    node: toNodeResponse(node),
+    stewards: resolved.length > 0 ? resolved.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      source: r.source
+    })) : void 0
+  }, 201);
+});
+nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-NC67XBYO.js");
+  const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
+    nestId,
+    nodeId
+  );
+  return c.json({
+    nodeId,
+    stewards: stewards.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      scope: r.steward.scope,
+      source: r.source,
+      priority: r.priority,
+      canApprove: r.steward.canApprove
+    })),
+    fallbackToOwner,
+    ownerEmail
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-Z6FYJRAG.js");
+  const allVersions = getVersions2(nestId, nodeId);
+  const approved = getApprovedVersion2(nestId, nodeId);
+  return c.json({
+    versions: allVersions,
+    approvedVersion: approved,
+    currentVersion: allVersions[0]?.version || 0
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-5CLVZKAR.js");
+  const history = getReviewHistory2(nestId, nodeId);
+  return c.json({ reviews: history });
+});
+nodeRoutes.get("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage } = engineCache.get(nestId);
+  const userEmail = resolveCallerEmail(c.get("userId"));
+  if (!canReadNode(nestId, nodeId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  try {
+    const node = await storage.readDocument(nodeId);
+    return c.json({ node: toNodeResponse(node) });
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+});
+nodeRoutes.patch("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage } = engineCache.get(nestId);
+  const body = await c.req.json();
+  const baseVersionHeader = c.req.header("X-Base-Version");
+  if (baseVersionHeader) {
+    const baseVersion = parseInt(baseVersionHeader, 10);
+    const conflict = checkConflict(nestId, nodeId, baseVersion);
+    if (conflict.conflict) {
+      return c.json(
+        {
+          error: "Version conflict",
+          your_version: baseVersion,
+          current_version: conflict.currentVersion,
+          updated_by: conflict.updatedBy,
+          updated_at: conflict.updatedAt,
+          rejected_content: body.content || body.append || null
+        },
+        409
+      );
+    }
+  }
+  let node;
+  try {
+    node = await storage.readDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  if (body.content !== void 0) {
+    node = { ...node, body: body.content };
+  }
+  if (body.append) {
+    node = { ...node, body: (node.body || "") + "\n\n" + body.append };
+  }
+  if (body.tags) {
+    const newTags = body.tags.map((t) => t.startsWith("#") ? t : `#${t}`);
+    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
+    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
+  }
+  if (body.status) {
+    node = {
+      ...node,
+      frontmatter: { ...node.frontmatter, status: body.status }
+    };
+  }
+  if (body.title) {
+    node = {
+      ...node,
+      frontmatter: { ...node.frontmatter, title: body.title }
+    };
+  }
+  const currentVersion = getCurrentVersion(nestId, nodeId);
+  const newVersion = currentVersion + 1;
+  node = {
+    ...node,
+    frontmatter: {
+      ...node.frontmatter,
+      version: newVersion,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  const fm = Object.fromEntries(
+    Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
+  );
+  node = { ...node, frontmatter: fm };
+  const serialized = serializeDocument(node);
+  await storage.writeDocument(nodeId, serialized);
+  const authorEmail = getUserEmail(c);
+  const hasStewards = isStewardshipEnabled(nestId);
+  const currentTags = node.frontmatter.tags || [];
+  syncNodeTags(nestId, nodeId, currentTags);
+  createVersion({
+    nestId,
+    nodeId,
+    version: newVersion,
+    content: node.body || "",
+    author: authorEmail,
+    status: hasStewards ? "draft" : "approved",
+    tags: currentTags,
+    changeNote: body.changeNote
+  });
+  if (!hasStewards) {
+    setApprovedVersion(nestId, nodeId, newVersion, authorEmail);
+  }
+  return c.json({ node: toNodeResponse(node), version: newVersion });
+});
+nodeRoutes.delete("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage } = engineCache.get(nestId);
+  try {
+    await storage.deleteDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  removeNodeFromTagIndex(nestId, nodeId);
+  trackEvent("node.delete", { nestId, nodeId });
+  return c.json({ deleted: true });
+});
+function getUserEmail(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return user?.email || "anonymous@localhost";
+}
+
+// src/nodes/query-routes.ts
+import { Hono as Hono5 } from "hono";
+import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
+
+// src/nodes/prompt-compiler.ts
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "and",
+  "or",
+  "but",
+  "if",
+  "then",
+  "else",
+  "so",
+  "as",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "have",
+  "has",
+  "had",
+  "do",
+  "does",
+  "did",
+  "done",
+  "can",
+  "could",
+  "should",
+  "would",
+  "may",
+  "might",
+  "must",
+  "shall",
+  "will",
+  "about",
+  "above",
+  "after",
+  "again",
+  "against",
+  "all",
+  "am",
+  "any",
+  "because",
+  "before",
+  "below",
+  "between",
+  "both",
+  "by",
+  "during",
+  "each",
+  "few",
+  "for",
+  "from",
+  "further",
+  "here",
+  "how",
+  "i",
+  "me",
+  "my",
+  "myself",
+  "we",
+  "us",
+  "our",
+  "ours",
+  "you",
+  "your",
+  "yours",
+  "he",
+  "him",
+  "his",
+  "she",
+  "her",
+  "hers",
+  "it",
+  "its",
+  "they",
+  "them",
+  "their",
+  "theirs",
+  "this",
+  "that",
+  "these",
+  "those",
+  "to",
+  "too",
+  "very",
+  "of",
+  "on",
+  "off",
+  "over",
+  "under",
+  "up",
+  "down",
+  "in",
+  "out",
+  "into",
+  "onto",
+  "some",
+  "such",
+  "same",
+  "other",
+  "than",
+  "what",
+  "when",
+  "where",
+  "which",
+  "who",
+  "whom",
+  "why",
+  "with",
+  "without",
+  "just",
+  "also",
+  "only",
+  "more",
+  "most",
+  "use",
+  "using",
+  "used",
+  "get",
+  "got",
+  "make",
+  "made",
+  "need",
+  "want",
+  "like",
+  "help",
+  "show",
+  "tell",
+  "give",
+  "take",
+  "find",
+  "look",
+  "know",
+  "think",
+  "say",
+  "mean",
+  "tell",
+  "not",
+  "no",
+  "yes",
+  "okay",
+  "ok",
+  "please",
+  "thanks",
+  "thank"
+]);
+function tokenizePrompt(prompt) {
+  const words = prompt.toLowerCase().split(/[^a-z0-9_-]+/).filter(Boolean).filter((w) => w.length >= 3 && !STOPWORDS.has(w));
+  return Array.from(new Set(words));
+}
+function compilePrompt(prompt, nestId, titles) {
+  const tokens = tokenizePrompt(prompt);
+  if (tokens.length === 0) {
+    return { selector: null, matchedTags: [], matchedTitles: [], unmatched: [] };
+  }
+  const db = getDb();
+  const tagRows = db.prepare(
+    "SELECT DISTINCT tag_name FROM node_tag_index WHERE nest_id = ?"
+  ).all(nestId);
+  const knownTags = new Set(tagRows.map((r) => r.tag_name));
+  const matchedTags = /* @__PURE__ */ new Set();
+  for (const token of tokens) {
+    const norm = normalizeTag(token);
+    if (knownTags.has(norm)) matchedTags.add(norm);
+  }
+  const matchedTitles = /* @__PURE__ */ new Set();
+  for (const title of titles) {
+    const titleTokens = tokenizePrompt(title);
+    if (titleTokens.length === 0) continue;
+    const hit = titleTokens.some((t) => tokens.includes(t));
+    if (hit) matchedTitles.add(title);
+  }
+  const unmatched = tokens.filter(
+    (t) => !matchedTags.has(normalizeTag(t)) && !Array.from(matchedTitles).some(
+      (title) => tokenizePrompt(title).includes(t)
+    )
+  );
+  const tagParts = Array.from(matchedTags).map((t) => `#${t}`);
+  return {
+    selector: tagParts.length > 0 ? tagParts.join(" | ") : null,
+    matchedTags: Array.from(matchedTags),
+    matchedTitles: Array.from(matchedTitles),
+    unmatched
+  };
+}
+
+// src/nodes/query-routes.ts
+var queryRoutes = new Hono5();
+function approxTokens(text) {
+  return Math.ceil(text.length / 4);
+}
+function formatContextBlock(node) {
+  const tags = (node.frontmatter.tags || []).join(" ");
+  const header = tags ? `# ${node.frontmatter.title}
+
+_tags: ${tags}_
+
+` : `# ${node.frontmatter.title}
+
+`;
+  return header + (node.body || "").trim();
+}
+queryRoutes.post("/context", async (c) => {
+  const body = await c.req.json();
+  if (!body.prompt && !body.selector) {
+    throw new ValidationError("prompt or selector is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { query: queryEngine, storage } = engineCache.get(nestId);
+  const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
+  const hops = body.hops ?? 2;
+  const includeDrafts = body.include_drafts === true;
+  let selector = body.selector?.trim() || null;
+  let compileDetail = null;
+  let titleMatches = [];
+  const allDocs = await storage.discoverDocuments();
+  if (!selector && body.prompt) {
+    const titles = allDocs.map((d) => d.frontmatter.title);
+    compileDetail = compilePrompt(body.prompt, nestId, titles);
+    selector = compileDetail.selector;
+    if (compileDetail.matchedTitles.length > 0) {
+      const matchedLower = new Set(
+        compileDetail.matchedTitles.map((t) => t.toLowerCase())
+      );
+      titleMatches = allDocs.filter(
+        (d) => matchedLower.has(d.frontmatter.title.toLowerCase())
+      );
+    }
+  }
+  let documents = [];
+  let hopsUsed = 0;
+  let nodesTraversed = 0;
+  if (selector) {
+    const result = await queryEngine.query(selector, {
+      hops,
+      includeDrafts,
+      full: true
+    });
+    documents = result.documents;
+    hopsUsed = result.hopsUsed;
+    nodesTraversed = result.nodesTraversed;
+  }
+  if (titleMatches.length > 0) {
+    const seen = new Set(documents.map((d) => d.id));
+    for (const t of titleMatches) {
+      if (!seen.has(t.id)) {
+        documents.push(t);
+        seen.add(t.id);
+      }
+    }
+  }
+  const userEmail = resolveCallerEmail(c.get("userId"));
+  const beforePermission = documents.length;
+  const accessible = filterAccessible(nestId, userEmail, documents);
+  const permissionFiltered = beforePermission - accessible.length;
+  const included = [];
+  let tokenCount = 0;
+  for (const doc of accessible) {
+    const block = formatContextBlock(doc);
+    const blockTokens = approxTokens(block);
+    if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
+    included.push(doc);
+    tokenCount += blockTokens;
+  }
+  const truncatedByBudget = accessible.length - included.length;
+  const contextMarkdown = included.map(formatContextBlock).join("\n\n---\n\n");
+  trackEvent("context.resolve", {
+    nestId,
+    selector_from_prompt: !!compileDetail,
+    included: included.length,
+    permission_filtered: permissionFiltered,
+    token_count: tokenCount
+  });
+  return c.json({
+    context: contextMarkdown,
+    nodes: included.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      tags: n.frontmatter.tags || [],
+      type: n.frontmatter.type || "document"
+    })),
+    trace: {
+      selector_used: selector,
+      from_prompt: body.prompt ?? null,
+      compiled: compileDetail ? {
+        matched_tags: compileDetail.matchedTags,
+        matched_titles: compileDetail.matchedTitles,
+        unmatched_tokens: compileDetail.unmatched
+      } : null,
+      total_matched: documents.length,
+      permission_filtered: permissionFiltered,
+      included: included.length,
+      truncated_by_budget: truncatedByBudget,
+      hops_used: hopsUsed,
+      nodes_traversed: nodesTraversed,
+      approx_tokens: tokenCount,
+      max_tokens: maxTokens
+    }
+  });
+});
+queryRoutes.post("/query", async (c) => {
+  const body = await c.req.json();
+  if (!body.query) {
+    throw new ValidationError("query is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { query: queryEngine } = engineCache.get(nestId);
+  const result = await queryEngine.query(body.query, {
+    hops: body.hops ?? 2
+  });
+  const userEmail = resolveCallerEmail(c.get("userId"));
+  const accessible = filterAccessible(nestId, userEmail, result.documents);
+  return c.json({
+    query: body.query,
+    count: accessible.length,
+    nodes: accessible.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      type: n.frontmatter.type || "document",
+      tags: n.frontmatter.tags || [],
+      snippet: (n.body || "").slice(0, 200).replace(/\n/g, " ")
+    }))
+  });
+});
+queryRoutes.get("/search", async (c) => {
+  const q = c.req.query("q");
+  if (!q) {
+    throw new ValidationError("q query parameter is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage } = engineCache.get(nestId);
+  const documents = await storage.discoverDocuments();
+  const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
+  const matches = documents.filter((node) => {
+    const haystack = [
+      node.frontmatter.title,
+      node.body || "",
+      node.frontmatter.type || "",
+      ...node.frontmatter.tags || []
+    ].join(" ").toLowerCase();
+    return terms.every((term) => haystack.includes(term));
+  });
+  const userEmail = resolveCallerEmail(c.get("userId"));
+  const accessible = filterAccessible(nestId, userEmail, matches);
+  return c.json({
+    query: q,
+    count: accessible.length,
+    nodes: accessible.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      type: n.frontmatter.type || "document",
+      tags: n.frontmatter.tags || [],
+      snippet: (n.body || "").slice(0, 200).replace(/\n/g, " ")
+    }))
+  });
+});
+queryRoutes.get("/overview", async (c) => {
+  const { storage } = engineCache.get(c.req.param("nestId"));
+  const documents = await storage.discoverDocuments();
+  const types = {};
+  const tags = {};
+  for (const node of documents) {
+    const t = node.frontmatter.type || "document";
+    types[t] = (types[t] || 0) + 1;
+    for (const tag of node.frontmatter.tags || []) {
+      tags[tag] = (tags[tag] || 0) + 1;
+    }
+  }
+  return c.json({
+    total: documents.length,
+    types,
+    tags,
+    nodes: documents.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      type: n.frontmatter.type || "document",
+      tags: n.frontmatter.tags || [],
+      snippet: (n.body || "").slice(0, 120).replace(/\n/g, " ")
+    }))
+  });
+});
+queryRoutes.get("/context", async (c) => {
+  const { storage } = engineCache.get(c.req.param("nestId"));
+  const content = await storage.readContextMd();
+  return c.json({ content: content || "" });
+});
+queryRoutes.post("/publish", async (c) => {
+  const body = await c.req.json();
+  if (!body.documents?.length && !body.context_md) {
+    throw new ValidationError("documents array or context_md is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage } = engineCache.get(nestId);
+  const created = [];
+  if (body.context_md) {
+    await storage.writeContextMd(body.context_md);
+  }
+  for (const doc of body.documents || []) {
+    if (!doc.title || !doc.content) continue;
+    const slug = doc.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    const id = `nodes/${slug}`;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const tags = doc.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
+    const node = {
+      id,
+      filePath: "",
+      frontmatter: {
+        title: doc.title,
+        type: doc.type || "document",
+        tags,
+        status: "draft",
+        version: 1,
+        created_at: now,
+        updated_at: now,
+        metadata: {
+          owners: ["*"],
+          scope: doc.scope || "team"
+        }
+      },
+      body: doc.content,
+      rawContent: ""
+    };
+    const serialized = serializeDocument2(node);
+    await storage.writeDocument(id, serialized);
+    syncNodeTags(nestId, id, tags);
+    created.push(id);
+  }
+  trackEvent("nest.publish", { nestId, count: created.length });
+  return c.json(
+    {
+      published: created.length,
+      context_md_updated: !!body.context_md,
+      node_ids: created
+    },
+    201
+  );
+});
+
+// src/mcp/routes.ts
+import { Hono as Hono6 } from "hono";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// src/mcp/tools.ts
+import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
+var TOOL_DEFINITIONS = [
+  {
+    name: "context_init",
+    description: "Load the vault's CONTEXT.md which contains operating instructions and behavioral guidelines. Call this FIRST in every conversation.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_overview",
+    description: "Get a complete map of the vault: total node count, types, tags, and a title+snippet for every node.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_search",
+    description: "Full-text keyword search across all node content, titles, tags, and metadata.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Search terms" }
+      },
+      required: ["query"]
+    }
+  },
+  {
+    name: "context_query",
+    description: "Run a structured selector query. Supports: #tag, type:X, [[Title]], scope:X. Combine with +AND, |OR, -NOT.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Selector query" }
+      },
+      required: ["query"]
+    }
+  },
+  {
+    name: "context_get",
+    description: "Get the FULL content of a specific node by title or ID.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      }
+    }
+  },
+  {
+    name: "context_list",
+    description: "Browse vault contents with optional type, tag, or limit filters.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        type: { type: "string", description: "Filter by node type" },
+        tag: { type: "string", description: "Filter by tag" },
+        limit: { type: "number", description: "Max nodes to return" }
+      }
+    }
+  },
+  {
+    name: "context_resolve",
+    description: "Full context resolution \u2014 run a selector and return complete node content, respecting a token budget.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        selector: {
+          type: "string",
+          description: "Selector query string"
+        },
+        max_tokens: {
+          type: "number",
+          description: "Approximate token budget (default: 8000)"
+        }
+      },
+      required: ["selector"]
+    }
+  },
+  {
+    name: "context_create",
+    description: "Create a new knowledge node in the vault.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Descriptive title" },
+        content: {
+          type: "string",
+          description: "Markdown content body"
+        },
+        type: {
+          type: "string",
+          description: "Node type (default: document)"
+        },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags"
+        },
+        scope: { type: "string", description: "Visibility scope" }
+      },
+      required: ["title", "content"]
+    }
+  },
+  {
+    name: "context_update",
+    description: "Update an existing node \u2014 append, replace content, add tags.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: {
+          type: "string",
+          description: "Title of node to update"
+        },
+        content: {
+          type: "string",
+          description: "New content (replaces)"
+        },
+        append: { type: "string", description: "Content to append" },
+        tags: {
+          type: "array",
+          items: { type: "string" },
+          description: "Tags to add"
+        },
+        scope: { type: "string", description: "New scope" }
+      },
+      required: ["title"]
+    }
+  },
+  // ─── Governance Tools ───────────────────────────────────────────────
+  {
+    name: "context_stewards",
+    description: "Show who the data stewards are for a specific node, or list all stewards for the vault. Stewards are the people who approve or reject changes before they go live.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: {
+          type: "string",
+          description: "Title of node to resolve stewards for (optional \u2014 omit for all stewards)"
+        }
+      }
+    }
+  },
+  {
+    name: "context_review_queue",
+    description: "Show documents pending review. These need a steward to approve or reject them before they become available to AI.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        status: {
+          type: "string",
+          description: "Filter by status: pending (default), approved, rejected, cancelled"
+        }
+      }
+    }
+  },
+  {
+    name: "context_submit_review",
+    description: "Submit a node for steward review. The node will be marked as pending review and stewards will be notified.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node to submit" },
+        note: { type: "string", description: "Optional note for the reviewer" },
+        priority: { type: "string", description: "Priority: low, normal (default), high, urgent" }
+      },
+      required: ["title"]
+    }
+  },
+  {
+    name: "context_approve",
+    description: "Approve a node that is pending review. Only stewards with approval permission can do this. The approved version becomes available to AI queries.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node to approve" },
+        note: { type: "string", description: "Optional approval note" }
+      },
+      required: ["title"]
+    }
+  },
+  {
+    name: "context_reject",
+    description: "Reject a node that is pending review with a required note explaining what needs to change. Only stewards can reject.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node to reject" },
+        note: { type: "string", description: "Required: explain what needs to change" }
+      },
+      required: ["title", "note"]
+    }
+  },
+  {
+    name: "context_versions",
+    description: "Show the version history of a node \u2014 all edits, who made them, their approval status, and which version is currently approved for AI use.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" }
+      },
+      required: ["title"]
+    }
+  },
+  {
+    name: "context_assign_steward",
+    description: "Assign a data steward to govern a scope (nest, tag, folder pattern, or specific document). Stewards review and approve changes before they go live.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        email: { type: "string", description: "Email of the person to assign as steward" },
+        scope: { type: "string", description: "Scope: nest (all docs), tag, folder, or document" },
+        target: { type: "string", description: "Scope target: tag name (e.g. #architecture), folder pattern (e.g. nodes/api-*), or document title" },
+        role: { type: "string", description: "Role: reviewer (default), editor, or viewer" }
+      },
+      required: ["email", "scope"]
+    }
+  }
+];
+async function handleToolCall(toolName, args, ctx) {
+  const { storage, queryEngine, nestId, userEmail } = ctx;
+  switch (toolName) {
+    case "context_init": {
+      const content = await storage.readContextMd();
+      if (!content)
+        return "No CONTEXT.md found. Use context_overview to see what's available.";
+      return `# Vault Instructions (CONTEXT.md)
+
+${content}`;
+    }
+    case "context_overview": {
+      const docs = await storage.discoverDocuments();
+      const types = {};
+      const tags = {};
+      for (const n of docs) {
+        const t = n.frontmatter.type || "document";
+        types[t] = (types[t] || 0) + 1;
+        for (const tag of n.frontmatter.tags || []) tags[tag] = (tags[tag] || 0) + 1;
+      }
+      const typeList = Object.entries(types).sort((a, b) => b[1] - a[1]).map(([t, c]) => `  ${t}: ${c}`).join("\n");
+      const tagList = Object.entries(tags).sort((a, b) => b[1] - a[1]).map(([t, c]) => `  ${t}: ${c}`).join("\n");
+      const nodeList = docs.map(
+        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).slice(0, 4).join(" ")}
+   ${(n.body || "").slice(0, 120).replace(/\n/g, " ")}`
+      ).join("\n\n");
+      return `# Vault Overview
+**Total nodes:** ${docs.length}
+
+## Types
+${typeList}
+
+## Tags
+${tagList}
+
+## All Nodes
+
+${nodeList}`;
+    }
+    case "context_search": {
+      const docs = await storage.discoverDocuments();
+      const terms = (args.query || "").toLowerCase().split(/\s+/).filter(Boolean);
+      const matches = docs.filter((n) => {
+        const hay = [n.frontmatter.title, n.body || "", n.frontmatter.type || "", ...n.frontmatter.tags || []].join(" ").toLowerCase();
+        return terms.every((t) => hay.includes(t));
+      });
+      if (!matches.length) return `No nodes matched search: "${args.query}"`;
+      const results = matches.map(
+        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}
+   ${(n.body || "").slice(0, 200).replace(/\n/g, " ")}`
+      ).join("\n\n");
+      return `Found ${matches.length} node(s) matching "${args.query}":
+
+${results}`;
+    }
+    case "context_query": {
+      const result = await queryEngine.query(args.query, { hops: 2 });
+      const nodes = result.documents;
+      if (!nodes.length) return `No nodes matched: ${args.query}`;
+      const list = nodes.map(
+        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}`
+      ).join("\n\n");
+      return `Found ${nodes.length} node(s) for \`${args.query}\`:
+
+${list}`;
+    }
+    case "context_get": {
+      const docs = await storage.discoverDocuments();
+      let node;
+      if (args.title) {
+        node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+        );
+      } else if (args.id) {
+        node = docs.find((n) => n.id === args.id);
+      }
+      if (!node) return `Node not found: ${args.title || args.id}`;
+      const meta = [
+        `**Title:** ${node.frontmatter.title}`,
+        `**Type:** ${node.frontmatter.type || "document"}`,
+        node.frontmatter.tags?.length ? `**Tags:** ${node.frontmatter.tags.join(" ")}` : null
+      ].filter(Boolean).join("\n");
+      return `${meta}
+
+---
+
+${node.body || "(no content)"}`;
+    }
+    case "context_list": {
+      let docs = await storage.discoverDocuments();
+      if (args.type)
+        docs = docs.filter((n) => n.frontmatter.type === args.type);
+      if (args.tag) {
+        const tag = args.tag.startsWith("#") ? args.tag : `#${args.tag}`;
+        docs = docs.filter((n) => n.frontmatter.tags?.includes(tag));
+      }
+      docs = docs.slice(0, args.limit || 50);
+      if (!docs.length) return "No nodes found with the given filters.";
+      const list = docs.map(
+        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}]`
+      ).join("\n");
+      return `${docs.length} node(s):
+
+${list}`;
+    }
+    case "context_resolve": {
+      const result = await queryEngine.query(args.selector, { hops: 2 });
+      const maxTokens = args.max_tokens || 8e3;
+      const approxChars = maxTokens * 4;
+      let total = 0;
+      const resolved = [];
+      for (const n of result.documents) {
+        const entry = `## ${n.frontmatter.title}
+
+${n.body || ""}`;
+        if (total + entry.length > approxChars) break;
+        resolved.push(entry);
+        total += entry.length;
+      }
+      return resolved.join("\n\n---\n\n") || "No nodes resolved.";
+    }
+    case "context_create": {
+      const slug = args.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+      const id = `nodes/${slug}`;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const tags = (args.tags || []).map(
+        (t) => t.startsWith("#") ? t : `#${t}`
+      );
+      const hasStewards = isStewardshipEnabled(nestId);
+      const initialStatus = hasStewards ? "draft" : "approved";
+      const node = {
+        id,
+        filePath: "",
+        frontmatter: {
+          title: args.title,
+          type: args.type || "document",
+          tags,
+          status: initialStatus,
+          version: 1,
+          created_at: now,
+          updated_at: now,
+          metadata: { owners: ["*"], scope: args.scope || "team" }
+        },
+        body: args.content,
+        rawContent: ""
+      };
+      await storage.writeDocument(id, serializeDocument3(node));
+      syncNodeTags(nestId, id, tags);
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: 1,
+        content: args.content,
+        author: userEmail,
+        status: initialStatus,
+        tags
+      });
+      if (initialStatus === "approved") {
+        setApprovedVersion(nestId, id, 1, userEmail);
+      }
+      return `Created node: **${args.title}** (${id}) \u2014 status: ${initialStatus}`;
+    }
+    case "context_update": {
+      const docs = await storage.discoverDocuments();
+      const node = docs.find(
+        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+      );
+      if (!node) return `Node not found: ${args.title}`;
+      let body = node.body || "";
+      if (args.content !== void 0) body = args.content;
+      if (args.append) body = body + "\n\n" + args.append;
+      let tags = node.frontmatter.tags || [];
+      if (args.tags) {
+        const newTags = args.tags.map(
+          (t) => t.startsWith("#") ? t : `#${t}`
+        );
+        tags = [.../* @__PURE__ */ new Set([...tags, ...newTags])];
+      }
+      const updated = {
+        ...node,
+        body,
+        frontmatter: {
+          ...node.frontmatter,
+          tags,
+          updated_at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      };
+      await storage.writeDocument(node.id, serializeDocument3(updated));
+      return `Updated node: **${node.frontmatter.title}**`;
+    }
+    // ─── Governance Tool Handlers ──────────────────────────────────────
+    case "context_stewards": {
+      if (args.title) {
+        const docs = await storage.discoverDocuments();
+        const node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+        );
+        const nodeId = node?.id || "";
+        const resolved = resolveStewardsForNode(ctx.nestId, nodeId);
+        if (resolved.length === 0) {
+          return `No stewards configured for "${args.title}". Changes are auto-approved.`;
+        }
+        const list = resolved.map(
+          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.canApprove ? " \u2713 can approve" : ""}`
+        ).join("\n");
+        return `# Stewards for "${args.title}"
+
+${list}`;
+      }
+      const allStewards = getStewardsForNest(ctx.nestId);
+      if (allStewards.length === 0) {
+        return "No stewards configured. All changes are auto-approved.\n\nTo configure stewards, add a `stewards.yaml` file to the vault root, or use `context_assign_steward`.";
+      }
+      const byScope = {};
+      for (const s of allStewards) {
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : s.scope === "folder" ? `Folder: ${s.nodePattern}` : `Document: ${s.nodePattern}`;
+        (byScope[key] = byScope[key] || []).push(s);
+      }
+      const sections = Object.entries(byScope).map(
+        ([scope, stewards]) => `## ${scope}
+${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.canApprove ? " \u2014 can approve" : ""}`).join("\n")}`
+      ).join("\n\n");
+      return `# Data Stewards
+
+${sections}`;
+    }
+    case "context_review_queue": {
+      const status = args.status || "pending";
+      const result = getReviewQueue({
+        nestId: ctx.nestId,
+        status
+      });
+      if (result.requests.length === 0) {
+        return status === "pending" ? "No documents pending review. All caught up!" : `No reviews with status "${status}".`;
+      }
+      const list = result.requests.map(
+        (r, i) => `${i + 1}. **${r.nodeId}** v${r.version} \u2014 ${r.priority} priority
+   Submitted by: ${r.requestedBy} at ${r.requestedAt}${r.requestNote ? `
+   Note: "${r.requestNote}"` : ""}`
+      ).join("\n\n");
+      return `# Review Queue (${status})
+**${result.total} item(s)**
+
+${list}`;
+    }
+    case "context_submit_review": {
+      const docs = await storage.discoverDocuments();
+      const node = docs.find(
+        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+      );
+      if (!node) return `Node not found: ${args.title}`;
+      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      if (currentVersion === 0) return `No versions found for "${args.title}"`;
+      try {
+        const request = submitForReview({
+          nestId: ctx.nestId,
+          nodeId: node.id,
+          version: currentVersion,
+          requestedBy: ctx.userEmail,
+          note: args.note,
+          priority: args.priority
+        });
+        const resolved = resolveStewardsForNode(
+          ctx.nestId,
+          node.id
+        );
+        const stewardList = resolved.length > 0 ? `
+
+**Stewards who can review:**
+${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "";
+        return `Submitted "${args.title}" v${currentVersion} for review (${request.priority} priority).${stewardList}`;
+      } catch (err) {
+        return `Failed to submit: ${err.message}`;
+      }
+    }
+    case "context_approve": {
+      const docs = await storage.discoverDocuments();
+      const node = docs.find(
+        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+      );
+      if (!node) return `Node not found: ${args.title}`;
+      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      try {
+        const request = approve({
+          nestId: ctx.nestId,
+          nodeId: node.id,
+          version: currentVersion,
+          approvedBy: ctx.userEmail,
+          note: args.note
+        });
+        return `Approved "${args.title}" v${currentVersion}. This version is now live for AI queries.${args.note ? `
+Note: ${args.note}` : ""}`;
+      } catch (err) {
+        return `Cannot approve: ${err.message}`;
+      }
+    }
+    case "context_reject": {
+      const docs = await storage.discoverDocuments();
+      const node = docs.find(
+        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+      );
+      if (!node) return `Node not found: ${args.title}`;
+      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      try {
+        const request = reject({
+          nestId: ctx.nestId,
+          nodeId: node.id,
+          version: currentVersion,
+          rejectedBy: ctx.userEmail,
+          note: args.note
+        });
+        return `Rejected "${args.title}" v${currentVersion}.
+Reason: ${args.note}`;
+      } catch (err) {
+        return `Cannot reject: ${err.message}`;
+      }
+    }
+    case "context_versions": {
+      const docs = await storage.discoverDocuments();
+      const node = docs.find(
+        (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+      );
+      if (!node) return `Node not found: ${args.title}`;
+      const allVersions = getVersions(ctx.nestId, node.id);
+      const approved = getApprovedVersion(ctx.nestId, node.id);
+      if (allVersions.length === 0) {
+        return `No version history for "${args.title}".`;
+      }
+      const list = allVersions.map(
+        (v) => `- **v${v.version}** ${v.status}${v.version === approved ? " (AI-active)" : ""} \u2014 by ${v.editedBy} at ${v.editedAt}${v.changeNote ? ` "${v.changeNote}"` : ""}`
+      ).join("\n");
+      return `# Version History: ${args.title}
+**Current:** v${allVersions[0]?.version || 0} | **AI-active:** ${approved ? `v${approved}` : "none"}
+
+${list}`;
+    }
+    case "context_assign_steward": {
+      const scope = args.scope;
+      if (!["nest", "tag", "folder", "document"].includes(scope)) {
+        return `Invalid scope "${args.scope}". Use: nest, tag, folder, or document.`;
+      }
+      try {
+        assignSteward({
+          nestId: ctx.nestId,
+          scope,
+          nodePattern: scope === "folder" || scope === "document" ? args.target : void 0,
+          tagName: scope === "tag" ? args.target : void 0,
+          userEmail: args.email,
+          role: args.role || "reviewer",
+          canApprove: true,
+          canReject: true,
+          assignedBy: ctx.userEmail,
+          assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          isActive: true
+        });
+        const targetDesc = scope === "nest" ? "all documents" : `${scope}: ${args.target}`;
+        return `Assigned **${args.email}** as ${args.role || "reviewer"} for ${targetDesc}.`;
+      } catch (err) {
+        return `Failed to assign steward: ${err.message}`;
+      }
+    }
+    default:
+      return `Unknown tool: ${toolName}`;
+  }
+}
+
+// src/mcp/routes.ts
+import { z } from "zod";
+var mcpRoutes = new Hono6();
+function getUserEmail2(userId) {
+  const db = getDb();
+  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return user?.email || "anonymous@localhost";
+}
+function createMcpServerForNest(nestId, userEmail) {
+  const server = new McpServer(
+    { name: `contextnest-${nestId}`, version: "1.0.0" },
+    { capabilities: { tools: {} } }
+  );
+  const engine = engineCache.get(nestId);
+  for (const tool of TOOL_DEFINITIONS) {
+    const props = tool.inputSchema.properties || {};
+    const required = tool.inputSchema.required || [];
+    const shape = {};
+    for (const [key, def] of Object.entries(props)) {
+      let field;
+      if (def.type === "string") field = z.string();
+      else if (def.type === "number") field = z.number();
+      else if (def.type === "array") field = z.array(z.string());
+      else field = z.any();
+      if (!required.includes(key)) field = field.optional();
+      shape[key] = field;
+    }
+    server.tool(tool.name, tool.description, shape, async (args) => {
+      const text = await handleToolCall(tool.name, args, {
+        storage: engine.storage,
+        queryEngine: engine.query,
+        nestId,
+        userEmail
+      });
+      return { content: [{ type: "text", text }] };
+    });
+  }
+  return server;
+}
+mcpRoutes.all("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const userEmail = getUserEmail2(userId);
+  const server = createMcpServerForNest(nestId, userEmail);
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: void 0,
+    enableJsonResponse: true
+  });
+  await server.server.connect(transport);
+  try {
+    const response = await transport.handleRequest(c.req.raw);
+    return response;
+  } finally {
+    await transport.close();
+    await server.server.close();
+  }
+});
+
+// src/governance/routes.ts
+import { Hono as Hono7 } from "hono";
+
+// src/governance/stewards-parser.ts
+import { readFileSync, existsSync } from "fs";
+import { join as join3 } from "path";
+function parseStewardsYaml(content) {
+  const result = { version: 1 };
+  const lines = content.split("\n");
+  let currentSection = null;
+  let currentTarget = null;
+  let currentEntries = [];
+  const flushTarget = () => {
+    if (!currentSection || currentEntries.length === 0) return;
+    if (currentSection === "nest") {
+      result.nest = [...result.nest || [], ...currentEntries];
+    } else if (currentSection === "folders" && currentTarget) {
+      result.folders = result.folders || {};
+      result.folders[currentTarget] = currentEntries;
+    } else if (currentSection === "tags" && currentTarget) {
+      result.tags = result.tags || {};
+      result.tags[currentTarget] = currentEntries;
+    } else if (currentSection === "documents" && currentTarget) {
+      result.documents = result.documents || {};
+      result.documents[currentTarget] = currentEntries;
+    }
+    currentEntries = [];
+  };
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    if (!line || line.startsWith("#")) continue;
+    if (!line.startsWith(" ") && !line.startsWith("	") && line.endsWith(":")) {
+      flushTarget();
+      currentTarget = null;
+      const key = line.slice(0, -1).trim();
+      if (key === "version") continue;
+      if (key === "nest" || key === "data_room") {
+        currentSection = "nest";
+      } else if (key === "folders") {
+        currentSection = "folders";
+      } else if (key === "tags") {
+        currentSection = "tags";
+      } else if (key === "documents") {
+        currentSection = "documents";
+      }
+      continue;
+    }
+    const subMatch = line.match(/^(?:  |\t)([^\s].*):$/);
+    if (subMatch && currentSection && currentSection !== "nest") {
+      flushTarget();
+      currentTarget = subMatch[1].trim().replace(/^["']|["']$/g, "");
+      continue;
+    }
+    const entryMatch = line.match(/^\s+-\s+(.*)/);
+    if (entryMatch) {
+      const entryStr = entryMatch[1].trim();
+      const entry = parseEntry(entryStr);
+      if (entry) currentEntries.push(entry);
+    }
+  }
+  flushTarget();
+  return result;
+}
+function parseEntry(str) {
+  const emailMatch = str.match(/email:\s*["']?([^\s,"'{}]+)["']?/);
+  if (!emailMatch) return null;
+  const entry = { email: emailMatch[1] };
+  const roleMatch = str.match(/role:\s*["']?(\w+)["']?/);
+  if (roleMatch) entry.role = roleMatch[1];
+  if (str.includes("can_approve:")) {
+    entry.can_approve = str.includes("can_approve: true");
+  }
+  if (str.includes("can_reject:")) {
+    entry.can_reject = str.includes("can_reject: true");
+  }
+  return entry;
+}
+function loadStewardsConfig(nestId) {
+  const dataRoot = config.DATA_ROOT;
+  const nestPath2 = join3(dataRoot, "nests", nestId);
+  const candidates = [
+    join3(nestPath2, "stewards.yaml"),
+    join3(nestPath2, "stewards.yml"),
+    join3(nestPath2, ".context", "stewards.yaml")
+  ];
+  for (const candidatePath of candidates) {
+    if (existsSync(candidatePath)) {
+      const content = readFileSync(candidatePath, "utf-8");
+      return parseStewardsYaml(content);
+    }
+  }
+  return null;
+}
+
+// src/governance/routes.ts
+var governanceRoutes = new Hono7();
+governanceRoutes.get("/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const scope = c.req.query("scope");
+  const search = c.req.query("search");
+  const stewards = listStewards({
+    nestId,
+    scope: scope || void 0,
+    search: search || void 0
+  });
+  return c.json({ stewards });
+});
+governanceRoutes.post("/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const assignedBy = getUserEmail3(c);
+  if (!body.scope) throw new ValidationError("scope is required");
+  if (Array.isArray(body.users)) {
+    const created2 = createStewardRecord({
+      nestId,
+      scope: body.scope,
+      documentId: body.documentId,
+      folderPath: body.folderPath,
+      tagName: body.tagName,
+      users: body.users,
+      assignedBy
+    });
+    return c.json({ stewards: created2 }, 201);
+  }
+  if (!body.email) {
+    throw new ValidationError("users[] or email is required");
+  }
+  const created = createStewardRecord({
+    nestId,
+    scope: body.scope,
+    documentId: body.scope === "document" ? body.nodePattern : void 0,
+    folderPath: body.scope === "folder" ? body.nodePattern : void 0,
+    tagName: body.scope === "tag" ? body.tagName : void 0,
+    users: [
+      {
+        email: body.email,
+        role: body.role,
+        canApprove: body.canApprove,
+        canReject: body.canReject
+      }
+    ],
+    assignedBy
+  });
+  return c.json({ steward: created[0] }, 201);
+});
+governanceRoutes.delete("/stewards/:stewardId", async (c) => {
+  const stewardId = c.req.param("stewardId");
+  removeSteward(stewardId);
+  return c.json({ removed: true });
+});
+governanceRoutes.post("/stewards/sync", async (c) => {
+  const nestId = c.req.param("nestId");
+  const stewardsConfig = loadStewardsConfig(nestId);
+  if (!stewardsConfig) {
+    return c.json({ synced: 0, message: "No stewards.yaml found" });
+  }
+  const count = syncFromConfig(nestId, stewardsConfig);
+  return c.json({ synced: count });
+});
+governanceRoutes.get("/review-queue", async (c) => {
+  const nestId = c.req.param("nestId");
+  const status = c.req.query("status") || "pending";
+  const limit = parseInt(c.req.query("limit") || "50", 10);
+  const offset = parseInt(c.req.query("offset") || "0", 10);
+  const result = getReviewQueue({
+    nestId,
+    status,
+    limit,
+    offset
+  });
+  return c.json(result);
+});
+var governanceNodeRoutes = new Hono7();
+governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { stewards: resolved, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback(nestId, nodeId);
+  return c.json({
+    nodeId,
+    stewards: resolved.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      scope: r.steward.scope,
+      source: r.source,
+      priority: r.priority,
+      canApprove: r.steward.canApprove
+    })),
+    fallbackToOwner,
+    ownerEmail
+  });
+});
+governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const allVersions = getVersions(nestId, nodeId);
+  const approved = getApprovedVersion(nestId, nodeId);
+  return c.json({
+    versions: allVersions,
+    approvedVersion: approved,
+    currentVersion: allVersions[0]?.version || 0
+  });
+});
+governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const history = getReviewHistory(nestId, nodeId);
+  return c.json({ reviews: history });
+});
+governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const currentVersion = getCurrentVersion(nestId, nodeId);
+  if (currentVersion === 0) {
+    throw new ValidationError("Node has no versions to review");
+  }
+  const userEmail = getUserEmail3(c);
+  const request = submitForReview({
+    nestId,
+    nodeId,
+    version: currentVersion,
+    requestedBy: userEmail,
+    note: body.note,
+    priority: body.priority
+  });
+  const resolved = resolveStewardsForNode(nestId, nodeId);
+  return c.json(
+    {
+      review: request,
+      stewards: resolved.map((r) => ({
+        email: r.steward.userEmail,
+        role: r.steward.role,
+        source: r.source
+      }))
+    },
+    201
+  );
+});
+governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const userEmail = getUserEmail3(c);
+  const isAdmin = isSuperAdmin(userEmail);
+  try {
+    const request = approve({
+      nestId,
+      nodeId,
+      version: getCurrentVersion(nestId, nodeId),
+      approvedBy: userEmail,
+      note: body.note,
+      override: body.override && isAdmin
+    });
+    return c.json({ review: request });
+  } catch (err) {
+    return c.json({ error: err.message }, 403);
+  }
+});
+governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  if (!body.note) {
+    throw new ValidationError("Rejection note is required");
+  }
+  const userEmail = getUserEmail3(c);
+  try {
+    const request = reject({
+      nestId,
+      nodeId,
+      version: getCurrentVersion(nestId, nodeId),
+      rejectedBy: userEmail,
+      note: body.note
+    });
+    return c.json({ review: request });
+  } catch (err) {
+    return c.json({ error: err.message }, 403);
+  }
+});
+governanceNodeRoutes.get("/:nodeId{.+}/can-access", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userEmail = getUserEmail3(c);
+  return c.json(canUserAccess(nestId, nodeId, userEmail));
+});
+governanceNodeRoutes.get("/:nodeId{.+}/can-approve", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userEmail = getUserEmail3(c);
+  return c.json(canUserApprove(nestId, nodeId, userEmail));
+});
+governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userEmail = getUserEmail3(c);
+  return c.json(canUserEdit(nestId, nodeId, userEmail));
+});
+governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userEmail = getUserEmail3(c);
+  const request = cancelReview({
+    nestId,
+    nodeId,
+    cancelledBy: userEmail
+  });
+  return c.json({ review: request });
+});
+function getUserEmail3(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return user?.email || "anonymous@localhost";
+}
+
+// src/auth/anonymous.ts
+import bcrypt from "bcryptjs";
+var ANON_USER_ID3 = "00000000-0000-0000-0000-000000000000";
+var ANON_EMAIL = "admin@localhost";
+function ensureAnonymousUser() {
+  const db = getDb();
+  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID3);
+  if (!exists) {
+    const placeholder = bcrypt.hashSync("anon-no-login", 4);
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(ANON_USER_ID3, ANON_EMAIL, "Admin", placeholder);
+  }
+  return ANON_USER_ID3;
+}
+
+// src/auth/license.ts
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var suspensionFirstSeen = null;
+var suspensionConfirmed = false;
+var suspensionReason = null;
+var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
+function isSuspended() {
+  return suspensionConfirmed;
+}
+function getSuspensionReason() {
+  return suspensionReason;
+}
+async function validateLicense() {
+  const key = config.PROMPTOWL_KEY;
+  if (!key) {
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null
+    };
+  }
+  const db = getDb();
+  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
+  if (cached) {
+    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
+    if (age < CACHE_TTL_MS) {
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason
+      };
+    }
+  }
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ key })
+    });
+    if (!res.ok) {
+      if (cached) {
+        console.warn(
+          "  PromptOwl unreachable, using cached license (grace period)"
+        );
+        return {
+          valid: true,
+          tier: cached.tier,
+          org: cached.org,
+          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+          suspended: suspensionConfirmed,
+          suspendedReason: suspensionReason
+        };
+      }
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null
+      };
+    }
+    const data = await res.json();
+    if (data.suspended === true) {
+      if (!suspensionFirstSeen) {
+        suspensionFirstSeen = Date.now();
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.warn(
+          `
+  WARNING: PromptOwl has flagged this server for suspension.`
+        );
+        console.warn(
+          `  Reason: ${suspensionReason}`
+        );
+        console.warn(
+          `  This will be confirmed in ~1 hour. If this is an error,`
+        );
+        console.warn(
+          `  contact support@promptowl.ai to reverse it.
+`
+        );
+      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
+        suspensionConfirmed = true;
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.error(
+          `
+  SERVER SUSPENDED: ${suspensionReason}`
+        );
+        console.error(
+          `  Write operations are disabled. Reads still work.`
+        );
+        console.error(
+          `  Contact support@promptowl.ai to resolve.
+`
+        );
+      }
+    } else {
+      if (suspensionFirstSeen) {
+        console.log("  Suspension flag cleared by PromptOwl.");
+      }
+      suspensionFirstSeen = null;
+      suspensionConfirmed = false;
+      suspensionReason = null;
+    }
+    if (!data.valid && !data.suspended) {
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null
+      };
+    }
+    if (data.valid) {
+      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
+      db.prepare(
+        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, validated_at)
+         VALUES (?, ?, ?, ?, datetime('now'))`
+      ).run(key, data.tier || "community", data.org || null, limitsJson);
+    }
+    return {
+      valid: data.valid !== false,
+      tier: data.tier || "community",
+      org: data.org || null,
+      limits: data.limits || null,
+      suspended: suspensionConfirmed,
+      suspendedReason: suspensionReason
+    };
+  } catch (err) {
+    if (cached) {
+      console.warn(
+        `  PromptOwl validation failed (${err.message}), using cached license`
+      );
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason
+      };
+    }
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null
+    };
+  }
+}
+
+// src/app.ts
+import { serveStatic } from "@hono/node-server/serve-static";
+var openModeMiddleware = createMiddleware2(async (c, next) => {
+  const anonId = ensureAnonymousUser();
+  c.set("userId", anonId);
+  c.set("nestScope", null);
+  await next();
+});
+var flexAuthMiddleware = createMiddleware2(async (c, next) => {
+  const header = c.req.header("Authorization");
+  if (header?.startsWith("Bearer cnst_")) {
+    return authMiddleware(c, next);
+  }
+  if (config.AUTH_MODE === "open") {
+    const anonId = ensureAnonymousUser();
+    c.set("userId", anonId);
+    c.set("nestScope", null);
+    return next();
+  }
+  return c.json({ error: "Missing or invalid API key" }, 401);
+});
+function createApp() {
+  const app = new Hono8();
+  app.use("*", logger());
+  const corsOrigins = config.CORS_ORIGINS;
+  app.use(
+    "*",
+    corsOrigins === "*" ? cors({ origin: "*" }) : cors({ origin: corsOrigins, credentials: true })
+  );
+  app.use("*", async (c, next) => {
+    const lenStr = c.req.header("Content-Length");
+    if (lenStr) {
+      const len = parseInt(lenStr, 10);
+      if (Number.isFinite(len) && len > config.MAX_BODY_BYTES) {
+        return c.json(
+          {
+            error: `Request body too large (${len} bytes, max ${config.MAX_BODY_BYTES})`
+          },
+          413
+        );
+      }
+    }
+    return next();
+  });
+  app.get(
+    "/health",
+    (c) => c.json({
+      status: isSuspended() ? "suspended" : "ok",
+      service: "contextnest-community",
+      version: "0.1.0",
+      auth_mode: config.AUTH_MODE,
+      ...isSuspended() && { suspended_reason: getSuspensionReason() }
+    })
+  );
+  app.route("/auth", authRoutes);
+  const nestsApp = new Hono8();
+  nestsApp.use("*", flexAuthMiddleware);
+  nestsApp.use("*", async (c, next) => {
+    const localPath = c.req.path.replace(/^\/nests\//, "");
+    const parts = localPath.split("/").filter(Boolean);
+    if (parts.length < 2) return next();
+    const nestId = parts[0];
+    const userId = c.get("userId");
+    const nestScope = c.get("nestScope");
+    if (nestScope && nestScope !== nestId) {
+      return c.json({ error: "API key not authorized for this nest" }, 403);
+    }
+    if (isSuspended() && c.req.method !== "GET") {
+      return c.json(
+        {
+          error: "Server suspended by PromptOwl",
+          reason: getSuspensionReason(),
+          contact: "support@promptowl.ai"
+        },
+        503
+      );
+    }
+    if (config.AUTH_MODE === "open") {
+      c.set("nestPermission", "owner");
+      return next();
+    }
+    const permission = resolveNestPermission(nestId, userId);
+    if (permission === "none") {
+      return c.json({ error: "Nest not found" }, 404);
+    }
+    let required = "read";
+    const path = c.req.path;
+    if (path.includes("/collaborators") || path.includes("/visibility")) {
+      required = "admin";
+    } else if (c.req.method !== "GET") {
+      required = "write";
+    }
+    if (permissionLevel(permission) < permissionLevel(required)) {
+      return c.json({ error: "Insufficient permissions" }, 403);
+    }
+    c.set("nestPermission", permission);
+    return next();
+  });
+  nestsApp.route("/", nestRoutes);
+  nestsApp.route("/:nestId", governanceRoutes);
+  nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
+  nestsApp.route("/:nestId/nodes", nodeRoutes);
+  nestsApp.route("/:nestId", queryRoutes);
+  nestsApp.route("/:nestId", sharingRoutes);
+  nestsApp.route("/:nestId/mcp", mcpRoutes);
+  app.route("/nests", nestsApp);
+  app.use("/assets/*", serveStatic({ root: "./dist/web3" }));
+  app.get("*", serveStatic({ root: "./dist/web3", path: "index.html" }));
+  app.onError((err, c) => {
+    if (err instanceof AppError) {
+      return c.json({ error: err.message }, err.statusCode);
+    }
+    console.error("Unhandled error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
+  return app;
+}
+
+// src/index.ts
+async function main() {
+  getDb();
+  const accessCfg = loadAccessConfig();
+  if (accessCfg) {
+    console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);
+  }
+  const license = await validateLicense();
+  if (!license.valid) {
+    console.warn(`
+  WARNING: No valid PromptOwl license key found.
+  The server will run, but some features may be limited.
+
+  To register:
+    1. Sign up at https://app.promptowl.ai
+    2. Go to Settings > License Keys
+    3. Create a Community Server key
+    4. Set PROMPTOWL_KEY=pk_... in your environment
+`);
+  }
+  const app = createApp();
+  startTelemetryLoop();
+  trackEvent("server.start", {
+    tier: license.tier,
+    org: license.org,
+    licensed: license.valid
+  });
+  const authDesc = config.AUTH_MODE === "open" ? "open (no auth \u2014 single-user / LAN only)" : "key (API key required on every request)";
+  console.log(`
+  ContextNest Community Server v0.1.0
+  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  Port:      ${config.PORT}
+  Data:      ${config.DATA_ROOT}
+  License:   ${license.valid ? `${license.tier}${license.org ? ` (${license.org})` : ""}` : "unlicensed (register at promptowl.ai)"}
+  Auth:      ${authDesc}
+  Telemetry: ${config.TELEMETRY_ENABLED ? "on" : "off"}
+  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+  To switch auth modes, set the AUTH_MODE env var:
+    AUTH_MODE=key    \u2014 default, safe for public/multi-user deployments
+    AUTH_MODE=open   \u2014 no auth, local/single-user only
+
+  Full reference: apps/community-server/CONFIGURATION.md
+
+  Ready! Endpoints:
+    GET  /nests                  List nests
+    POST /nests                  Create nest
+    GET  /nests/:id/nodes        List nodes
+    POST /nests/:id/nodes        Create node
+    POST /nests/:id/query        Selector query
+    POST /nests/:id/context      One-call context retrieval
+    GET  /nests/:id/search?q=    Full-text search
+    POST /nests/:id/publish      Bulk publish
+    POST /nests/:id/mcp          MCP endpoint
+    GET  /health                 Health check
+${config.AUTH_MODE === "key" ? `
+  Auth endpoints:
+    POST /auth/register          Create account
+    POST /auth/login             Login
+    POST /auth/device            PromptOwl device auth
+    POST /auth/promptowl         Exchange PromptOwl token
+` : ""}`);
+  if (config.AUTH_MODE === "open") {
+    console.warn(`
+  \u26A0\uFE0F  Running in open mode \u2014 no authentication.
+     Anyone who can reach this port has full read/write + admin access.
+     Bind to 127.0.0.1 only, or switch to AUTH_MODE=key before exposing.
+`);
+  }
+  serve({ fetch: app.fetch, port: config.PORT });
+}
+main().catch((err) => {
+  console.error("Fatal:", err);
+  process.exit(1);
+});