@promptowl/contextnest-community 0.1.0-alpha.2 → 1.0.0

package/dist/index.js

@@ -12,17 +12,19 @@ import {
   createVersion,
   getApprovedVersion,
   getCurrentVersion,
+  getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-P6NG56CO.js";
+} from "./chunk-BLOPZDPL.js";
 import {
   approve,
   cancelReview,
+  getPendingReview,
   getReviewHistory,
   getReviewQueue,
   reject,
   submitForReview
-} from "./chunk-DJFEV4ET.js";
+} from "./chunk-XDCW4HTW.js";
 import {
   assignSteward,
   canUserAccess,
@@ -37,11 +39,11 @@ import {
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   syncFromConfig
-} from "./chunk-Q2DCOS7V.js";
+} from "./chunk-2FXVMVZJ.js";
 import {
   config,
   getDb
-} from "./chunk-USIDOGVJ.js";
+} from "./chunk-2TW25QEA.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -49,7 +51,6 @@ import { serve } from "@hono/node-server";
 // src/app.ts
 import { Hono as Hono8 } from "hono";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
-import { logger } from "hono/logger";
 import { cors } from "hono/cors";
 
 // src/auth/routes.ts
@@ -58,23 +59,113 @@ import { v4 as uuid } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
-var authMiddleware = createMiddleware(async (c, next) => {
-  const key = parseBearerToken(c.req.header("Authorization"));
-  if (!key) {
-    return c.json({ error: "Missing or invalid API key" }, 401);
-  }
-  const keyHash = hashApiKey(key);
+
+// src/auth/sessions.ts
+import { randomBytes } from "crypto";
+var SESSION_COOKIE = "cnst_session";
+var SESSION_TTL_DAYS = 30;
+var SESSION_TTL_SECS = SESSION_TTL_DAYS * 24 * 60 * 60;
+function newSessionId() {
+  return randomBytes(32).toString("hex");
+}
+function expiryIso(ttlSeconds = SESSION_TTL_SECS) {
+  return new Date(Date.now() + ttlSeconds * 1e3).toISOString();
+}
+function createSession(userId, userAgent) {
+  const db = getDb();
+  const id = newSessionId();
+  db.prepare(
+    `INSERT INTO sessions (id, user_id, expires_at, user_agent)
+     VALUES (?, ?, ?, ?)`
+  ).run(id, userId, expiryIso(), userAgent || null);
+  return id;
+}
+function resolveSession(id) {
   const db = getDb();
-  const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
-  if (!record) {
-    return c.json({ error: "Invalid API key" }, 401);
+  const row = db.prepare(
+    `SELECT user_id, expires_at FROM sessions WHERE id = ?`
+  ).get(id);
+  if (!row) return null;
+  if (new Date(row.expires_at).getTime() <= Date.now()) {
+    db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+    return null;
   }
   db.prepare(
-    "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
-  ).run(keyHash);
-  c.set("userId", record.user_id);
-  c.set("nestScope", record.nest_id);
-  await next();
+    "UPDATE sessions SET last_seen_at = datetime('now') WHERE id = ?"
+  ).run(id);
+  return row.user_id;
+}
+function deleteSession(id) {
+  const db = getDb();
+  db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+}
+function deleteAllSessionsForUser(userId) {
+  const db = getDb();
+  db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+}
+function getSessionIdFromRequest(c) {
+  const cookieHeader = c.req.header("Cookie");
+  if (!cookieHeader) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === SESSION_COOKIE) {
+      const v = rest.join("=").trim();
+      return /^[0-9a-f]{64}$/.test(v) ? v : null;
+    }
+  }
+  return null;
+}
+function buildSessionCookie(id, opts = {}) {
+  const maxAge = opts.maxAgeSeconds ?? SESSION_TTL_SECS;
+  const parts = [
+    `${SESSION_COOKIE}=${id}`,
+    "HttpOnly",
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAge}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function buildClearSessionCookie(opts = {}) {
+  return buildSessionCookie("", { secure: opts.secure, maxAgeSeconds: 0 });
+}
+function isSecureRequest(c) {
+  const proto = c.req.header("x-forwarded-proto");
+  if (proto) return proto.split(",")[0].trim() === "https";
+  try {
+    return new URL(c.req.url).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// src/auth/middleware.ts
+var authMiddleware = createMiddleware(async (c, next) => {
+  const db = getDb();
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) {
+    const userId = resolveSession(sessionId);
+    if (userId) {
+      c.set("userId", userId);
+      c.set("nestScope", null);
+      return next();
+    }
+  }
+  const key = parseBearerToken(c.req.header("Authorization"));
+  if (key) {
+    const keyHash = hashApiKey(key);
+    const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
+    if (record) {
+      db.prepare(
+        "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
+      ).run(keyHash);
+      c.set("userId", record.user_id);
+      c.set("nestScope", record.nest_id);
+      return next();
+    }
+  }
+  return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
 // src/shared/errors.ts
@@ -84,6 +175,7 @@ var AppError = class extends Error {
     this.statusCode = statusCode;
     this.name = "AppError";
   }
+  statusCode;
 };
 var NotFoundError = class extends AppError {
   constructor(message = "Not found") {
@@ -97,6 +189,12 @@ var ValidationError = class extends AppError {
     this.name = "ValidationError";
   }
 };
+var ConflictError = class extends AppError {
+  constructor(message) {
+    super(409, message);
+    this.name = "ConflictError";
+  }
+};
 
 // src/telemetry/tracker.ts
 function trackEvent(event, data) {
@@ -154,6 +252,338 @@ function startTelemetryLoop() {
   );
 }
 
+// src/auth/license.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+var currentLicense = null;
+function getCurrentLicense() {
+  return currentLicense;
+}
+function isLicenseAdminEmail(email) {
+  if (!email) return false;
+  const lic = currentLicense;
+  if (!lic?.valid || !lic.ownerEmail) return false;
+  return lic.ownerEmail.toLowerCase() === email.toLowerCase();
+}
+function isLicenseAdminUserId(userId) {
+  try {
+    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
+    return isLicenseAdminEmail(row?.email);
+  } catch {
+    return false;
+  }
+}
+function upsertEnvVar(filePath, varName, value) {
+  const prefix = `${varName}=`;
+  let lines = [];
+  if (existsSync(filePath)) {
+    lines = readFileSync(filePath, "utf8").split(/\r?\n/);
+  }
+  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
+  if (value !== null) {
+    filtered.push(`${prefix}${value}`);
+  }
+  while (filtered.length && filtered[filtered.length - 1] === "") {
+    filtered.pop();
+  }
+  writeFileSync(filePath, filtered.join("\n") + "\n", "utf8");
+}
+async function installLicenseKey(key) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith("pk_")) {
+    throw new Error("Invalid license key format. Must start with pk_.");
+  }
+  const previousKey = process.env.PROMPTOWL_KEY || "";
+  process.env.PROMPTOWL_KEY = trimmed;
+  const info = await validateLicense({ forceFresh: true });
+  if (!info.valid) {
+    process.env.PROMPTOWL_KEY = previousKey;
+    if (previousKey) {
+      await validateLicense({ forceFresh: true });
+    }
+    return info;
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+  } catch (err) {
+    console.warn("[license] failed to write .env:", err);
+  }
+  startLicenseWatcher();
+  return info;
+}
+var watcherActive = false;
+var watcherAbort = null;
+var WATCHER_BACKOFF_MIN_MS = 2 * 1e3;
+var WATCHER_BACKOFF_MAX_MS = 60 * 1e3;
+function startLicenseWatcher() {
+  if (watcherActive) {
+    watcherAbort?.abort();
+    return;
+  }
+  watcherActive = true;
+  void runLicenseWatcher();
+}
+async function runLicenseWatcher() {
+  let backoff = WATCHER_BACKOFF_MIN_MS;
+  while (watcherActive) {
+    const key = config.PROMPTOWL_KEY;
+    if (!key) {
+      await sleep(WATCHER_BACKOFF_MAX_MS);
+      continue;
+    }
+    try {
+      watcherAbort = new AbortController();
+      const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+      const res = await fetch(`${promptowlUrl}/api/license/listen`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          key,
+          since_updated_at: currentLicense ? (/* @__PURE__ */ new Date()).toISOString() : void 0
+        }),
+        signal: watcherAbort.signal
+      });
+      if (!res.ok) {
+        throw new Error(`listen returned ${res.status}`);
+      }
+      const data = await res.json();
+      backoff = WATCHER_BACKOFF_MIN_MS;
+      if (data.event && data.event !== "no_change") {
+        console.log(
+          `[license] event from PromptOwl: ${data.event} \u2014 revalidating`
+        );
+        const wasValid = !!currentLicense?.valid;
+        await validateLicense({ forceFresh: true });
+        const isValid = !!currentLicense?.valid;
+        if (wasValid && !isValid) {
+          handleLicenseRevoked();
+        }
+      }
+    } catch (err) {
+      if (err.name === "AbortError") {
+        continue;
+      }
+      console.warn(
+        `[license] watcher error: ${err.message}; backing off ${backoff}ms`
+      );
+      await sleep(backoff);
+      backoff = Math.min(backoff * 2, WATCHER_BACKOFF_MAX_MS);
+    } finally {
+      watcherAbort = null;
+    }
+  }
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function handleLicenseRevoked() {
+  try {
+    const db = getDb();
+    const result = db.prepare("DELETE FROM sessions").run();
+    console.warn(
+      `[license] revoked \u2014 wiped ${result.changes} active session(s).`
+    );
+  } catch (err) {
+    console.warn("[license] failed to wipe sessions:", err);
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
+    console.warn(
+      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
+    );
+  } catch (err) {
+    console.warn("[license] failed to strip key from .env:", err);
+  }
+  process.env.PROMPTOWL_KEY = "";
+  currentLicense = {
+    valid: false,
+    tier: "none",
+    org: null,
+    limits: null,
+    suspended: false,
+    suspendedReason: null,
+    ownerEmail: null
+  };
+}
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var suspensionFirstSeen = null;
+var suspensionConfirmed = false;
+var suspensionReason = null;
+var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
+function isSuspended() {
+  return suspensionConfirmed;
+}
+function getSuspensionReason() {
+  return suspensionReason;
+}
+async function validateLicense(opts = {}) {
+  const info = await _validateLicenseImpl(!!opts.forceFresh);
+  currentLicense = info;
+  return info;
+}
+async function _validateLicenseImpl(forceFresh) {
+  const key = config.PROMPTOWL_KEY;
+  if (!key) {
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+  const db = getDb();
+  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
+  if (cached && !forceFresh) {
+    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
+    if (age < CACHE_TTL_MS) {
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+  }
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ key })
+    });
+    if (!res.ok) {
+      if (cached) {
+        console.warn(
+          "  PromptOwl unreachable, using cached license (grace period)"
+        );
+        return {
+          valid: true,
+          tier: cached.tier,
+          org: cached.org,
+          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+          suspended: suspensionConfirmed,
+          suspendedReason: suspensionReason,
+          ownerEmail: cached.owner_email || null
+        };
+      }
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: null
+      };
+    }
+    const data = await res.json();
+    if (data.suspended === true) {
+      if (!suspensionFirstSeen) {
+        suspensionFirstSeen = Date.now();
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.warn(
+          `
+  WARNING: PromptOwl has flagged this server for suspension.`
+        );
+        console.warn(
+          `  Reason: ${suspensionReason}`
+        );
+        console.warn(
+          `  This will be confirmed in ~1 hour. If this is an error,`
+        );
+        console.warn(
+          `  contact support@promptowl.ai to reverse it.
+`
+        );
+      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
+        suspensionConfirmed = true;
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.error(
+          `
+  SERVER SUSPENDED: ${suspensionReason}`
+        );
+        console.error(
+          `  Write operations are disabled. Reads still work.`
+        );
+        console.error(
+          `  Contact support@promptowl.ai to resolve.
+`
+        );
+      }
+    } else {
+      if (suspensionFirstSeen) {
+        console.log("  Suspension flag cleared by PromptOwl.");
+      }
+      suspensionFirstSeen = null;
+      suspensionConfirmed = false;
+      suspensionReason = null;
+    }
+    if (!data.valid && !data.suspended) {
+      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: data.owner_email || null
+      };
+    }
+    if (data.valid) {
+      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
+      db.prepare(
+        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
+         VALUES (?, ?, ?, ?, ?, datetime('now'))`
+      ).run(
+        key,
+        data.tier || "community",
+        data.org || null,
+        limitsJson,
+        data.owner_email || null
+      );
+    }
+    return {
+      valid: data.valid !== false,
+      tier: data.tier || "community",
+      org: data.org || null,
+      limits: data.limits || null,
+      suspended: suspensionConfirmed,
+      suspendedReason: suspensionReason,
+      ownerEmail: data.owner_email || null
+    };
+  } catch (err) {
+    if (cached) {
+      console.warn(
+        `  PromptOwl validation failed (${err.message}), using cached license`
+      );
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+}
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function tryConsume(key, cfg) {
@@ -185,6 +615,32 @@ function clientIp(c) {
   if (realIp) return realIp.trim();
   return "unknown";
 }
+function resolveCallerUserId(c) {
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) {
+    const uid = resolveSession(sessionId);
+    if (uid) return uid;
+  }
+  const key = parseBearerToken(c.req.header("Authorization"));
+  if (key) {
+    const db = getDb();
+    const row = db.prepare("SELECT user_id FROM api_keys WHERE key_hash = ?").get(hashApiKey(key));
+    if (row) return row.user_id;
+  }
+  return null;
+}
+function setSessionCookie(c, sessionId) {
+  c.header(
+    "Set-Cookie",
+    buildSessionCookie(sessionId, { secure: isSecureRequest(c) })
+  );
+}
+function clearSessionCookie(c) {
+  c.header(
+    "Set-Cookie",
+    buildClearSessionCookie({ secure: isSecureRequest(c) })
+  );
+}
 var authRoutes = new Hono();
 authRoutes.post("/register", async (c) => {
   const body = await c.req.json();
@@ -196,25 +652,34 @@ authRoutes.post("/register", async (c) => {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
-  if (existing) {
+  const existing = db.prepare("SELECT id, is_invited FROM users WHERE email = ?").get(body.email);
+  let userId;
+  const passwordHash = await hashPassword(body.password);
+  if (existing && existing.is_invited === 1) {
+    userId = existing.id;
+    db.prepare(
+      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
+    ).run(passwordHash, body.name || null, userId);
+    trackEvent("user.register", { userId, email: body.email, claimed: true });
+  } else if (existing) {
     throw new ValidationError("Email already registered");
+  } else {
+    userId = uuid();
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, body.email, body.name || null, passwordHash);
+    trackEvent("user.register", { userId, email: body.email });
   }
-  const userId = uuid();
-  const passwordHash = await hashPassword(body.password);
-  db.prepare(
-    "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-  ).run(userId, body.email, body.name || null, passwordHash);
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(keyId, userId, hashApiKey(apiKey), getKeyPrefix(apiKey), "default");
-  trackEvent("user.register", { userId, email: body.email });
+  const sessionId = createSession(userId, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
   return c.json(
     {
-      user: { id: userId, email: body.email, name: body.name || null },
-      api_key: apiKey
+      user: {
+        id: userId,
+        email: body.email,
+        name: body.name || null,
+        is_admin: isLicenseAdminEmail(body.email)
+      }
     },
     201
   );
@@ -231,7 +696,7 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = db.prepare(
-    "SELECT id, email, name, password_hash FROM users WHERE email = ?"
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE email = ?"
   ).get(body.email);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
@@ -247,30 +712,47 @@ authRoutes.post("/login", async (c) => {
     } catch {
     }
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    user.id,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    body.label || "login"
-  );
   trackEvent("user.login", { userId: user.id });
-  return c.json({ api_key: apiKey });
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
+  return c.json({
+    user: {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      is_admin: isLicenseAdminEmail(user.email)
+    }
+  });
+});
+authRoutes.post("/logout", async (c) => {
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) deleteSession(sessionId);
+  clearSessionCookie(c);
+  return c.json({ ok: true });
 });
 authRoutes.post("/keys", authMiddleware, async (c) => {
-  const body = await c.req.json();
+  const body = await c.req.json().catch(
+    () => ({})
+  );
   const db = getDb();
+  const userId = c.get("userId");
+  const existing = db.prepare("SELECT key_prefix FROM api_keys WHERE user_id = ?").get(userId);
+  if (existing) {
+    return c.json(
+      {
+        error: "An API key already exists for this user. Rotate it instead.",
+        key_prefix: existing.key_prefix
+      },
+      409
+    );
+  }
   const apiKey = generateApiKey();
   const keyId = uuid();
   db.prepare(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
   ).run(
     keyId,
-    c.get("userId"),
+    userId,
     hashApiKey(apiKey),
     getKeyPrefix(apiKey),
     body.nest_id || null,
@@ -281,6 +763,30 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     201
   );
 });
+authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
+  const body = await c.req.json().catch(
+    () => ({})
+  );
+  const db = getDb();
+  const userId = c.get("userId");
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  const prior = db.prepare("SELECT label, nest_id FROM api_keys WHERE user_id = ?").get(userId);
+  db.transaction(() => {
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(userId);
+    db.prepare(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
+    ).run(
+      keyId,
+      userId,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.nest_id ?? prior?.nest_id ?? null,
+      body.label ?? prior?.label ?? null
+    );
+  })();
+  return c.json({ api_key: apiKey, key_prefix: getKeyPrefix(apiKey) });
+});
 authRoutes.get("/keys", authMiddleware, async (c) => {
   const db = getDb();
   const keys = db.prepare(
@@ -370,97 +876,127 @@ authRoutes.post("/promptowl", async (c) => {
   } else {
     trackEvent("user.login", { userId: user.id, method: "promptowl" });
   }
+  let claimBlocked = null;
+  const lic = getCurrentLicense();
   let isAdmin = false;
-  const claim = db.transaction((userId) => {
-    const result = db.prepare(
-      `UPDATE users SET is_admin = 1
-         WHERE id = ?
-           AND NOT EXISTS (SELECT 1 FROM users WHERE is_admin = 1)`
-    ).run(userId);
-    return result.changes > 0;
-  });
-  if (claim(user.id)) {
+  if (!lic?.valid) {
+    claimBlocked = { reason: "license_required" };
+  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === me.email.toLowerCase()) {
     isAdmin = true;
     trackEvent("admin.claim", { userId: user.id, email: user.email });
   } else {
-    const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(user.id);
-    isAdmin = !!userRow?.is_admin;
+    claimBlocked = {
+      reason: "email_mismatch",
+      license_owner_email: lic.ownerEmail
+    };
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    user.id,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    "promptowl"
-  );
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
   return c.json({
-    api_key: apiKey,
     user: {
       id: user.id,
       email: user.email,
       name: user.name,
       is_admin: isAdmin
-    }
+    },
+    ...claimBlocked ? { claim_blocked: claimBlocked } : {}
   });
 });
 authRoutes.get("/admin-status", async (c) => {
   const db = getDb();
-  const admin = db.prepare("SELECT email, name FROM users WHERE is_admin = 1 LIMIT 1").get();
-  const callerKey = parseBearerToken(c.req.header("Authorization"));
+  const lic = getCurrentLicense();
+  const ownerEmail = lic?.valid ? lic.ownerEmail : null;
+  let admin = null;
+  if (ownerEmail) {
+    const ownerRow = db.prepare("SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1").get(ownerEmail);
+    admin = { email: ownerEmail, name: ownerRow?.name ?? null };
+  }
+  const callerId = resolveCallerUserId(c);
   let me = null;
-  if (callerKey) {
-    const keyHash = hashApiKey(callerKey);
-    const row = db.prepare(
-      `SELECT u.email, u.is_admin FROM api_keys k
-         JOIN users u ON u.id = k.user_id
-         WHERE k.key_hash = ?`
-    ).get(keyHash);
+  if (callerId) {
+    const row = db.prepare("SELECT email, name FROM users WHERE id = ?").get(callerId);
     if (row) {
-      me = { email: row.email, is_admin: !!row.is_admin };
+      me = {
+        email: row.email,
+        name: row.name,
+        is_admin: isLicenseAdminEmail(row.email)
+      };
     }
   }
   return c.json({
     claimed: !!admin,
-    admin: admin ? { email: admin.email, name: admin.name } : null,
+    admin,
     me
   });
 });
+authRoutes.post("/password", authMiddleware, async (c) => {
+  const body = await c.req.json();
+  if (!body.current || !body.next) {
+    throw new ValidationError("current and next are required");
+  }
+  if (body.next.length < 8) {
+    throw new ValidationError("new password must be at least 8 characters");
+  }
+  const db = getDb();
+  const userId = c.get("userId");
+  const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
+  if (!user) return c.json({ error: "User not found" }, 404);
+  const check = await verifyPassword(body.current, user.password_hash);
+  if (!check.ok) return c.json({ error: "Invalid current password" }, 401);
+  const newHash = await hashPassword(body.next);
+  db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+    newHash,
+    userId
+  );
+  deleteAllSessionsForUser(userId);
+  clearSessionCookie(c);
+  return c.json({ ok: true });
+});
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
-  const inviteKey = parseBearerToken(c.req.header("Authorization"));
-  if (!inviteKey) {
-    return c.json({ error: "Admin authentication required" }, 401);
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json(
+      {
+        error: "Authentication required. Sign in with the admin account that owns the installed PromptOwl license to invite teammates."
+      },
+      401
+    );
   }
   const db = getDb();
-  const keyHash = hashApiKey(inviteKey);
-  const caller = db.prepare(
-    `SELECT u.id, u.is_admin FROM api_keys k
-       JOIN users u ON u.id = k.user_id
-       WHERE k.key_hash = ?`
-  ).get(keyHash);
-  if (!caller || !caller.is_admin) {
-    return c.json({ error: "Admin only" }, 403);
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      {
+        error: "Only the license-admin user can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
+      },
+      403
+    );
   }
   let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
     ).run(userId, body.email, null, placeholderHash);
     user = { id: userId, email: body.email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(keyId, user.id, hashApiKey(apiKey), getKeyPrefix(apiKey), body.label || "teammate");
-  trackEvent("admin.invite", { adminId: caller.id, email: body.email });
+  db.transaction(() => {
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(user.id);
+    db.prepare(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+    ).run(
+      keyId,
+      user.id,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.label || "teammate"
+    );
+  })();
+  trackEvent("admin.invite", { adminId: callerId, email: body.email });
   return c.json(
     {
       api_key: apiKey,
@@ -471,27 +1007,31 @@ authRoutes.post("/invite", async (c) => {
   );
 });
 authRoutes.get("/teammates", async (c) => {
-  const teammatesKey = parseBearerToken(c.req.header("Authorization"));
-  if (!teammatesKey) {
-    return c.json({ error: "Admin authentication required" }, 401);
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json(
+      {
+        error: "Authentication required. Sign in with the admin account that owns the installed PromptOwl license to view teammates."
+      },
+      401
+    );
   }
   const db = getDb();
-  const keyHash = hashApiKey(teammatesKey);
-  const caller = db.prepare(
-    `SELECT u.is_admin FROM api_keys k
-       JOIN users u ON u.id = k.user_id
-       WHERE k.key_hash = ?`
-  ).get(keyHash);
-  if (!caller || !caller.is_admin) {
-    return c.json({ error: "Admin only" }, 403);
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      {
+        error: "Only the license-admin user can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
+      },
+      403
+    );
   }
   const teammates = db.prepare(
-    `SELECT u.id, u.email, u.name, u.is_admin,
+    `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
        WHERE u.id != '00000000-0000-0000-0000-000000000000'
-       ORDER BY u.is_admin DESC, u.created_at DESC`
+       ORDER BY u.created_at DESC`
   ).all();
   const pendingStewards = db.prepare(
     `SELECT DISTINCT s.user_email AS email
@@ -504,11 +1044,9 @@ authRoutes.get("/teammates", async (c) => {
           )
         ORDER BY s.user_email`
   ).all();
+  const enriched = teammates.map((t) => ({ ...t, is_admin: isLicenseAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
   return c.json({
-    teammates: teammates.map((t) => ({
-      ...t,
-      is_admin: !!t.is_admin
-    })),
+    teammates: enriched,
     pending_stewards: pendingStewards.map((p) => p.email)
   });
 });
@@ -668,12 +1206,15 @@ nestRoutes.get("/:nestId/settings", async (c) => {
 nestRoutes.patch("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const db = getDb();
-  const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(userId);
-  const isServerAdmin = !!userRow?.is_admin;
+  const isServerAdmin = isLicenseAdminUserId(userId);
   const permission = effectivePermission(nestId, userId);
   if (!isServerAdmin && permission !== "owner") {
-    return c.json({ error: "Admin only" }, 403);
+    return c.json(
+      {
+        error: "Only the nest owner or the server license-admin can update nest settings."
+      },
+      403
+    );
   }
   const body = await c.req.json();
   if (typeof body.stewardship_enabled === "boolean") {
@@ -711,7 +1252,7 @@ sharingRoutes.post("/collaborators", async (c) => {
       const { hashPassword: hashPassword2 } = await import("./keys-YV33AJK3.js");
       userId = uuid3();
       db.prepare(
-        "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
       ).run(userId, body.email, null, await hashPassword2(uuid3()));
     } else {
       userId = user.id;
@@ -771,7 +1312,11 @@ import { serializeDocument } from "@promptowl/contextnest-engine";
 
 // src/nodes/engine.ts
 import { join as join2 } from "path";
-import { NestStorage as NestStorage2, GraphQueryEngine } from "@promptowl/contextnest-engine";
+import {
+  NestStorage as NestStorage2,
+  GraphQueryEngine,
+  VersionManager
+} from "@promptowl/contextnest-engine";
 var NestEngineCache = class {
   cache = /* @__PURE__ */ new Map();
   get(nestId) {
@@ -780,7 +1325,8 @@ var NestEngineCache = class {
       const nestPath2 = join2(config.DATA_ROOT, "nests", nestId);
       const storage = new NestStorage2(nestPath2);
       const query = new GraphQueryEngine(storage);
-      engine = { storage, query };
+      const versions = new VersionManager(storage);
+      engine = { storage, query, versions };
       this.cache.set(nestId, engine);
     }
     return engine;
@@ -845,6 +1391,9 @@ function toNodeResponse(node) {
     title: node.frontmatter.title,
     type: node.frontmatter.type || "document",
     tags: node.frontmatter.tags || [],
+    // Widen to string so callers can layer review-workflow states like
+    // "pending_review" / "rejected" on top of the on-disk frontmatter
+    // status. The engine's Status enum only knows draft/approved.
     status: node.frontmatter.status || "draft",
     version: node.frontmatter.version || 1,
     author: node.frontmatter.author,
@@ -862,7 +1411,11 @@ nodeRoutes.get("/", async (c) => {
   const accessible = filterAccessible(nestId, userEmail, documents);
   return c.json({
     count: accessible.length,
-    nodes: accessible.map(toNodeResponse)
+    nodes: accessible.map((doc) => {
+      const r = toNodeResponse(doc);
+      r.status = getDisplayStatus(nestId, r.id);
+      return r;
+    })
   });
 });
 nodeRoutes.post("/", async (c) => {
@@ -871,7 +1424,7 @@ nodeRoutes.post("/", async (c) => {
     throw new ValidationError("title and content are required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = engineCache.get(nestId);
   const slug = body.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   const id = `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -901,6 +1454,11 @@ nodeRoutes.post("/", async (c) => {
   await storage.writeDocument(id, serialized);
   syncNodeTags(nestId, id, tags);
   const authorEmail = getUserEmail(c);
+  try {
+    await versionManager.createVersion(node, authorEmail);
+  } catch (err) {
+    console.error("VersionManager.createVersion failed (node create)", err);
+  }
   createVersion({
     nestId,
     nodeId: id,
@@ -927,7 +1485,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-NC67XBYO.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZJATH6OM.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -949,11 +1507,30 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-Z6FYJRAG.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-2MZJGE3H.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
+  const db = getDb();
+  const resolutions = db.prepare(
+    `SELECT version, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ? AND node_id = ?
+          AND status IN ('approved', 'rejected')
+          AND resolved_by IS NOT NULL
+        ORDER BY resolved_at DESC`
+  ).all(nestId, nodeId);
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const r of resolutions) {
+    if (!byVersion.has(r.version)) {
+      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+    }
+  }
+  const enriched = allVersions.map((v) => {
+    const r = byVersion.get(v.version);
+    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
+  });
   return c.json({
-    versions: allVersions,
+    versions: enriched,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
@@ -961,7 +1538,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-5CLVZKAR.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2JHZHZWJ.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -976,17 +1553,20 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       403
     );
   }
+  let node;
   try {
-    const node = await storage.readDocument(nodeId);
-    return c.json({ node: toNodeResponse(node) });
+    node = await storage.readDocument(nodeId);
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
+  const response = toNodeResponse(node);
+  response.status = getDisplayStatus(nestId, nodeId);
+  return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = engineCache.get(nestId);
   const body = await c.req.json();
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
@@ -1055,6 +1635,13 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const hasStewards = isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
   syncNodeTags(nestId, nodeId, currentTags);
+  try {
+    await versionManager.createVersion(node, authorEmail, {
+      note: body.changeNote
+    });
+  } catch (err) {
+    console.error("VersionManager.createVersion failed (node patch)", err);
+  }
   createVersion({
     nestId,
     nodeId,
@@ -1065,6 +1652,10 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
     tags: currentTags,
     changeNote: body.changeNote
   });
+  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-2JHZHZWJ.js");
+  if (getPendingReview2(nestId, nodeId)) {
+    cancelReview2({ nestId, nodeId, cancelledBy: authorEmail });
+  }
   if (!hasStewards) {
     setApprovedVersion(nestId, nodeId, newVersion, authorEmail);
   }
@@ -1080,6 +1671,18 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
   removeNodeFromTagIndex(nestId, nodeId);
+  const db = getDb();
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    db.prepare(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    db.prepare(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+  })();
   trackEvent("node.delete", { nestId, nodeId });
   return c.json({ deleted: true });
 });
@@ -1756,8 +2359,19 @@ var TOOL_DEFINITIONS = [
     }
   }
 ];
+async function resolveLlmBody(ctx, node) {
+  if (!isStewardshipEnabled(ctx.nestId)) return node.body || "";
+  const approved = getApprovedVersion(ctx.nestId, node.id);
+  if (approved == null) return null;
+  try {
+    return await ctx.versionManager.reconstructVersion(node.id, approved);
+  } catch (err) {
+    console.error("reconstructVersion failed", node.id, approved, err);
+    return null;
+  }
+}
 async function handleToolCall(toolName, args, ctx) {
-  const { storage, queryEngine, nestId, userEmail } = ctx;
+  const { storage, queryEngine, versionManager, nestId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
       const content = await storage.readContextMd();
@@ -1798,14 +2412,23 @@ ${nodeList}`;
     case "context_search": {
       const docs = await storage.discoverDocuments();
       const terms = (args.query || "").toLowerCase().split(/\s+/).filter(Boolean);
-      const matches = docs.filter((n) => {
-        const hay = [n.frontmatter.title, n.body || "", n.frontmatter.type || "", ...n.frontmatter.tags || []].join(" ").toLowerCase();
+      const enriched = await Promise.all(
+        docs.map(async (n) => ({ node: n, body: await resolveLlmBody(ctx, n) }))
+      );
+      const visible = enriched.filter((e) => e.body !== null);
+      const matches = visible.filter(({ node: n, body }) => {
+        const hay = [
+          n.frontmatter.title,
+          body || "",
+          n.frontmatter.type || "",
+          ...n.frontmatter.tags || []
+        ].join(" ").toLowerCase();
         return terms.every((t) => hay.includes(t));
       });
       if (!matches.length) return `No nodes matched search: "${args.query}"`;
       const results = matches.map(
-        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}
-   ${(n.body || "").slice(0, 200).replace(/\n/g, " ")}`
+        ({ node: n, body }, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}
+   ${(body || "").slice(0, 200).replace(/\n/g, " ")}`
       ).join("\n\n");
       return `Found ${matches.length} node(s) matching "${args.query}":
 
@@ -1833,6 +2456,10 @@ ${list}`;
         node = docs.find((n) => n.id === args.id);
       }
       if (!node) return `Node not found: ${args.title || args.id}`;
+      const body = await resolveLlmBody(ctx, node);
+      if (body === null) {
+        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      }
       const meta = [
         `**Title:** ${node.frontmatter.title}`,
         `**Type:** ${node.frontmatter.type || "document"}`,
@@ -1842,7 +2469,7 @@ ${list}`;
 
 ---
 
-${node.body || "(no content)"}`;
+${body || "(no content)"}`;
     }
     case "context_list": {
       let docs = await storage.discoverDocuments();
@@ -1852,6 +2479,11 @@ ${node.body || "(no content)"}`;
         const tag = args.tag.startsWith("#") ? args.tag : `#${args.tag}`;
         docs = docs.filter((n) => n.frontmatter.tags?.includes(tag));
       }
+      if (isStewardshipEnabled(nestId)) {
+        docs = docs.filter(
+          (n) => getApprovedVersion(nestId, n.id) != null
+        );
+      }
       docs = docs.slice(0, args.limit || 50);
       if (!docs.length) return "No nodes found with the given filters.";
       const list = docs.map(
@@ -1904,6 +2536,11 @@ ${n.body || ""}`;
       };
       await storage.writeDocument(id, serializeDocument3(node));
       syncNodeTags(nestId, id, tags);
+      try {
+        await versionManager.createVersion(node, userEmail);
+      } catch (err) {
+        console.error("VersionManager.createVersion failed (mcp create)", err);
+      }
       createVersion({
         nestId,
         nodeId: id,
@@ -1934,16 +2571,45 @@ ${n.body || ""}`;
         );
         tags = [.../* @__PURE__ */ new Set([...tags, ...newTags])];
       }
+      const prevVersion = getCurrentVersion(nestId, node.id);
+      const newVersion = prevVersion + 1;
+      const hasStewards = isStewardshipEnabled(nestId);
       const updated = {
         ...node,
         body,
         frontmatter: {
           ...node.frontmatter,
           tags,
+          version: newVersion,
           updated_at: (/* @__PURE__ */ new Date()).toISOString()
         }
       };
       await storage.writeDocument(node.id, serializeDocument3(updated));
+      try {
+        await versionManager.createVersion(updated, userEmail);
+      } catch (err) {
+        console.error("VersionManager.createVersion failed (mcp update)", err);
+      }
+      syncNodeTags(nestId, node.id, tags);
+      createVersion({
+        nestId,
+        nodeId: node.id,
+        version: newVersion,
+        content: body,
+        author: userEmail,
+        status: hasStewards ? "draft" : "approved",
+        tags
+      });
+      if (getPendingReview(nestId, node.id)) {
+        cancelReview({
+          nestId,
+          nodeId: node.id,
+          cancelledBy: userEmail
+        });
+      }
+      if (!hasStewards) {
+        setApprovedVersion(nestId, node.id, newVersion, userEmail);
+      }
       return `Updated node: **${node.frontmatter.title}**`;
     }
     // ─── Governance Tool Handlers ──────────────────────────────────────
@@ -2153,6 +2819,7 @@ function createMcpServerForNest(nestId, userEmail) {
       const text = await handleToolCall(tool.name, args, {
         storage: engine.storage,
         queryEngine: engine.query,
+        versionManager: engine.versions,
         nestId,
         userEmail
       });
@@ -2184,7 +2851,7 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync, existsSync } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join3 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
@@ -2266,8 +2933,8 @@ function loadStewardsConfig(nestId) {
     join3(nestPath2, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
-    if (existsSync(candidatePath)) {
-      const content = readFileSync(candidatePath, "utf-8");
+    if (existsSync2(candidatePath)) {
+      const content = readFileSync2(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -2293,7 +2960,7 @@ governanceRoutes.post("/stewards", async (c) => {
   const assignedBy = getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
   if (Array.isArray(body.users)) {
-    const created2 = createStewardRecord({
+    const created2 = await createStewardRecord({
       nestId,
       scope: body.scope,
       documentId: body.documentId,
@@ -2307,7 +2974,7 @@ governanceRoutes.post("/stewards", async (c) => {
   if (!body.email) {
     throw new ValidationError("users[] or email is required");
   }
-  const created = createStewardRecord({
+  const created = await createStewardRecord({
     nestId,
     scope: body.scope,
     documentId: body.scope === "document" ? body.nodePattern : void 0,
@@ -2397,14 +3064,23 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     throw new ValidationError("Node has no versions to review");
   }
   const userEmail = getUserEmail3(c);
-  const request = submitForReview({
-    nestId,
-    nodeId,
-    version: currentVersion,
-    requestedBy: userEmail,
-    note: body.note,
-    priority: body.priority
-  });
+  let request;
+  try {
+    request = submitForReview({
+      nestId,
+      nodeId,
+      version: currentVersion,
+      requestedBy: userEmail,
+      note: body.note,
+      priority: body.priority
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/already pending/i.test(msg)) {
+      throw new ConflictError(msg);
+    }
+    throw err;
+  }
   const resolved = resolveStewardsForNode(nestId, nodeId);
   return c.json(
     {
@@ -2511,172 +3187,17 @@ function ensureAnonymousUser() {
   return ANON_USER_ID3;
 }
 
-// src/auth/license.ts
-var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var suspensionFirstSeen = null;
-var suspensionConfirmed = false;
-var suspensionReason = null;
-var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
-function isSuspended() {
-  return suspensionConfirmed;
-}
-function getSuspensionReason() {
-  return suspensionReason;
-}
-async function validateLicense() {
-  const key = config.PROMPTOWL_KEY;
-  if (!key) {
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null
-    };
-  }
-  const db = getDb();
-  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
-  if (cached) {
-    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
-    if (age < CACHE_TTL_MS) {
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason
-      };
-    }
-  }
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ key })
-    });
-    if (!res.ok) {
-      if (cached) {
-        console.warn(
-          "  PromptOwl unreachable, using cached license (grace period)"
-        );
-        return {
-          valid: true,
-          tier: cached.tier,
-          org: cached.org,
-          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-          suspended: suspensionConfirmed,
-          suspendedReason: suspensionReason
-        };
-      }
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null
-      };
-    }
-    const data = await res.json();
-    if (data.suspended === true) {
-      if (!suspensionFirstSeen) {
-        suspensionFirstSeen = Date.now();
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.warn(
-          `
-  WARNING: PromptOwl has flagged this server for suspension.`
-        );
-        console.warn(
-          `  Reason: ${suspensionReason}`
-        );
-        console.warn(
-          `  This will be confirmed in ~1 hour. If this is an error,`
-        );
-        console.warn(
-          `  contact support@promptowl.ai to reverse it.
-`
-        );
-      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
-        suspensionConfirmed = true;
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.error(
-          `
-  SERVER SUSPENDED: ${suspensionReason}`
-        );
-        console.error(
-          `  Write operations are disabled. Reads still work.`
-        );
-        console.error(
-          `  Contact support@promptowl.ai to resolve.
-`
-        );
-      }
-    } else {
-      if (suspensionFirstSeen) {
-        console.log("  Suspension flag cleared by PromptOwl.");
-      }
-      suspensionFirstSeen = null;
-      suspensionConfirmed = false;
-      suspensionReason = null;
-    }
-    if (!data.valid && !data.suspended) {
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null
-      };
-    }
-    if (data.valid) {
-      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
-      db.prepare(
-        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, validated_at)
-         VALUES (?, ?, ?, ?, datetime('now'))`
-      ).run(key, data.tier || "community", data.org || null, limitsJson);
-    }
-    return {
-      valid: data.valid !== false,
-      tier: data.tier || "community",
-      org: data.org || null,
-      limits: data.limits || null,
-      suspended: suspensionConfirmed,
-      suspendedReason: suspensionReason
-    };
-  } catch (err) {
-    if (cached) {
-      console.warn(
-        `  PromptOwl validation failed (${err.message}), using cached license`
-      );
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason
-      };
-    }
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null
-    };
-  }
-}
-
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
 import { dirname, join as join4, relative } from "path";
-var UI_DIR_ABS = join4(dirname(fileURLToPath(import.meta.url)), "web3");
+import { existsSync as existsSync3 } from "fs";
+var HERE = dirname(fileURLToPath(import.meta.url));
+var UI_DIR_CANDIDATES = [
+  join4(HERE, "web3"),
+  join4(process.cwd(), "dist", "web3")
+];
+var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync3(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
@@ -2685,8 +3206,9 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
   await next();
 });
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
-  const header = c.req.header("Authorization");
-  if (header?.startsWith("Bearer cnst_")) {
+  const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
+  const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
+  if (hasBearer || hasCookie) {
     return authMiddleware(c, next);
   }
   if (config.AUTH_MODE === "open") {
@@ -2695,11 +3217,10 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     c.set("nestScope", null);
     return next();
   }
-  return c.json({ error: "Missing or invalid API key" }, 401);
+  return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
   const app = new Hono8();
-  app.use("*", logger());
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -2730,7 +3251,79 @@ function createApp() {
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
+  app.use("/auth/invite", async (c, next) => {
+    if (!getCurrentLicense()?.valid) {
+      return c.json(
+        {
+          error: "License required",
+          reason: "Install a valid PromptOwl license key before inviting teammates."
+        },
+        503
+      );
+    }
+    return next();
+  });
+  app.use("/auth/teammates", async (c, next) => {
+    if (!getCurrentLicense()?.valid) {
+      return c.json(
+        {
+          error: "License required",
+          reason: "Install a valid PromptOwl license key to view teammates."
+        },
+        503
+      );
+    }
+    return next();
+  });
   app.route("/auth", authRoutes);
+  app.get("/license/status", (c) => {
+    const lic = getCurrentLicense();
+    return c.json({
+      valid: !!lic?.valid,
+      tier: lic?.tier || "none",
+      org: lic?.org || null,
+      owner_email: lic?.ownerEmail || null,
+      suspended: !!lic?.suspended,
+      suspended_reason: lic?.suspendedReason || null,
+      limits: lic?.limits || null
+    });
+  });
+  app.post("/license/install", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const key = body?.key?.trim();
+    if (!key || !key.startsWith("pk_")) {
+      return c.json(
+        { error: "Invalid license key. Must start with pk_." },
+        400
+      );
+    }
+    try {
+      const info = await installLicenseKey(key);
+      if (!info.valid) {
+        return c.json(
+          {
+            valid: false,
+            error: "License key was saved but PromptOwl rejected it. Verify the key is correct and active."
+          },
+          400
+        );
+      }
+      return c.json({
+        valid: true,
+        tier: info.tier,
+        org: info.org,
+        limits: info.limits
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Failed to install key";
+      return c.json({ error: msg }, 500);
+    }
+  });
   const nestsApp = new Hono8();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
@@ -2753,6 +3346,24 @@ function createApp() {
         503
       );
     }
+    {
+      const path2 = c.req.path;
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit");
+      const needsLicense = c.req.method !== "GET" || isGovernance;
+      if (needsLicense) {
+        const lic = getCurrentLicense();
+        if (!lic?.valid) {
+          return c.json(
+            {
+              error: "License required",
+              reason: "Install a PromptOwl license key via the setup screen or POST /license/install.",
+              setup_url: "/setup"
+            },
+            503
+          );
+        }
+      }
+    }
     if (config.AUTH_MODE === "open") {
       c.set("nestPermission", "owner");
       return next();
@@ -2763,13 +3374,21 @@ function createApp() {
     }
     let required = "read";
     const path = c.req.path;
+    const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
     if (path.includes("/collaborators") || path.includes("/visibility")) {
       required = "admin";
-    } else if (c.req.method !== "GET") {
+    } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
     if (permissionLevel(permission) < permissionLevel(required)) {
-      return c.json({ error: "Insufficient permissions" }, 403);
+      return c.json(
+        {
+          error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
+          required_permission: required,
+          your_permission: permission
+        },
+        403
+      );
     }
     c.set("nestPermission", permission);
     return next();
@@ -2788,8 +3407,74 @@ function createApp() {
     if (err instanceof AppError) {
       return c.json({ error: err.message }, err.statusCode);
     }
+    const e = err;
+    const code = e.code;
+    const msg = e.message || "";
+    if (code === "SQLITE_CONSTRAINT_UNIQUE") {
+      let friendly = "That conflicts with existing data. Please change a value and try again.";
+      if (msg.includes("node_versions")) {
+        friendly = "A version record for this node already exists. The document may have been recreated with the same name \u2014 pick a different title or remove the old node first.";
+      } else if (msg.includes("review_requests")) {
+        friendly = "A review request for this node already exists.";
+      } else if (msg.includes("nests")) {
+        friendly = "A nest with that name already exists.";
+      } else if (msg.includes("users")) {
+        friendly = "An account with that email already exists.";
+      } else if (msg.includes("stewards")) {
+        friendly = "That steward is already assigned with the same scope.";
+      }
+      return c.json({ error: friendly }, 409);
+    }
+    if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+      return c.json(
+        {
+          error: "Required related record is missing. Ensure the parent resource still exists."
+        },
+        409
+      );
+    }
+    if (code === "SQLITE_CONSTRAINT_CHECK") {
+      return c.json(
+        {
+          error: "Provided value isn't allowed for one of the fields. Double-check your input."
+        },
+        400
+      );
+    }
+    if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+      return c.json(
+        { error: "A required field is missing. Please fill it in and retry." },
+        400
+      );
+    }
+    if (code === "ENOENT") {
+      return c.json(
+        { error: "The requested file or folder doesn't exist." },
+        404
+      );
+    }
+    if (code === "EACCES" || code === "EPERM") {
+      return c.json(
+        { error: "Server doesn't have permission to access that file." },
+        500
+      );
+    }
+    if (code === "ENOSPC") {
+      return c.json(
+        { error: "Out of disk space on the server. Free up space and retry." },
+        507
+      );
+    }
+    if (err instanceof SyntaxError && msg.toLowerCase().includes("json")) {
+      return c.json({ error: "Request body isn't valid JSON." }, 400);
+    }
     console.error("Unhandled error:", err);
-    return c.json({ error: "Internal server error" }, 500);
+    return c.json(
+      {
+        error: "Something went wrong on the server. Try again \u2014 if it keeps failing, check the server log."
+      },
+      500
+    );
   });
   return app;
 }
@@ -2805,16 +3490,19 @@ async function main() {
   if (!license.valid) {
     console.warn(`
   WARNING: No valid PromptOwl license key found.
-  The server will run, but some features may be limited.
+  Server boots in SETUP MODE \u2014 writes return 503 and admin features
+  (stewards, teammates, governance) are locked until a key is installed.
 
-  To register:
+  To activate:
     1. Sign up at https://app.promptowl.ai
-    2. Go to Settings > License Keys
-    3. Create a Community Server key
-    4. Set PROMPTOWL_KEY=pk_... in your environment
+    2. Open Overview > Community License
+    3. Generate a key
+    4. Paste it into the setup screen (UI) or POST /license/install,
+       or set PROMPTOWL_KEY=pk_... in your environment and restart.
 `);
   }
   const app = createApp();
+  startLicenseWatcher();
   startTelemetryLoop();
   trackEvent("server.start", {
     tier: license.tier,