@promptowl/contextnest-community 0.1.0-alpha.2 → 1.0.1

package/dist/{chunk-Q2DCOS7V.js → chunk-K22GWPT4.js}

@@ -1,7 +1,7 @@
 import {
   config,
   getDb
-} from "./chunk-USIDOGVJ.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -108,8 +108,8 @@ function assignSteward(data) {
   const id = uuid();
   db.prepare(
     `INSERT INTO stewards
-     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, can_approve, can_reject, assigned_by, is_active)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
   ).run(
     id,
     data.nestId,
@@ -119,8 +119,6 @@ function assignSteward(data) {
     data.userEmail,
     data.userId || null,
     data.role,
-    data.canApprove ? 1 : 0,
-    data.canReject ? 1 : 0,
     data.assignedBy,
     data.isActive ? 1 : 0
   );
@@ -128,7 +126,21 @@ function assignSteward(data) {
 }
 function removeSteward(id) {
   const db = getDb();
-  db.prepare("UPDATE stewards SET is_active = 0 WHERE id = ?").run(id);
+  const remove = db.transaction((stewardId) => {
+    const row = db.prepare("SELECT nest_id, user_email FROM stewards WHERE id = ?").get(stewardId);
+    db.prepare("DELETE FROM stewards WHERE id = ?").run(stewardId);
+    if (!row) return;
+    const remaining = db.prepare(
+      "SELECT 1 FROM stewards WHERE nest_id = ? AND LOWER(user_email) = LOWER(?) AND is_active = 1 LIMIT 1"
+    ).get(row.nest_id, row.user_email);
+    if (remaining) return;
+    const user = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(row.user_email);
+    if (!user) return;
+    db.prepare(
+      "DELETE FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+    ).run(row.nest_id, user.id);
+  });
+  remove(id);
 }
 function getSteward(id) {
   const db = getDb();
@@ -170,7 +182,34 @@ function listStewards(params) {
   sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
   return db.prepare(sql).all(...args).map(rowToSteward);
 }
-function createStewardRecord(params) {
+function rolePermission(role) {
+  return role === "editor" ? "write" : "read";
+}
+async function ensureCollaborator(nestId, email, permission, grantedBy) {
+  const db = getDb();
+  let userRow = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
+  if (!userRow) {
+    const { hashPassword } = await import("./keys-YV33AJK3.js");
+    const newId = uuid();
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
+    ).run(newId, email, null, await hashPassword(uuid()));
+    userRow = { id: newId };
+  }
+  const nestRow = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+  if (nestRow && nestRow.user_id === userRow.id) return;
+  const existing = db.prepare(
+    "SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+  ).get(nestId, userRow.id);
+  if (existing) return;
+  const granterRow = db.prepare("SELECT id FROM users WHERE email = ?").get(grantedBy);
+  const granterId = granterRow?.id ?? nestRow?.user_id;
+  if (!granterId) return;
+  db.prepare(
+    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
+  ).run(uuid(), nestId, userRow.id, permission, granterId);
+}
+async function createStewardRecord(params) {
   if (params.users.length === 0) {
     throw new Error("At least one user is required");
   }
@@ -181,10 +220,6 @@ function createStewardRecord(params) {
       if (!params.documentId) throw new Error("documentId required for document scope");
       nodePattern = params.documentId;
       break;
-    case "folder":
-      if (!params.folderPath) throw new Error("folderPath required for folder scope");
-      nodePattern = params.folderPath;
-      break;
     case "tag":
       if (!params.tagName) throw new Error("tagName required for tag scope");
       tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
@@ -222,13 +257,17 @@ function createStewardRecord(params) {
       userEmail: email,
       userId: userRow?.id,
       role: user.role ?? "reviewer",
-      canApprove: user.canApprove !== false,
-      canReject: user.canReject !== false,
       assignedBy: params.assignedBy,
       assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
       isActive: true
     });
     results.push(created);
+    await ensureCollaborator(
+      params.nestId,
+      email,
+      rolePermission(user.role),
+      params.assignedBy
+    );
   }
   db.prepare(
     "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0"
@@ -250,14 +289,7 @@ function resolve(nestId, nodeId) {
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
           AND s.node_pattern = ?
       UNION ALL
-      SELECT s.*, 2 AS priority, ('folder: ' || s.node_pattern) AS match_source
-        FROM stewards s
-        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'folder'
-          AND s.node_pattern IS NOT NULL
-          AND instr(s.node_pattern, '*') = 0
-          AND ? LIKE s.node_pattern || '/%'
-      UNION ALL
-      SELECT s.*, 3 AS priority, ('tag: ' || s.tag_name) AS match_source
+      SELECT s.*, 2 AS priority, ('tag: ' || s.tag_name) AS match_source
         FROM stewards s
         JOIN node_tag_index nt
           ON nt.nest_id = s.nest_id
@@ -265,34 +297,26 @@ function resolve(nestId, nodeId) {
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
           AND nt.node_id = ?
       UNION ALL
-      SELECT s.*, 4 AS priority, 'nest-level steward' AS match_source
+      SELECT s.*, 3 AS priority, 'nest-level steward' AS match_source
         FROM stewards s
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
       ORDER BY priority ASC, user_email ASC
       `
-  ).all(nestId, nodeId, nestId, nodeId, nestId, nodeId, nestId);
+  ).all(
+    nestId,
+    nodeId,
+    // document branch
+    nestId,
+    nodeId,
+    // tag branch
+    nestId
+    // nest branch
+  );
   const resolved = rows.map((row) => ({
     steward: rowToSteward(row),
     priority: row.priority,
     source: row.match_source
   }));
-  const legacyFolderGlobs = db.prepare(
-    `SELECT * FROM stewards
-       WHERE nest_id = ? AND is_active = 1 AND scope = 'folder'
-         AND node_pattern IS NOT NULL AND instr(node_pattern, '*') > 0`
-  ).all(nestId);
-  for (const row of legacyFolderGlobs) {
-    if (globMatch(nodeId, row.node_pattern)) {
-      resolved.push({
-        steward: rowToSteward(row),
-        priority: 2,
-        source: `folder: ${row.node_pattern}`
-      });
-    }
-  }
-  if (legacyFolderGlobs.length > 0) {
-    resolved.sort((a, b) => a.priority - b.priority);
-  }
   if (resolved.length > 0) {
     return { stewards: resolved, fallbackToOwner: false };
   }
@@ -359,7 +383,7 @@ function canUserApprove(nestId, nodeId, userEmail) {
     };
   }
   const match = resolved.find(
-    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "reviewer" && r.steward.canApprove
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "reviewer"
   );
   if (!match) {
     return {
@@ -395,14 +419,6 @@ function canUserAccess(nestId, nodeId, userEmail) {
   }
   return { allowed: false, reason: "no steward assignment", role: null };
 }
-function globMatch(value, pattern) {
-  if (pattern === "*") return true;
-  if (!pattern.includes("*")) return value === pattern;
-  const regex = new RegExp(
-    "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$"
-  );
-  return regex.test(value);
-}
 function syncFromConfig(nestId, config2) {
   const db = getDb();
   let count = 0;
@@ -425,8 +441,6 @@ function syncFromConfig(nestId, config2) {
         userEmail: entry.email.toLowerCase(),
         userId: user?.id,
         role,
-        canApprove: entry.can_approve !== false,
-        canReject: entry.can_reject !== false,
         assignedBy: "config",
         assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
         isActive: true
@@ -437,11 +451,6 @@ function syncFromConfig(nestId, config2) {
   if (config2.nest) {
     addEntries("nest", config2.nest);
   }
-  if (config2.folders) {
-    for (const [pattern, entries] of Object.entries(config2.folders)) {
-      addEntries("folder", entries, { nodePattern: pattern });
-    }
-  }
   if (config2.tags) {
     for (const [tagName, entries] of Object.entries(config2.tags)) {
       addEntries("tag", entries, { tagName });
@@ -464,8 +473,6 @@ function rowToSteward(row) {
     userEmail: row.user_email,
     userId: row.user_id || void 0,
     role: row.role,
-    canApprove: !!row.can_approve,
-    canReject: !!row.can_reject,
     assignedBy: row.assigned_by,
     assignedAt: row.assigned_at,
     isActive: !!row.is_active

package/dist/{chunk-USIDOGVJ.js → chunk-KQCWNHDM.js}

@@ -1,5 +1,24 @@
 // src/config.ts
-import { join } from "path";
+import { join, dirname } from "path";
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+import dotenv from "dotenv";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname(__filename);
+var envCandidates = [
+  join(process.cwd(), ".env"),
+  join(__dirname, "..", ".env")
+];
+var envFileLoaded = envCandidates.find((p) => existsSync(p)) || null;
+var isTestRun = !!process.env.VITEST;
+if (envFileLoaded && !isTestRun) {
+  dotenv.config({ path: envFileLoaded, override: true });
+}
+if (!isTestRun) {
+  console.log(
+    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
+  );
+}
 function dataRoot() {
   return process.env.DATA_ROOT || join(process.cwd(), "data");
 }
@@ -19,6 +38,14 @@ var config = {
   get PROMPTOWL_KEY() {
     return process.env.PROMPTOWL_KEY || "";
   },
+  /**
+   * Path to the .env file the server reads its config from. Used by
+   * the license install flow to persist PROMPTOWL_KEY alongside any
+   * existing env vars, instead of a separate sidecar file.
+   */
+  get ENV_FILE_PATH() {
+    return process.env.ENV_FILE_PATH || join(process.cwd(), ".env");
+  },
   get TELEMETRY_ENABLED() {
     return process.env.TELEMETRY_ENABLED !== "false";
   },
@@ -52,7 +79,11 @@ var config = {
 // src/db/client.ts
 import Database from "better-sqlite3";
 import { mkdirSync } from "fs";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
+
+// src/shared/constants.ts
+var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
+var ANON_EMAIL = "admin@localhost";
 
 // src/db/migrations.ts
 function runMigrations(db2) {
@@ -124,19 +155,17 @@ function runMigrations(db2) {
   db2.exec(`
     -- Steward assignments (mirrors PromptOwl ContextSteward model)
     -- scope+target combination determines what the steward governs
-    -- Resolution priority: document(1) > folder(2) > tag(3) > nest(4)
+    -- Resolution priority: document(1) > tag(2) > nest(3)
     CREATE TABLE IF NOT EXISTS stewards (
       id TEXT PRIMARY KEY,
       nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-      scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
-      node_pattern TEXT,           -- glob for document/folder scope (e.g. "nodes/api-*")
+      scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+      node_pattern TEXT,           -- exact node id for document scope
       tag_name TEXT,               -- for tag scope
       user_email TEXT NOT NULL,
       user_id TEXT REFERENCES users(id),
       role TEXT NOT NULL DEFAULT 'reviewer'
         CHECK(role IN ('editor', 'reviewer', 'admin')),
-      can_approve INTEGER NOT NULL DEFAULT 1,
-      can_reject INTEGER NOT NULL DEFAULT 1,
       assigned_by TEXT NOT NULL,
       assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
       is_active INTEGER NOT NULL DEFAULT 1
@@ -204,6 +233,22 @@ function runMigrations(db2) {
   if (!userCols.includes("is_admin")) {
     db2.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
   }
+  if (!userCols.includes("is_invited")) {
+    db2.exec("ALTER TABLE users ADD COLUMN is_invited INTEGER NOT NULL DEFAULT 0");
+  }
+  const stewardCols = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+  if (stewardCols.length > 0) {
+    if (!stewardCols.includes("can_approve")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_approve INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+    if (!stewardCols.includes("can_reject")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_reject INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+  }
   db2.exec(`
     CREATE TABLE IF NOT EXISTS schema_migrations (
       id TEXT PRIMARY KEY,
@@ -218,24 +263,23 @@ function runMigrations(db2) {
         CREATE TABLE stewards_new (
           id TEXT PRIMARY KEY,
           nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-          scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
+          scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
           node_pattern TEXT,
           tag_name TEXT,
           user_email TEXT NOT NULL,
           user_id TEXT REFERENCES users(id),
           role TEXT NOT NULL DEFAULT 'reviewer'
             CHECK(role IN ('editor', 'reviewer', 'viewer')),
-          can_approve INTEGER NOT NULL DEFAULT 1,
-          can_reject INTEGER NOT NULL DEFAULT 1,
           assigned_by TEXT NOT NULL,
           assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
           is_active INTEGER NOT NULL DEFAULT 1
         );
 
-        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email
+        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email.
+        -- Legacy can_approve/can_reject columns are dropped here (role is now the sole signal).
         INSERT INTO stewards_new
           (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
-           role, can_approve, can_reject, assigned_by, assigned_at, is_active)
+           role, assigned_by, assigned_at, is_active)
         SELECT
           id, nest_id, scope, node_pattern,
           CASE
@@ -245,7 +289,7 @@ function runMigrations(db2) {
           lower(user_email),
           user_id,
           CASE role WHEN 'admin' THEN 'reviewer' ELSE role END,
-          can_approve, can_reject, assigned_by, assigned_at, is_active
+          assigned_by, assigned_at, is_active
         FROM stewards;
 
         DROP TABLE stewards;
@@ -264,10 +308,6 @@ function runMigrations(db2) {
           ON stewards(nest_id, node_pattern, user_email)
           WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
 
-        CREATE UNIQUE INDEX idx_stewards_uniq_folder
-          ON stewards(nest_id, node_pattern, user_email)
-          WHERE scope = 'folder' AND node_pattern IS NOT NULL AND is_active = 1;
-
         CREATE UNIQUE INDEX idx_stewards_uniq_tag
           ON stewards(nest_id, tag_name, user_email)
           WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
@@ -276,9 +316,6 @@ function runMigrations(db2) {
         CREATE INDEX idx_stewards_tag_lookup
           ON stewards(nest_id, tag_name)
           WHERE scope = 'tag' AND is_active = 1;
-        CREATE INDEX idx_stewards_folder_lookup
-          ON stewards(nest_id, node_pattern)
-          WHERE scope = 'folder' AND is_active = 1;
         CREATE INDEX idx_stewards_doc_lookup
           ON stewards(nest_id, node_pattern)
           WHERE scope = 'document' AND is_active = 1;
@@ -326,16 +363,174 @@ function runMigrations(db2) {
       recordMigration("002_steward_parity");
     })();
   }
+  if (!hasMigration("003_sessions_and_single_api_key")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE IF NOT EXISTS sessions (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          expires_at TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          last_seen_at TEXT NOT NULL DEFAULT (datetime('now')),
+          user_agent TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
+        CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
+      `);
+      db2.exec(`
+        DELETE FROM api_keys
+        WHERE id IN (
+          SELECT id FROM (
+            SELECT
+              id,
+              ROW_NUMBER() OVER (
+                PARTITION BY user_id
+                ORDER BY
+                  COALESCE(last_used_at, '') DESC,
+                  created_at DESC,
+                  id DESC
+              ) AS rn
+            FROM api_keys
+          )
+          WHERE rn > 1
+        );
+      `);
+      db2.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_api_keys_user_unique
+          ON api_keys(user_id);
+      `);
+      recordMigration("003_sessions_and_single_api_key");
+    })();
+  }
+  if (!hasMigration("004_license_cache_owner_email")) {
+    db2.transaction(() => {
+      const cols = db2.prepare("PRAGMA table_info(license_cache)").all().map((c) => c.name);
+      if (!cols.includes("owner_email")) {
+        db2.exec("ALTER TABLE license_cache ADD COLUMN owner_email TEXT");
+      }
+      recordMigration("004_license_cache_owner_email");
+    })();
+  }
+  if (!hasMigration("005_anon_nest_public_default")) {
+    db2.transaction(() => {
+      db2.prepare(
+        "UPDATE nests SET visibility = 'public' WHERE user_id = ? AND visibility = 'private'"
+      ).run(ANON_USER_ID);
+      recordMigration("005_anon_nest_public_default");
+    })();
+  }
+  if (!hasMigration("006_node_versions_published_status")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE node_versions_new (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          version INTEGER NOT NULL,
+          content_hash TEXT NOT NULL,
+          author TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'draft'
+            CHECK(status IN ('draft', 'pending_review', 'approved', 'published', 'rejected')),
+          change_note TEXT,
+          tags_json TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          UNIQUE(nest_id, node_id, version)
+        );
+        INSERT INTO node_versions_new
+          (id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at)
+        SELECT
+          id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at
+        FROM node_versions;
+        DROP TABLE node_versions;
+        ALTER TABLE node_versions_new RENAME TO node_versions;
+        CREATE INDEX idx_versions_node ON node_versions(nest_id, node_id);
+      `);
+      recordMigration("006_node_versions_published_status");
+    })();
+  }
+  if (!hasMigration("007_drop_steward_capability_flags")) {
+    const stewardCols2 = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+    const hasLegacyCols = stewardCols2.includes("can_approve") || stewardCols2.includes("can_reject");
+    if (hasLegacyCols) {
+      db2.transaction(() => {
+        if (stewardCols2.includes("can_approve")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_approve");
+        }
+        if (stewardCols2.includes("can_reject")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_reject");
+        }
+        recordMigration("007_drop_steward_capability_flags");
+      })();
+    } else {
+      recordMigration("007_drop_steward_capability_flags");
+    }
+  }
+  if (!hasMigration("008_drop_steward_folder_scope")) {
+    db2.transaction(() => {
+      db2.exec("DELETE FROM stewards WHERE scope = 'folder'");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_uniq_folder");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_folder_lookup");
+      const tbl = db2.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='stewards'").get();
+      if (tbl?.sql && tbl.sql.includes("'folder'")) {
+        db2.exec(`
+          CREATE TABLE stewards_new (
+            id TEXT PRIMARY KEY,
+            nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+            scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+            node_pattern TEXT,
+            tag_name TEXT,
+            user_email TEXT NOT NULL,
+            user_id TEXT REFERENCES users(id),
+            role TEXT NOT NULL DEFAULT 'reviewer'
+              CHECK(role IN ('editor', 'reviewer', 'viewer')),
+            assigned_by TEXT NOT NULL,
+            assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
+            is_active INTEGER NOT NULL DEFAULT 1
+          );
+          INSERT INTO stewards_new
+            (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+             role, assigned_by, assigned_at, is_active)
+          SELECT
+            id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+            role, assigned_by, assigned_at, is_active
+          FROM stewards;
+          DROP TABLE stewards;
+          ALTER TABLE stewards_new RENAME TO stewards;
+
+          CREATE INDEX idx_stewards_nest ON stewards(nest_id);
+          CREATE INDEX idx_stewards_email ON stewards(user_email);
+          CREATE INDEX idx_stewards_scope ON stewards(nest_id, scope);
+          CREATE UNIQUE INDEX idx_stewards_uniq_nest
+            ON stewards(nest_id, user_email)
+            WHERE scope = 'nest' AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_document
+            ON stewards(nest_id, node_pattern, user_email)
+            WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_tag
+            ON stewards(nest_id, tag_name, user_email)
+            WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
+          CREATE INDEX idx_stewards_tag_lookup
+            ON stewards(nest_id, tag_name)
+            WHERE scope = 'tag' AND is_active = 1;
+          CREATE INDEX idx_stewards_doc_lookup
+            ON stewards(nest_id, node_pattern)
+            WHERE scope = 'document' AND is_active = 1;
+        `);
+      }
+      recordMigration("008_drop_steward_folder_scope");
+    })();
+  }
 }
 
 // src/db/client.ts
 var db = null;
 function getDb() {
   if (!db) {
-    mkdirSync(dirname(config.DATABASE_PATH), { recursive: true });
+    mkdirSync(dirname2(config.DATABASE_PATH), { recursive: true });
     db = new Database(config.DATABASE_PATH);
     db.pragma("journal_mode = WAL");
     db.pragma("foreign_keys = ON");
+    db.pragma("busy_timeout = 5000");
     runMigrations(db);
   }
   return db;
@@ -343,5 +538,7 @@ function getDb() {
 
 export {
   config,
+  ANON_USER_ID,
+  ANON_EMAIL,
   getDb
 };