@promptowl/contextnest-community 0.1.0-alpha.2 → 1.0.1

package/dist/index.js

@@ -7,22 +7,17 @@ import {
   parseBearerToken,
   verifyPassword
 } from "./chunk-7K2LLJXK.js";
-import {
-  checkConflict,
-  createVersion,
-  getApprovedVersion,
-  getCurrentVersion,
-  getVersions,
-  setApprovedVersion
-} from "./chunk-P6NG56CO.js";
 import {
   approve,
   cancelReview,
+  engineCache,
+  getPendingReview,
   getReviewHistory,
   getReviewQueue,
   reject,
+  safePublishDocument,
   submitForReview
-} from "./chunk-DJFEV4ET.js";
+} from "./chunk-5VHKEIAW.js";
 import {
   assignSteward,
   canUserAccess,
@@ -37,11 +32,22 @@ import {
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   syncFromConfig
-} from "./chunk-Q2DCOS7V.js";
+} from "./chunk-K22GWPT4.js";
 import {
+  checkConflict,
+  createVersion,
+  getApprovedVersion,
+  getCurrentVersion,
+  getDisplayStatus,
+  getVersions,
+  setApprovedVersion
+} from "./chunk-JMZ75ZCD.js";
+import {
+  ANON_EMAIL,
+  ANON_USER_ID,
   config,
   getDb
-} from "./chunk-USIDOGVJ.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -49,7 +55,6 @@ import { serve } from "@hono/node-server";
 // src/app.ts
 import { Hono as Hono8 } from "hono";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
-import { logger } from "hono/logger";
 import { cors } from "hono/cors";
 
 // src/auth/routes.ts
@@ -58,23 +63,113 @@ import { v4 as uuid } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
-var authMiddleware = createMiddleware(async (c, next) => {
-  const key = parseBearerToken(c.req.header("Authorization"));
-  if (!key) {
-    return c.json({ error: "Missing or invalid API key" }, 401);
-  }
-  const keyHash = hashApiKey(key);
+
+// src/auth/sessions.ts
+import { randomBytes } from "crypto";
+var SESSION_COOKIE = "cnst_session";
+var SESSION_TTL_DAYS = 30;
+var SESSION_TTL_SECS = SESSION_TTL_DAYS * 24 * 60 * 60;
+function newSessionId() {
+  return randomBytes(32).toString("hex");
+}
+function expiryIso(ttlSeconds = SESSION_TTL_SECS) {
+  return new Date(Date.now() + ttlSeconds * 1e3).toISOString();
+}
+function createSession(userId, userAgent) {
+  const db = getDb();
+  const id = newSessionId();
+  db.prepare(
+    `INSERT INTO sessions (id, user_id, expires_at, user_agent)
+     VALUES (?, ?, ?, ?)`
+  ).run(id, userId, expiryIso(), userAgent || null);
+  return id;
+}
+function resolveSession(id) {
   const db = getDb();
-  const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
-  if (!record) {
-    return c.json({ error: "Invalid API key" }, 401);
+  const row = db.prepare(
+    `SELECT user_id, expires_at FROM sessions WHERE id = ?`
+  ).get(id);
+  if (!row) return null;
+  if (new Date(row.expires_at).getTime() <= Date.now()) {
+    db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+    return null;
   }
   db.prepare(
-    "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
-  ).run(keyHash);
-  c.set("userId", record.user_id);
-  c.set("nestScope", record.nest_id);
-  await next();
+    "UPDATE sessions SET last_seen_at = datetime('now') WHERE id = ?"
+  ).run(id);
+  return row.user_id;
+}
+function deleteSession(id) {
+  const db = getDb();
+  db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+}
+function deleteAllSessionsForUser(userId) {
+  const db = getDb();
+  db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+}
+function getSessionIdFromRequest(c) {
+  const cookieHeader = c.req.header("Cookie");
+  if (!cookieHeader) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === SESSION_COOKIE) {
+      const v = rest.join("=").trim();
+      return /^[0-9a-f]{64}$/.test(v) ? v : null;
+    }
+  }
+  return null;
+}
+function buildSessionCookie(id, opts = {}) {
+  const maxAge = opts.maxAgeSeconds ?? SESSION_TTL_SECS;
+  const parts = [
+    `${SESSION_COOKIE}=${id}`,
+    "HttpOnly",
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAge}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function buildClearSessionCookie(opts = {}) {
+  return buildSessionCookie("", { secure: opts.secure, maxAgeSeconds: 0 });
+}
+function isSecureRequest(c) {
+  const proto = c.req.header("x-forwarded-proto");
+  if (proto) return proto.split(",")[0].trim() === "https";
+  try {
+    return new URL(c.req.url).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// src/auth/middleware.ts
+var authMiddleware = createMiddleware(async (c, next) => {
+  const db = getDb();
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) {
+    const userId = resolveSession(sessionId);
+    if (userId) {
+      c.set("userId", userId);
+      c.set("nestScope", null);
+      return next();
+    }
+  }
+  const key = parseBearerToken(c.req.header("Authorization"));
+  if (key) {
+    const keyHash = hashApiKey(key);
+    const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
+    if (record) {
+      db.prepare(
+        "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
+      ).run(keyHash);
+      c.set("userId", record.user_id);
+      c.set("nestScope", record.nest_id);
+      return next();
+    }
+  }
+  return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
 // src/shared/errors.ts
@@ -84,6 +179,7 @@ var AppError = class extends Error {
     this.statusCode = statusCode;
     this.name = "AppError";
   }
+  statusCode;
 };
 var NotFoundError = class extends AppError {
   constructor(message = "Not found") {
@@ -91,12 +187,24 @@ var NotFoundError = class extends AppError {
     this.name = "NotFoundError";
   }
 };
+var ForbiddenError = class extends AppError {
+  constructor(message = "Forbidden") {
+    super(403, message);
+    this.name = "ForbiddenError";
+  }
+};
 var ValidationError = class extends AppError {
   constructor(message) {
     super(400, message);
     this.name = "ValidationError";
   }
 };
+var ConflictError = class extends AppError {
+  constructor(message) {
+    super(409, message);
+    this.name = "ConflictError";
+  }
+};
 
 // src/telemetry/tracker.ts
 function trackEvent(event, data) {
@@ -154,6 +262,368 @@ function startTelemetryLoop() {
   );
 }
 
+// src/auth/license.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+var currentLicense = null;
+function getCurrentLicense() {
+  return currentLicense;
+}
+function isLicenseAdminEmail(email) {
+  if (!email) return false;
+  const lic = currentLicense;
+  if (!lic?.valid || !lic.ownerEmail) return false;
+  return lic.ownerEmail.toLowerCase() === email.toLowerCase();
+}
+function isLicenseAdminUserId(userId) {
+  try {
+    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
+    return isLicenseAdminEmail(row?.email);
+  } catch {
+    return false;
+  }
+}
+function upsertEnvVar(filePath, varName, value) {
+  const prefix = `${varName}=`;
+  let lines = [];
+  if (existsSync(filePath)) {
+    lines = readFileSync(filePath, "utf8").split(/\r?\n/);
+  }
+  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
+  if (value !== null) {
+    filtered.push(`${prefix}${value}`);
+  }
+  while (filtered.length && filtered[filtered.length - 1] === "") {
+    filtered.pop();
+  }
+  writeFileSync(filePath, filtered.join("\n") + "\n", "utf8");
+}
+async function installLicenseKey(key) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith("pk_")) {
+    throw new Error("Invalid license key format. Must start with pk_.");
+  }
+  const previousKey = process.env.PROMPTOWL_KEY || "";
+  process.env.PROMPTOWL_KEY = trimmed;
+  const info = await validateLicense({ forceFresh: true });
+  if (!info.valid) {
+    process.env.PROMPTOWL_KEY = previousKey;
+    if (previousKey) {
+      await validateLicense({ forceFresh: true });
+    }
+    return info;
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+  } catch (err) {
+    console.warn("[license] failed to write .env:", err);
+  }
+  startLicenseWatcher();
+  return info;
+}
+var watcherActive = false;
+var watcherAbort = null;
+var WATCHER_BACKOFF_MIN_MS = 2 * 1e3;
+var WATCHER_BACKOFF_MAX_MS = 60 * 1e3;
+function startLicenseWatcher() {
+  if (watcherActive) {
+    watcherAbort?.abort();
+    return;
+  }
+  watcherActive = true;
+  void runLicenseWatcher();
+}
+async function runLicenseWatcher() {
+  let backoff = WATCHER_BACKOFF_MIN_MS;
+  while (watcherActive) {
+    const key = config.PROMPTOWL_KEY;
+    if (!key) {
+      await sleep(WATCHER_BACKOFF_MAX_MS);
+      continue;
+    }
+    try {
+      watcherAbort = new AbortController();
+      const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+      const fetchTimeout = AbortSignal.timeout(30 * 1e3);
+      const signal = typeof AbortSignal.any === "function" ? AbortSignal.any([watcherAbort.signal, fetchTimeout]) : watcherAbort.signal;
+      const res = await fetch(`${promptowlUrl}/api/license/listen`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          key,
+          since_updated_at: currentLicense ? (/* @__PURE__ */ new Date()).toISOString() : void 0
+        }),
+        signal
+      });
+      if (!res.ok) {
+        if (res.status === 504 || res.status === 408 || res.status === 502) {
+          backoff = WATCHER_BACKOFF_MIN_MS;
+          continue;
+        }
+        throw new Error(`listen returned ${res.status}`);
+      }
+      const data = await res.json();
+      backoff = WATCHER_BACKOFF_MIN_MS;
+      if (data.event && data.event !== "no_change") {
+        console.log(
+          `[license] event from PromptOwl: ${data.event} \u2014 revalidating`
+        );
+        const wasValid = !!currentLicense?.valid;
+        await validateLicense({ forceFresh: true });
+        const isValid = !!currentLicense?.valid;
+        if (wasValid && !isValid) {
+          handleLicenseRevoked();
+        }
+      }
+    } catch (err) {
+      if (err.name === "AbortError") {
+        continue;
+      }
+      console.warn(
+        `[license] watcher error: ${err.message}; backing off ${backoff}ms`
+      );
+      await sleep(backoff);
+      backoff = Math.min(backoff * 2, WATCHER_BACKOFF_MAX_MS);
+    } finally {
+      watcherAbort = null;
+    }
+  }
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+var safetyPollHandle = null;
+var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
+function startLicenseSafetyPoll() {
+  if (safetyPollHandle) return;
+  safetyPollHandle = setInterval(async () => {
+    if (!config.PROMPTOWL_KEY) return;
+    try {
+      const wasValid = !!currentLicense?.valid;
+      await validateLicense({ forceFresh: true });
+      const isValid = !!currentLicense?.valid;
+      if (wasValid && !isValid) {
+        console.log("[license] safety poll detected revocation");
+        handleLicenseRevoked();
+      }
+    } catch (err) {
+      console.warn(
+        `[license] safety poll error: ${err.message}`
+      );
+    }
+  }, SAFETY_POLL_INTERVAL_MS);
+  if (typeof safetyPollHandle.unref === "function") {
+    safetyPollHandle.unref();
+  }
+}
+function handleLicenseRevoked() {
+  try {
+    const db = getDb();
+    const result = db.prepare("DELETE FROM sessions").run();
+    console.warn(
+      `[license] revoked \u2014 wiped ${result.changes} active session(s).`
+    );
+  } catch (err) {
+    console.warn("[license] failed to wipe sessions:", err);
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
+    console.warn(
+      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
+    );
+  } catch (err) {
+    console.warn("[license] failed to strip key from .env:", err);
+  }
+  process.env.PROMPTOWL_KEY = "";
+  currentLicense = {
+    valid: false,
+    tier: "none",
+    org: null,
+    limits: null,
+    suspended: false,
+    suspendedReason: null,
+    ownerEmail: null
+  };
+}
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var suspensionFirstSeen = null;
+var suspensionConfirmed = false;
+var suspensionReason = null;
+var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
+function isSuspended() {
+  return suspensionConfirmed;
+}
+function getSuspensionReason() {
+  return suspensionReason;
+}
+async function validateLicense(opts = {}) {
+  const info = await _validateLicenseImpl(!!opts.forceFresh);
+  currentLicense = info;
+  return info;
+}
+async function _validateLicenseImpl(forceFresh) {
+  const key = config.PROMPTOWL_KEY;
+  if (!key) {
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+  const db = getDb();
+  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
+  if (cached && !forceFresh) {
+    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
+    if (age < CACHE_TTL_MS) {
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+  }
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ key })
+    });
+    if (!res.ok) {
+      if (cached) {
+        console.warn(
+          "  PromptOwl unreachable, using cached license (grace period)"
+        );
+        return {
+          valid: true,
+          tier: cached.tier,
+          org: cached.org,
+          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+          suspended: suspensionConfirmed,
+          suspendedReason: suspensionReason,
+          ownerEmail: cached.owner_email || null
+        };
+      }
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: null
+      };
+    }
+    const data = await res.json();
+    if (data.suspended === true) {
+      if (!suspensionFirstSeen) {
+        suspensionFirstSeen = Date.now();
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.warn(
+          `
+  WARNING: PromptOwl has flagged this server for suspension.`
+        );
+        console.warn(
+          `  Reason: ${suspensionReason}`
+        );
+        console.warn(
+          `  This will be confirmed in ~1 hour. If this is an error,`
+        );
+        console.warn(
+          `  contact support@promptowl.ai to reverse it.
+`
+        );
+      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
+        suspensionConfirmed = true;
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.error(
+          `
+  SERVER SUSPENDED: ${suspensionReason}`
+        );
+        console.error(
+          `  Write operations are disabled. Reads still work.`
+        );
+        console.error(
+          `  Contact support@promptowl.ai to resolve.
+`
+        );
+      }
+    } else {
+      if (suspensionFirstSeen) {
+        console.log("  Suspension flag cleared by PromptOwl.");
+      }
+      suspensionFirstSeen = null;
+      suspensionConfirmed = false;
+      suspensionReason = null;
+    }
+    if (!data.valid && !data.suspended) {
+      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: data.owner_email || null
+      };
+    }
+    if (data.valid) {
+      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
+      db.prepare(
+        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
+         VALUES (?, ?, ?, ?, ?, datetime('now'))`
+      ).run(
+        key,
+        data.tier || "community",
+        data.org || null,
+        limitsJson,
+        data.owner_email || null
+      );
+    }
+    return {
+      valid: data.valid !== false,
+      tier: data.tier || "community",
+      org: data.org || null,
+      limits: data.limits || null,
+      suspended: suspensionConfirmed,
+      suspendedReason: suspensionReason,
+      ownerEmail: data.owner_email || null
+    };
+  } catch (err) {
+    if (cached) {
+      console.warn(
+        `  PromptOwl validation failed (${err.message}), using cached license`
+      );
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+}
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function tryConsume(key, cfg) {
@@ -185,6 +655,32 @@ function clientIp(c) {
   if (realIp) return realIp.trim();
   return "unknown";
 }
+function resolveCallerUserId(c) {
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) {
+    const uid = resolveSession(sessionId);
+    if (uid) return uid;
+  }
+  const key = parseBearerToken(c.req.header("Authorization"));
+  if (key) {
+    const db = getDb();
+    const row = db.prepare("SELECT user_id FROM api_keys WHERE key_hash = ?").get(hashApiKey(key));
+    if (row) return row.user_id;
+  }
+  return null;
+}
+function setSessionCookie(c, sessionId) {
+  c.header(
+    "Set-Cookie",
+    buildSessionCookie(sessionId, { secure: isSecureRequest(c) })
+  );
+}
+function clearSessionCookie(c) {
+  c.header(
+    "Set-Cookie",
+    buildClearSessionCookie({ secure: isSecureRequest(c) })
+  );
+}
 var authRoutes = new Hono();
 authRoutes.post("/register", async (c) => {
   const body = await c.req.json();
@@ -196,25 +692,34 @@ authRoutes.post("/register", async (c) => {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
-  if (existing) {
+  const existing = db.prepare("SELECT id, is_invited FROM users WHERE email = ?").get(body.email);
+  let userId;
+  const passwordHash = await hashPassword(body.password);
+  if (existing && existing.is_invited === 1) {
+    userId = existing.id;
+    db.prepare(
+      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
+    ).run(passwordHash, body.name || null, userId);
+    trackEvent("user.register", { userId, email: body.email, claimed: true });
+  } else if (existing) {
     throw new ValidationError("Email already registered");
+  } else {
+    userId = uuid();
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, body.email, body.name || null, passwordHash);
+    trackEvent("user.register", { userId, email: body.email });
   }
-  const userId = uuid();
-  const passwordHash = await hashPassword(body.password);
-  db.prepare(
-    "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-  ).run(userId, body.email, body.name || null, passwordHash);
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(keyId, userId, hashApiKey(apiKey), getKeyPrefix(apiKey), "default");
-  trackEvent("user.register", { userId, email: body.email });
+  const sessionId = createSession(userId, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
   return c.json(
     {
-      user: { id: userId, email: body.email, name: body.name || null },
-      api_key: apiKey
+      user: {
+        id: userId,
+        email: body.email,
+        name: body.name || null,
+        is_admin: isLicenseAdminEmail(body.email)
+      }
     },
     201
   );
@@ -231,7 +736,7 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = db.prepare(
-    "SELECT id, email, name, password_hash FROM users WHERE email = ?"
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE email = ?"
   ).get(body.email);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
@@ -247,30 +752,47 @@ authRoutes.post("/login", async (c) => {
     } catch {
     }
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    user.id,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    body.label || "login"
-  );
   trackEvent("user.login", { userId: user.id });
-  return c.json({ api_key: apiKey });
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
+  return c.json({
+    user: {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      is_admin: isLicenseAdminEmail(user.email)
+    }
+  });
+});
+authRoutes.post("/logout", async (c) => {
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) deleteSession(sessionId);
+  clearSessionCookie(c);
+  return c.json({ ok: true });
 });
 authRoutes.post("/keys", authMiddleware, async (c) => {
-  const body = await c.req.json();
+  const body = await c.req.json().catch(
+    () => ({})
+  );
   const db = getDb();
+  const userId = c.get("userId");
+  const existing = db.prepare("SELECT key_prefix FROM api_keys WHERE user_id = ?").get(userId);
+  if (existing) {
+    return c.json(
+      {
+        error: "An API key already exists for this user. Rotate it instead.",
+        key_prefix: existing.key_prefix
+      },
+      409
+    );
+  }
   const apiKey = generateApiKey();
   const keyId = uuid();
   db.prepare(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
   ).run(
     keyId,
-    c.get("userId"),
+    userId,
     hashApiKey(apiKey),
     getKeyPrefix(apiKey),
     body.nest_id || null,
@@ -281,6 +803,30 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     201
   );
 });
+authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
+  const body = await c.req.json().catch(
+    () => ({})
+  );
+  const db = getDb();
+  const userId = c.get("userId");
+  const apiKey = generateApiKey();
+  const keyId = uuid();
+  const prior = db.prepare("SELECT label, nest_id FROM api_keys WHERE user_id = ?").get(userId);
+  db.transaction(() => {
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(userId);
+    db.prepare(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
+    ).run(
+      keyId,
+      userId,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.nest_id ?? prior?.nest_id ?? null,
+      body.label ?? prior?.label ?? null
+    );
+  })();
+  return c.json({ api_key: apiKey, key_prefix: getKeyPrefix(apiKey) });
+});
 authRoutes.get("/keys", authMiddleware, async (c) => {
   const db = getDb();
   const keys = db.prepare(
@@ -370,97 +916,127 @@ authRoutes.post("/promptowl", async (c) => {
   } else {
     trackEvent("user.login", { userId: user.id, method: "promptowl" });
   }
+  let claimBlocked = null;
+  const lic = getCurrentLicense();
   let isAdmin = false;
-  const claim = db.transaction((userId) => {
-    const result = db.prepare(
-      `UPDATE users SET is_admin = 1
-         WHERE id = ?
-           AND NOT EXISTS (SELECT 1 FROM users WHERE is_admin = 1)`
-    ).run(userId);
-    return result.changes > 0;
-  });
-  if (claim(user.id)) {
+  if (!lic?.valid) {
+    claimBlocked = { reason: "license_required" };
+  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === me.email.toLowerCase()) {
     isAdmin = true;
     trackEvent("admin.claim", { userId: user.id, email: user.email });
   } else {
-    const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(user.id);
-    isAdmin = !!userRow?.is_admin;
+    claimBlocked = {
+      reason: "email_mismatch",
+      license_owner_email: lic.ownerEmail
+    };
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    user.id,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    "promptowl"
-  );
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
   return c.json({
-    api_key: apiKey,
     user: {
       id: user.id,
       email: user.email,
       name: user.name,
       is_admin: isAdmin
-    }
+    },
+    ...claimBlocked ? { claim_blocked: claimBlocked } : {}
   });
 });
 authRoutes.get("/admin-status", async (c) => {
   const db = getDb();
-  const admin = db.prepare("SELECT email, name FROM users WHERE is_admin = 1 LIMIT 1").get();
-  const callerKey = parseBearerToken(c.req.header("Authorization"));
+  const lic = getCurrentLicense();
+  const ownerEmail = lic?.valid ? lic.ownerEmail : null;
+  let admin = null;
+  if (ownerEmail) {
+    const ownerRow = db.prepare("SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1").get(ownerEmail);
+    admin = { email: ownerEmail, name: ownerRow?.name ?? null };
+  }
+  const callerId = resolveCallerUserId(c);
   let me = null;
-  if (callerKey) {
-    const keyHash = hashApiKey(callerKey);
-    const row = db.prepare(
-      `SELECT u.email, u.is_admin FROM api_keys k
-         JOIN users u ON u.id = k.user_id
-         WHERE k.key_hash = ?`
-    ).get(keyHash);
+  if (callerId) {
+    const row = db.prepare("SELECT email, name FROM users WHERE id = ?").get(callerId);
     if (row) {
-      me = { email: row.email, is_admin: !!row.is_admin };
+      me = {
+        email: row.email,
+        name: row.name,
+        is_admin: isLicenseAdminEmail(row.email)
+      };
     }
   }
   return c.json({
     claimed: !!admin,
-    admin: admin ? { email: admin.email, name: admin.name } : null,
+    admin,
     me
   });
 });
+authRoutes.post("/password", authMiddleware, async (c) => {
+  const body = await c.req.json();
+  if (!body.current || !body.next) {
+    throw new ValidationError("current and next are required");
+  }
+  if (body.next.length < 8) {
+    throw new ValidationError("new password must be at least 8 characters");
+  }
+  const db = getDb();
+  const userId = c.get("userId");
+  const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
+  if (!user) return c.json({ error: "User not found" }, 404);
+  const check = await verifyPassword(body.current, user.password_hash);
+  if (!check.ok) return c.json({ error: "Invalid current password" }, 401);
+  const newHash = await hashPassword(body.next);
+  db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+    newHash,
+    userId
+  );
+  deleteAllSessionsForUser(userId);
+  clearSessionCookie(c);
+  return c.json({ ok: true });
+});
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
-  const inviteKey = parseBearerToken(c.req.header("Authorization"));
-  if (!inviteKey) {
-    return c.json({ error: "Admin authentication required" }, 401);
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json(
+      {
+        error: "Authentication required. Sign in with the admin account that owns the installed PromptOwl license to invite teammates."
+      },
+      401
+    );
   }
   const db = getDb();
-  const keyHash = hashApiKey(inviteKey);
-  const caller = db.prepare(
-    `SELECT u.id, u.is_admin FROM api_keys k
-       JOIN users u ON u.id = k.user_id
-       WHERE k.key_hash = ?`
-  ).get(keyHash);
-  if (!caller || !caller.is_admin) {
-    return c.json({ error: "Admin only" }, 403);
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      {
+        error: "Only the license-admin user can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
+      },
+      403
+    );
   }
   let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
     ).run(userId, body.email, null, placeholderHash);
     user = { id: userId, email: body.email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-  ).run(keyId, user.id, hashApiKey(apiKey), getKeyPrefix(apiKey), body.label || "teammate");
-  trackEvent("admin.invite", { adminId: caller.id, email: body.email });
+  db.transaction(() => {
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(user.id);
+    db.prepare(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
+    ).run(
+      keyId,
+      user.id,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.label || "teammate"
+    );
+  })();
+  trackEvent("admin.invite", { adminId: callerId, email: body.email });
   return c.json(
     {
       api_key: apiKey,
@@ -471,28 +1047,32 @@ authRoutes.post("/invite", async (c) => {
   );
 });
 authRoutes.get("/teammates", async (c) => {
-  const teammatesKey = parseBearerToken(c.req.header("Authorization"));
-  if (!teammatesKey) {
-    return c.json({ error: "Admin authentication required" }, 401);
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json(
+      {
+        error: "Authentication required. Sign in with the admin account that owns the installed PromptOwl license to view teammates."
+      },
+      401
+    );
   }
   const db = getDb();
-  const keyHash = hashApiKey(teammatesKey);
-  const caller = db.prepare(
-    `SELECT u.is_admin FROM api_keys k
-       JOIN users u ON u.id = k.user_id
-       WHERE k.key_hash = ?`
-  ).get(keyHash);
-  if (!caller || !caller.is_admin) {
-    return c.json({ error: "Admin only" }, 403);
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      {
+        error: "Only the license-admin user can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
+      },
+      403
+    );
   }
   const teammates = db.prepare(
-    `SELECT u.id, u.email, u.name, u.is_admin,
+    `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
-       WHERE u.id != '00000000-0000-0000-0000-000000000000'
-       ORDER BY u.is_admin DESC, u.created_at DESC`
-  ).all();
+       WHERE u.id != ?
+       ORDER BY u.created_at DESC`
+  ).all(ANON_USER_ID);
   const pendingStewards = db.prepare(
     `SELECT DISTINCT s.user_email AS email
          FROM stewards s
@@ -504,11 +1084,9 @@ authRoutes.get("/teammates", async (c) => {
           )
         ORDER BY s.user_email`
   ).all();
+  const enriched = teammates.map((t) => ({ ...t, is_admin: isLicenseAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
   return c.json({
-    teammates: teammates.map((t) => ({
-      ...t,
-      is_admin: !!t.is_admin
-    })),
+    teammates: enriched,
     pending_stewards: pendingStewards.map((p) => p.email)
   });
 });
@@ -529,6 +1107,9 @@ function resolveNestPermission(nestId, userId) {
   const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
   if (!nest) return "none";
   if (nest.user_id === userId) return "owner";
+  if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
+    return "owner";
+  }
   const directGrant = db.prepare(
     "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
@@ -567,9 +1148,10 @@ async function createNest(userId, name, description) {
   const id = uuid2();
   const slug = toSlug(name);
   const db = getDb();
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
   db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description) VALUES (?, ?, ?, ?, ?)"
-  ).run(id, userId, name, slug, description || null);
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)"
+  ).run(id, userId, name, slug, description || null, visibility);
   const path = nestPath(id);
   mkdirSync(path, { recursive: true });
   const storage = new NestStorage(path);
@@ -577,14 +1159,17 @@ async function createNest(userId, name, description) {
   trackEvent("nest.create", { nestId: id, userId });
   return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
 }
-var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
 function listNests(userId) {
   const db = getDb();
   if (userId === ANON_USER_ID) {
     return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
   }
+  const includeAnon = config.AUTH_MODE === "open" || isLicenseAdminUserId(userId);
+  if (!includeAnon) {
+    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(userId);
+  }
   return db.prepare(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
+    "SELECT * FROM nests WHERE user_id = ? OR (user_id = ? AND visibility = 'public') ORDER BY created_at DESC"
   ).all(userId, ANON_USER_ID);
 }
 function listSharedNests(userId) {
@@ -602,23 +1187,35 @@ function getNest(nestId) {
 }
 async function deleteNest(nestId) {
   const db = getDb();
-  db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(nestId);
-  db.prepare("DELETE FROM nests WHERE id = ?").run(nestId);
+  const wipe = db.transaction((id) => {
+    db.prepare("DELETE FROM approved_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM node_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM review_requests WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nest_collaborators WHERE nest_id = ?").run(id);
+    try {
+      db.prepare("DELETE FROM node_tag_index WHERE nest_id = ?").run(id);
+    } catch {
+    }
+    db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nests WHERE id = ?").run(id);
+  });
+  wipe(nestId);
   const path = nestPath(nestId);
   try {
     rmSync(path, { recursive: true, force: true });
-  } catch {
+  } catch (err) {
+    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
   }
   trackEvent("nest.delete", { nestId });
 }
 
 // src/nests/routes.ts
-var ANON_USER_ID2 = "00000000-0000-0000-0000-000000000000";
 function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
     const db = getDb();
     const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
-    if (nest && nest.user_id === ANON_USER_ID2) return "owner";
+    if (nest && nest.user_id === ANON_USER_ID) return "owner";
   }
   return resolveNestPermission(nestId, userId);
 }
@@ -627,7 +1224,23 @@ nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const owned = listNests(userId);
   const shared = listSharedNests(userId);
-  return c.json({ nests: [...owned, ...shared] });
+  const db = getDb();
+  const ownerEmailStmt = db.prepare(
+    "SELECT email FROM users WHERE id = ?"
+  );
+  const annotate = (n) => {
+    const permission = effectivePermission(n.id, userId);
+    const is_owner = permission === "owner";
+    let owner_email = null;
+    if (!is_owner && n.user_id !== ANON_USER_ID) {
+      const row = ownerEmailStmt.get(n.user_id);
+      owner_email = row?.email ?? null;
+    }
+    return { ...n, permission, is_owner, owner_email };
+  };
+  return c.json({
+    nests: [...owned.map(annotate), ...shared.map(annotate)]
+  });
 });
 nestRoutes.post("/", async (c) => {
   const body = await c.req.json();
@@ -648,10 +1261,19 @@ nestRoutes.get("/:nestId", async (c) => {
 });
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission !== "owner") {
+  const userId = c.get("userId");
+  const nest = getNest(nestId);
+  if (!nest) {
     throw new NotFoundError("Nest not found");
   }
+  const permission = effectivePermission(nestId, userId);
+  const isAnonOwned = nest.user_id === ANON_USER_ID;
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  if (permission !== "owner" && !adminCaretaker) {
+    throw new ForbiddenError(
+      "You don't have permission to delete this nest. Only the nest owner can delete it."
+    );
+  }
   await deleteNest(nestId);
   return c.json({ deleted: true });
 });
@@ -668,12 +1290,15 @@ nestRoutes.get("/:nestId/settings", async (c) => {
 nestRoutes.patch("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const db = getDb();
-  const userRow = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(userId);
-  const isServerAdmin = !!userRow?.is_admin;
+  const isServerAdmin = isLicenseAdminUserId(userId);
   const permission = effectivePermission(nestId, userId);
   if (!isServerAdmin && permission !== "owner") {
-    return c.json({ error: "Admin only" }, 403);
+    return c.json(
+      {
+        error: "Only the nest owner or the server license-admin can update nest settings."
+      },
+      403
+    );
   }
   const body = await c.req.json();
   if (typeof body.stewardship_enabled === "boolean") {
@@ -711,7 +1336,7 @@ sharingRoutes.post("/collaborators", async (c) => {
       const { hashPassword: hashPassword2 } = await import("./keys-YV33AJK3.js");
       userId = uuid3();
       db.prepare(
-        "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
       ).run(userId, body.email, null, await hashPassword2(uuid3()));
     } else {
       userId = user.id;
@@ -765,32 +1390,26 @@ sharingRoutes.patch("/visibility", async (c) => {
   return c.json({ visibility: body.visibility });
 });
 
+// src/governance/access-guard.ts
+function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
+  const db = getDb();
+  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return row?.email || "admin@localhost";
+}
+function canReadNode(nestId, nodeId, userEmail) {
+  if (!isStewardshipEnabled(nestId)) return true;
+  return canUserAccess(nestId, nodeId, userEmail).allowed;
+}
+function filterAccessible(nestId, userEmail, nodes) {
+  if (!isStewardshipEnabled(nestId)) return nodes;
+  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+}
+
 // src/nodes/routes.ts
 import { Hono as Hono4 } from "hono";
 import { serializeDocument } from "@promptowl/contextnest-engine";
 
-// src/nodes/engine.ts
-import { join as join2 } from "path";
-import { NestStorage as NestStorage2, GraphQueryEngine } from "@promptowl/contextnest-engine";
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath2 = join2(config.DATA_ROOT, "nests", nestId);
-      const storage = new NestStorage2(nestPath2);
-      const query = new GraphQueryEngine(storage);
-      engine = { storage, query };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-
 // src/governance/tag-index-service.ts
 function normalizeTag(raw) {
   return raw.trim().replace(/^#+/, "").toLowerCase();
@@ -821,20 +1440,220 @@ function removeNodeFromTagIndex(nestId, nodeId) {
   ).run(nestId, nodeId);
 }
 
-// src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
-  if (!userId) return "admin@localhost";
-  const db = getDb();
-  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
-  return row?.email || "admin@localhost";
+// src/governance/external-edit-service.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+import {
+  detectDrift,
+  stageSuggestion,
+  approveSuggestion,
+  rejectSuggestion,
+  listSuggestions,
+  readSuggestion,
+  VersionManager
+} from "@promptowl/contextnest-engine";
+var communityRbac = {
+  isCzar: () => false,
+  canIngest: () => true,
+  isDocOwner: () => true
+};
+function docPath(nestId, documentId) {
+  return join2(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
 }
-function canReadNode(nestId, nodeId, userEmail) {
-  if (!isStewardshipEnabled(nestId)) return true;
-  return canUserAccess(nestId, nodeId, userEmail).allowed;
+async function readRaw(nestId, documentId) {
+  try {
+    return await readFile(docPath(nestId, documentId), "utf-8");
+  } catch {
+    return null;
+  }
 }
-function filterAccessible(nestId, userEmail, nodes) {
-  if (!isStewardshipEnabled(nestId)) return nodes;
-  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+async function loadChainHead(storage, documentId) {
+  const history = await storage.readHistory(documentId);
+  if (!history || history.versions.length === 0) return null;
+  const latest = history.versions[history.versions.length - 1];
+  try {
+    const content = await new VersionManager(storage).reconstructVersion(
+      documentId,
+      latest.version
+    );
+    return { version: latest.version, content };
+  } catch {
+    return null;
+  }
+}
+async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
+  const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
+  return res?.meta ?? null;
+}
+async function scanDocumentForDriftInternal(nestId, documentId, actor) {
+  const { storage } = engineCache.get(nestId);
+  const node = await storage.readDocument(documentId).catch(() => null);
+  if (!node) return null;
+  const raw = await readRaw(nestId, documentId);
+  if (raw == null) return null;
+  const drift = detectDrift(raw, node.frontmatter.checksum);
+  if (!drift.drifted) return null;
+  const approved = await loadChainHead(storage, documentId);
+  if (!approved) return null;
+  const existing = await listSuggestions(storage, documentId);
+  const dup = existing.find((s) => s.proposed_hash === drift.actualHash);
+  if (dup) return { meta: dup, created: false };
+  const result = await stageSuggestion({
+    storage,
+    documentId,
+    approvedRawContent: approved.content,
+    proposedRawContent: raw,
+    source: "out-of-band-edit",
+    actor,
+    docTier: "standard"
+  });
+  return { meta: result.meta, created: true };
+}
+async function scanNestForDrift(nestId, actor = "system:scanner") {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const results = await Promise.all(
+    docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
+  );
+  const staged = results.filter((r) => r?.created).length;
+  return { scanned: docs.length, staged };
+}
+async function getPendingChange(nestId, documentId) {
+  const { storage } = engineCache.get(nestId);
+  const list = await listSuggestions(storage, documentId);
+  if (list.length === 0) return null;
+  const latest = list[list.length - 1];
+  return {
+    suggestion_id: latest.suggestion_id,
+    detected_at: latest.detected_at,
+    source: latest.source,
+    proposed_hash: latest.proposed_hash
+  };
+}
+async function listNestExternalEdits(nestId) {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const lists = await Promise.all(
+    docs.map((doc) => listSuggestions(storage, doc.id))
+  );
+  const entries = lists.flat().map((meta) => ({
+    suggestion_id: meta.suggestion_id,
+    nest_id: nestId,
+    document_id: meta.document_id,
+    source: meta.source,
+    detected_at: meta.detected_at,
+    actor: meta.actor,
+    target_hash: meta.target_hash,
+    proposed_hash: meta.proposed_hash,
+    note: meta.note
+  }));
+  return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
+}
+async function getExternalEditDetail(nestId, documentId, suggestionId) {
+  const { storage } = engineCache.get(nestId);
+  const found = await readSuggestion(storage, documentId, suggestionId);
+  if (!found) return null;
+  return {
+    suggestion_id: found.meta.suggestion_id,
+    nest_id: nestId,
+    document_id: found.meta.document_id,
+    source: found.meta.source,
+    detected_at: found.meta.detected_at,
+    actor: found.meta.actor,
+    target_hash: found.meta.target_hash,
+    proposed_hash: found.meta.proposed_hash,
+    note: found.meta.note,
+    patch: found.patch
+  };
+}
+async function approveExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  let result;
+  try {
+    result = await approveSuggestion({
+      storage,
+      rbac: communityRbac,
+      documentId: input.documentId,
+      suggestionId: input.suggestionId,
+      actor: input.actor,
+      zone: "default",
+      comment: input.comment
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] approveSuggestion failed for ${input.nestId}/${input.documentId} suggestion=${input.suggestionId}:`,
+      err
+    );
+    throw err;
+  }
+  try {
+    const node = await storage.readDocument(input.documentId);
+    const versionNum = result.versionEntry.version;
+    const tags = node.frontmatter.tags || [];
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
+    createVersion2({
+      nestId: input.nestId,
+      nodeId: input.documentId,
+      version: versionNum,
+      content: node.body || "",
+      author: input.actor,
+      status: "published",
+      tags,
+      changeNote: input.comment || "External edit approved"
+    });
+    setApprovedVersion2(input.nestId, input.documentId, versionNum, input.actor);
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+async function rejectExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  const result = await rejectSuggestion({
+    storage,
+    rbac: communityRbac,
+    documentId: input.documentId,
+    suggestionId: input.suggestionId,
+    actor: input.actor,
+    zone: "default",
+    reason: input.reason
+  });
+  try {
+    const approved = await loadChainHead(storage, input.documentId);
+    if (approved) {
+      await storage.writeDocument(input.documentId, approved.content);
+    }
+  } catch (err) {
+    console.error(
+      `[external-edit] revert-on-reject failed for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+var scannerTimer = null;
+async function scanAllNests() {
+  const db = getDb();
+  const rows = db.prepare("SELECT id FROM nests").all();
+  await Promise.all(
+    rows.map(
+      ({ id }) => scanNestForDrift(id).catch(
+        (err) => console.error(`[external-edit] scan failed for nest ${id}:`, err)
+      )
+    )
+  );
+}
+function startDriftScanner(intervalMs = 3e4) {
+  if (scannerTimer) return;
+  scannerTimer = setInterval(() => {
+    scanAllNests().catch(
+      (err) => console.error("[external-edit] scanner tick failed:", err)
+    );
+  }, intervalMs);
+  scannerTimer.unref?.();
 }
 
 // src/nodes/routes.ts
@@ -845,13 +1664,17 @@ function toNodeResponse(node) {
     title: node.frontmatter.title,
     type: node.frontmatter.type || "document",
     tags: node.frontmatter.tags || [],
+    // Widen to string so callers can layer review-workflow states like
+    // "pending_review" / "rejected" on top of the on-disk frontmatter
+    // status. The engine's Status enum only knows draft/approved.
     status: node.frontmatter.status || "draft",
     version: node.frontmatter.version || 1,
     author: node.frontmatter.author,
     description: node.frontmatter.description,
     created_at: node.frontmatter.created_at,
     updated_at: node.frontmatter.updated_at,
-    content: node.body
+    content: node.body,
+    pendingChange: node.pendingChange ?? void 0
   };
 }
 nodeRoutes.get("/", async (c) => {
@@ -860,9 +1683,29 @@ nodeRoutes.get("/", async (c) => {
   const documents = await storage.discoverDocuments();
   const userEmail = resolveCallerEmail(c.get("userId"));
   const accessible = filterAccessible(nestId, userEmail, documents);
+  const pendingByDoc = /* @__PURE__ */ new Map();
+  await Promise.all(
+    accessible.map(async (doc) => {
+      try {
+        pendingByDoc.set(doc.id, await getPendingChange(nestId, doc.id));
+      } catch {
+        pendingByDoc.set(doc.id, null);
+      }
+    })
+  );
   return c.json({
     count: accessible.length,
-    nodes: accessible.map(toNodeResponse)
+    nodes: accessible.map((doc) => {
+      const r = toNodeResponse(doc);
+      const pending = pendingByDoc.get(doc.id);
+      if (pending) {
+        r.pendingChange = pending;
+        r.status = "external_edit_pending";
+      } else {
+        r.status = getDisplayStatus(nestId, r.id);
+      }
+      return r;
+    })
   });
 });
 nodeRoutes.post("/", async (c) => {
@@ -871,14 +1714,15 @@ nodeRoutes.post("/", async (c) => {
     throw new ValidationError("title and content are required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = engineCache.get(nestId);
   const slug = body.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   const id = `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = body.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
   const hasStewards = isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "approved";
-  const node = {
+  const initialVersion = hasStewards ? 1 : 0;
+  let node = {
     id,
     filePath: "",
     frontmatter: {
@@ -886,7 +1730,7 @@ nodeRoutes.post("/", async (c) => {
       type: body.type || "document",
       tags,
       status: body.status || initialStatus,
-      version: 1,
+      version: initialVersion,
       created_at: now,
       updated_at: now,
       metadata: {
@@ -901,17 +1745,51 @@ nodeRoutes.post("/", async (c) => {
   await storage.writeDocument(id, serialized);
   syncNodeTags(nestId, id, tags);
   const authorEmail = getUserEmail(c);
-  createVersion({
-    nestId,
-    nodeId: id,
-    version: 1,
-    content: body.content,
-    author: authorEmail,
-    status: initialStatus,
-    tags
-  });
-  if (initialStatus === "approved") {
-    setApprovedVersion(nestId, id, 1, authorEmail);
+  if (hasStewards) {
+    try {
+      await versionManager.createVersion(node, authorEmail);
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node create)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId: id,
+      version: 1,
+      content: body.content,
+      author: authorEmail,
+      status: "draft",
+      tags
+    });
+  } else {
+    try {
+      const result = await safePublishDocument(storage, id, {
+        editedBy: authorEmail,
+        note: "Auto-published on create (no stewards configured)"
+      });
+      const publishedVersion = result.node.frontmatter.version || 2;
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: publishedVersion,
+        content: result.node.body || "",
+        author: authorEmail,
+        status: "published",
+        tags
+      });
+      setApprovedVersion(nestId, id, publishedVersion, authorEmail);
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node create auto-publish)", err);
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: 1,
+        content: body.content,
+        author: authorEmail,
+        status: "draft",
+        tags
+      });
+    }
   }
   trackEvent("node.create", { nestId, nodeId: id });
   const resolved = resolveStewardsForNode(nestId, id);
@@ -927,7 +1805,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-NC67XBYO.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-C5D2O7ZE.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -939,8 +1817,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -949,11 +1826,30 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-Z6FYJRAG.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
+  const db = getDb();
+  const resolutions = db.prepare(
+    `SELECT version, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ? AND node_id = ?
+          AND status IN ('approved', 'rejected')
+          AND resolved_by IS NOT NULL
+        ORDER BY resolved_at DESC`
+  ).all(nestId, nodeId);
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const r of resolutions) {
+    if (!byVersion.has(r.version)) {
+      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+    }
+  }
+  const enriched = allVersions.map((v) => {
+    const r = byVersion.get(v.version);
+    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
+  });
   return c.json({
-    versions: allVersions,
+    versions: enriched,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
@@ -961,7 +1857,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-5CLVZKAR.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-4WS3XL6K.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -976,17 +1872,29 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       403
     );
   }
+  let node;
   try {
-    const node = await storage.readDocument(nodeId);
-    return c.json({ node: toNodeResponse(node) });
+    node = await storage.readDocument(nodeId, { verifyChecksum: true });
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
+  if (node.pendingChange) {
+    try {
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
+    } catch (err) {
+      console.error("[external-edit] stage-on-read failed:", err);
+    }
+  }
+  const response = toNodeResponse(node);
+  response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
+  return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = engineCache.get(nestId);
   const body = await c.req.json();
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
@@ -1035,40 +1943,99 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       frontmatter: { ...node.frontmatter, title: body.title }
     };
   }
-  const currentVersion = getCurrentVersion(nestId, nodeId);
-  const newVersion = currentVersion + 1;
-  node = {
-    ...node,
-    frontmatter: {
-      ...node.frontmatter,
-      version: newVersion,
-      updated_at: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  const fm = Object.fromEntries(
-    Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
-  );
-  node = { ...node, frontmatter: fm };
-  const serialized = serializeDocument(node);
-  await storage.writeDocument(nodeId, serialized);
   const authorEmail = getUserEmail(c);
   const hasStewards = isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  syncNodeTags(nestId, nodeId, currentTags);
-  createVersion({
-    nestId,
-    nodeId,
-    version: newVersion,
-    content: node.body || "",
-    author: authorEmail,
-    status: hasStewards ? "draft" : "approved",
-    tags: currentTags,
-    changeNote: body.changeNote
-  });
-  if (!hasStewards) {
-    setApprovedVersion(nestId, nodeId, newVersion, authorEmail);
+  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-4WS3XL6K.js");
+  if (getPendingReview2(nestId, nodeId)) {
+    cancelReview2({ nestId, nodeId, cancelledBy: authorEmail });
+  }
+  let responseVersion;
+  if (hasStewards) {
+    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const newVersion = currentVersion + 1;
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        version: newVersion,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Strip the stale published-state checksum — the body just
+        // changed, so leaving the old hash would make the next GET (with
+        // verifyChecksum: true) flag the file as an external edit even
+        // though *this* app wrote it. Engine treats absent checksum as
+        // "no baseline" and skips drift detection until publish runs.
+        checksum: void 0
+      }
+    };
+    const fm = Object.fromEntries(
+      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
+    );
+    node = { ...node, frontmatter: fm };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    try {
+      await versionManager.createVersion(node, authorEmail, {
+        note: body.changeNote
+      });
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node patch)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: newVersion,
+      content: node.body || "",
+      author: authorEmail,
+      status: "draft",
+      tags: currentTags,
+      changeNote: body.changeNote
+    });
+    responseVersion = newVersion;
+  } else {
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Drop the prior published-state checksum before the interim
+        // write — publish recomputes it from the new body, but if
+        // publish errors out the file would otherwise be left with new
+        // body + stale checksum and drift on next read.
+        checksum: void 0
+      }
+    };
+    const fm = Object.fromEntries(
+      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
+    );
+    node = { ...node, frontmatter: fm };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    let publishedVersion = (node.frontmatter.version || 0) + 1;
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: authorEmail,
+        note: body.changeNote || "Auto-published on edit (no stewards)"
+      });
+      publishedVersion = result.node.frontmatter.version || publishedVersion;
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node patch auto-publish)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: publishedVersion,
+      content: node.body || "",
+      author: authorEmail,
+      status: "published",
+      tags: currentTags,
+      changeNote: body.changeNote
+    });
+    setApprovedVersion(nestId, nodeId, publishedVersion, authorEmail);
+    responseVersion = publishedVersion;
   }
-  return c.json({ node: toNodeResponse(node), version: newVersion });
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
 });
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
@@ -1080,6 +2047,18 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
   removeNodeFromTagIndex(nestId, nodeId);
+  const db = getDb();
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    db.prepare(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    db.prepare(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+  })();
   trackEvent("node.delete", { nestId, nodeId });
   return c.json({ deleted: true });
 });
@@ -1743,21 +2722,32 @@ var TOOL_DEFINITIONS = [
   },
   {
     name: "context_assign_steward",
-    description: "Assign a data steward to govern a scope (nest, tag, folder pattern, or specific document). Stewards review and approve changes before they go live.",
+    description: "Assign a data steward to govern a scope (nest, tag, or specific document). Stewards review and approve changes before they go live.",
     inputSchema: {
       type: "object",
       properties: {
         email: { type: "string", description: "Email of the person to assign as steward" },
-        scope: { type: "string", description: "Scope: nest (all docs), tag, folder, or document" },
-        target: { type: "string", description: "Scope target: tag name (e.g. #architecture), folder pattern (e.g. nodes/api-*), or document title" },
+        scope: { type: "string", description: "Scope: nest (all docs), tag, or document" },
+        target: { type: "string", description: "Scope target: tag name (e.g. #architecture) or document title" },
         role: { type: "string", description: "Role: reviewer (default), editor, or viewer" }
       },
       required: ["email", "scope"]
     }
   }
 ];
+async function resolveLlmBody(ctx, node) {
+  if (!isStewardshipEnabled(ctx.nestId)) return node.body || "";
+  const approved = getApprovedVersion(ctx.nestId, node.id);
+  if (approved == null) return null;
+  try {
+    return await ctx.versionManager.reconstructVersion(node.id, approved);
+  } catch (err) {
+    console.error("reconstructVersion failed", node.id, approved, err);
+    return null;
+  }
+}
 async function handleToolCall(toolName, args, ctx) {
-  const { storage, queryEngine, nestId, userEmail } = ctx;
+  const { storage, queryEngine, versionManager, nestId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
       const content = await storage.readContextMd();
@@ -1798,14 +2788,23 @@ ${nodeList}`;
     case "context_search": {
       const docs = await storage.discoverDocuments();
       const terms = (args.query || "").toLowerCase().split(/\s+/).filter(Boolean);
-      const matches = docs.filter((n) => {
-        const hay = [n.frontmatter.title, n.body || "", n.frontmatter.type || "", ...n.frontmatter.tags || []].join(" ").toLowerCase();
+      const enriched = await Promise.all(
+        docs.map(async (n) => ({ node: n, body: await resolveLlmBody(ctx, n) }))
+      );
+      const visible = enriched.filter((e) => e.body !== null);
+      const matches = visible.filter(({ node: n, body }) => {
+        const hay = [
+          n.frontmatter.title,
+          body || "",
+          n.frontmatter.type || "",
+          ...n.frontmatter.tags || []
+        ].join(" ").toLowerCase();
         return terms.every((t) => hay.includes(t));
       });
       if (!matches.length) return `No nodes matched search: "${args.query}"`;
       const results = matches.map(
-        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}
-   ${(n.body || "").slice(0, 200).replace(/\n/g, " ")}`
+        ({ node: n, body }, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}
+   ${(body || "").slice(0, 200).replace(/\n/g, " ")}`
       ).join("\n\n");
       return `Found ${matches.length} node(s) matching "${args.query}":
 
@@ -1833,6 +2832,10 @@ ${list}`;
         node = docs.find((n) => n.id === args.id);
       }
       if (!node) return `Node not found: ${args.title || args.id}`;
+      const body = await resolveLlmBody(ctx, node);
+      if (body === null) {
+        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      }
       const meta = [
         `**Title:** ${node.frontmatter.title}`,
         `**Type:** ${node.frontmatter.type || "document"}`,
@@ -1842,7 +2845,7 @@ ${list}`;
 
 ---
 
-${node.body || "(no content)"}`;
+${body || "(no content)"}`;
     }
     case "context_list": {
       let docs = await storage.discoverDocuments();
@@ -1852,6 +2855,11 @@ ${node.body || "(no content)"}`;
         const tag = args.tag.startsWith("#") ? args.tag : `#${args.tag}`;
         docs = docs.filter((n) => n.frontmatter.tags?.includes(tag));
       }
+      if (isStewardshipEnabled(nestId)) {
+        docs = docs.filter(
+          (n) => getApprovedVersion(nestId, n.id) != null
+        );
+      }
       docs = docs.slice(0, args.limit || 50);
       if (!docs.length) return "No nodes found with the given filters.";
       const list = docs.map(
@@ -1904,6 +2912,11 @@ ${n.body || ""}`;
       };
       await storage.writeDocument(id, serializeDocument3(node));
       syncNodeTags(nestId, id, tags);
+      try {
+        await versionManager.createVersion(node, userEmail);
+      } catch (err) {
+        console.error("VersionManager.createVersion failed (mcp create)", err);
+      }
       createVersion({
         nestId,
         nodeId: id,
@@ -1934,16 +2947,45 @@ ${n.body || ""}`;
         );
         tags = [.../* @__PURE__ */ new Set([...tags, ...newTags])];
       }
+      const prevVersion = getCurrentVersion(nestId, node.id);
+      const newVersion = prevVersion + 1;
+      const hasStewards = isStewardshipEnabled(nestId);
       const updated = {
         ...node,
         body,
         frontmatter: {
           ...node.frontmatter,
           tags,
+          version: newVersion,
           updated_at: (/* @__PURE__ */ new Date()).toISOString()
         }
       };
       await storage.writeDocument(node.id, serializeDocument3(updated));
+      try {
+        await versionManager.createVersion(updated, userEmail);
+      } catch (err) {
+        console.error("VersionManager.createVersion failed (mcp update)", err);
+      }
+      syncNodeTags(nestId, node.id, tags);
+      createVersion({
+        nestId,
+        nodeId: node.id,
+        version: newVersion,
+        content: body,
+        author: userEmail,
+        status: hasStewards ? "draft" : "approved",
+        tags
+      });
+      if (getPendingReview(nestId, node.id)) {
+        cancelReview({
+          nestId,
+          nodeId: node.id,
+          cancelledBy: userEmail
+        });
+      }
+      if (!hasStewards) {
+        setApprovedVersion(nestId, node.id, newVersion, userEmail);
+      }
       return `Updated node: **${node.frontmatter.title}**`;
     }
     // ─── Governance Tool Handlers ──────────────────────────────────────
@@ -1959,7 +3001,7 @@ ${n.body || ""}`;
           return `No stewards configured for "${args.title}". Changes are auto-approved.`;
         }
         const list = resolved.map(
-          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.canApprove ? " \u2713 can approve" : ""}`
+          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.role === "reviewer" ? " \u2713 can approve" : ""}`
         ).join("\n");
         return `# Stewards for "${args.title}"
 
@@ -1971,12 +3013,12 @@ ${list}`;
       }
       const byScope = {};
       for (const s of allStewards) {
-        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : s.scope === "folder" ? `Folder: ${s.nodePattern}` : `Document: ${s.nodePattern}`;
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodePattern}`;
         (byScope[key] = byScope[key] || []).push(s);
       }
       const sections = Object.entries(byScope).map(
         ([scope, stewards]) => `## ${scope}
-${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.canApprove ? " \u2014 can approve" : ""}`).join("\n")}`
+${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.role === "reviewer" ? " \u2014 can approve" : ""}`).join("\n")}`
       ).join("\n\n");
       return `# Data Stewards
 
@@ -2039,7 +3081,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
       if (!node) return `Node not found: ${args.title}`;
       const currentVersion = getCurrentVersion(ctx.nestId, node.id);
       try {
-        const request = approve({
+        const request = await approve({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -2094,19 +3136,17 @@ ${list}`;
     }
     case "context_assign_steward": {
       const scope = args.scope;
-      if (!["nest", "tag", "folder", "document"].includes(scope)) {
-        return `Invalid scope "${args.scope}". Use: nest, tag, folder, or document.`;
+      if (!["nest", "tag", "document"].includes(scope)) {
+        return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
       }
       try {
         assignSteward({
           nestId: ctx.nestId,
           scope,
-          nodePattern: scope === "folder" || scope === "document" ? args.target : void 0,
+          nodePattern: scope === "document" ? args.target : void 0,
           tagName: scope === "tag" ? args.target : void 0,
           userEmail: args.email,
           role: args.role || "reviewer",
-          canApprove: true,
-          canReject: true,
           assignedBy: ctx.userEmail,
           assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
           isActive: true
@@ -2153,6 +3193,7 @@ function createMcpServerForNest(nestId, userEmail) {
       const text = await handleToolCall(tool.name, args, {
         storage: engine.storage,
         queryEngine: engine.query,
+        versionManager: engine.versions,
         nestId,
         userEmail
       });
@@ -2184,7 +3225,7 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync, existsSync } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join3 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
@@ -2196,9 +3237,6 @@ function parseStewardsYaml(content) {
     if (!currentSection || currentEntries.length === 0) return;
     if (currentSection === "nest") {
       result.nest = [...result.nest || [], ...currentEntries];
-    } else if (currentSection === "folders" && currentTarget) {
-      result.folders = result.folders || {};
-      result.folders[currentTarget] = currentEntries;
     } else if (currentSection === "tags" && currentTarget) {
       result.tags = result.tags || {};
       result.tags[currentTarget] = currentEntries;
@@ -2218,12 +3256,12 @@ function parseStewardsYaml(content) {
       if (key === "version") continue;
       if (key === "nest" || key === "data_room") {
         currentSection = "nest";
-      } else if (key === "folders") {
-        currentSection = "folders";
       } else if (key === "tags") {
         currentSection = "tags";
       } else if (key === "documents") {
         currentSection = "documents";
+      } else if (key === "folders") {
+        currentSection = null;
       }
       continue;
     }
@@ -2249,12 +3287,6 @@ function parseEntry(str) {
   const entry = { email: emailMatch[1] };
   const roleMatch = str.match(/role:\s*["']?(\w+)["']?/);
   if (roleMatch) entry.role = roleMatch[1];
-  if (str.includes("can_approve:")) {
-    entry.can_approve = str.includes("can_approve: true");
-  }
-  if (str.includes("can_reject:")) {
-    entry.can_reject = str.includes("can_reject: true");
-  }
   return entry;
 }
 function loadStewardsConfig(nestId) {
@@ -2266,8 +3298,8 @@ function loadStewardsConfig(nestId) {
     join3(nestPath2, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
-    if (existsSync(candidatePath)) {
-      const content = readFileSync(candidatePath, "utf-8");
+    if (existsSync2(candidatePath)) {
+      const content = readFileSync2(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -2292,12 +3324,16 @@ governanceRoutes.post("/stewards", async (c) => {
   const body = await c.req.json();
   const assignedBy = getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
+  if (body.scope === "folder") {
+    throw new ValidationError(
+      "folder scope is no longer supported \u2014 use 'nest' or 'document'"
+    );
+  }
   if (Array.isArray(body.users)) {
-    const created2 = createStewardRecord({
+    const created2 = await createStewardRecord({
       nestId,
       scope: body.scope,
       documentId: body.documentId,
-      folderPath: body.folderPath,
       tagName: body.tagName,
       users: body.users,
       assignedBy
@@ -2307,18 +3343,15 @@ governanceRoutes.post("/stewards", async (c) => {
   if (!body.email) {
     throw new ValidationError("users[] or email is required");
   }
-  const created = createStewardRecord({
+  const created = await createStewardRecord({
     nestId,
     scope: body.scope,
     documentId: body.scope === "document" ? body.nodePattern : void 0,
-    folderPath: body.scope === "folder" ? body.nodePattern : void 0,
     tagName: body.scope === "tag" ? body.tagName : void 0,
     users: [
       {
         email: body.email,
-        role: body.role,
-        canApprove: body.canApprove,
-        canReject: body.canReject
+        role: body.role
       }
     ],
     assignedBy
@@ -2352,6 +3385,21 @@ governanceRoutes.get("/review-queue", async (c) => {
   });
   return c.json(result);
 });
+governanceRoutes.get("/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const refresh = c.req.query("refresh") === "true";
+  if (refresh) {
+    await scanNestForDrift(nestId, "user:refresh");
+  }
+  const entries = await listNestExternalEdits(nestId);
+  return c.json({ entries, total: entries.length });
+});
+governanceRoutes.post("/external-edits/scan", async (c) => {
+  const nestId = c.req.param("nestId");
+  const actor = getUserEmail3(c);
+  const result = await scanNestForDrift(nestId, actor);
+  return c.json(result);
+});
 var governanceNodeRoutes = new Hono7();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
@@ -2364,8 +3412,7 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -2397,14 +3444,23 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     throw new ValidationError("Node has no versions to review");
   }
   const userEmail = getUserEmail3(c);
-  const request = submitForReview({
-    nestId,
-    nodeId,
-    version: currentVersion,
-    requestedBy: userEmail,
-    note: body.note,
-    priority: body.priority
-  });
+  let request;
+  try {
+    request = submitForReview({
+      nestId,
+      nodeId,
+      version: currentVersion,
+      requestedBy: userEmail,
+      note: body.note,
+      priority: body.priority
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/already pending/i.test(msg)) {
+      throw new ConflictError(msg);
+    }
+    throw err;
+  }
   const resolved = resolveStewardsForNode(nestId, nodeId);
   return c.json(
     {
@@ -2425,7 +3481,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const userEmail = getUserEmail3(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
-    const request = approve({
+    const request = await approve({
       nestId,
       nodeId,
       version: getCurrentVersion(nestId, nodeId),
@@ -2477,6 +3533,90 @@ governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const userEmail = getUserEmail3(c);
   return c.json(canUserEdit(nestId, nodeId, userEmail));
 });
+governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const pending = await getPendingChange(nestId, nodeId);
+  return c.json({ pending });
+});
+governanceNodeRoutes.get(
+  "/:nodeId{.+?}/external-edits/:suggestionId",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const detail = await getExternalEditDetail(
+      nestId,
+      nodeId,
+      suggestionId
+    );
+    if (!detail) {
+      return c.json({ error: "Suggestion not found" }, 404);
+    }
+    return c.json({ entry: detail });
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/approve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    const actor = getUserEmail3(c);
+    try {
+      const result = await approveExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        comment: body.comment
+      });
+      return c.json({
+        approved: true,
+        version: result.versionEntry.version,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      console.error(
+        `[external-edit-route] approve failed nest=${nestId} node=${nodeId} suggestion=${suggestionId}`,
+        { message: err?.message, name: err?.name, stack: err?.stack }
+      );
+      return c.json(
+        { error: err.message, name: err?.name },
+        400
+      );
+    }
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/reject",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.reason) {
+      throw new ValidationError("Rejection reason is required");
+    }
+    const actor = getUserEmail3(c);
+    try {
+      const result = await rejectExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        reason: body.reason
+      });
+      return c.json({
+        rejected: true,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  }
+);
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -2497,186 +3637,29 @@ function getUserEmail3(c) {
 
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
-var ANON_USER_ID3 = "00000000-0000-0000-0000-000000000000";
-var ANON_EMAIL = "admin@localhost";
 function ensureAnonymousUser() {
   const db = getDb();
-  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID3);
+  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID);
   if (!exists) {
     const placeholder = bcrypt.hashSync("anon-no-login", 4);
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(ANON_USER_ID3, ANON_EMAIL, "Admin", placeholder);
-  }
-  return ANON_USER_ID3;
-}
-
-// src/auth/license.ts
-var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var suspensionFirstSeen = null;
-var suspensionConfirmed = false;
-var suspensionReason = null;
-var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
-function isSuspended() {
-  return suspensionConfirmed;
-}
-function getSuspensionReason() {
-  return suspensionReason;
-}
-async function validateLicense() {
-  const key = config.PROMPTOWL_KEY;
-  if (!key) {
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null
-    };
-  }
-  const db = getDb();
-  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
-  if (cached) {
-    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
-    if (age < CACHE_TTL_MS) {
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason
-      };
-    }
-  }
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ key })
-    });
-    if (!res.ok) {
-      if (cached) {
-        console.warn(
-          "  PromptOwl unreachable, using cached license (grace period)"
-        );
-        return {
-          valid: true,
-          tier: cached.tier,
-          org: cached.org,
-          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-          suspended: suspensionConfirmed,
-          suspendedReason: suspensionReason
-        };
-      }
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null
-      };
-    }
-    const data = await res.json();
-    if (data.suspended === true) {
-      if (!suspensionFirstSeen) {
-        suspensionFirstSeen = Date.now();
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.warn(
-          `
-  WARNING: PromptOwl has flagged this server for suspension.`
-        );
-        console.warn(
-          `  Reason: ${suspensionReason}`
-        );
-        console.warn(
-          `  This will be confirmed in ~1 hour. If this is an error,`
-        );
-        console.warn(
-          `  contact support@promptowl.ai to reverse it.
-`
-        );
-      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
-        suspensionConfirmed = true;
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.error(
-          `
-  SERVER SUSPENDED: ${suspensionReason}`
-        );
-        console.error(
-          `  Write operations are disabled. Reads still work.`
-        );
-        console.error(
-          `  Contact support@promptowl.ai to resolve.
-`
-        );
-      }
-    } else {
-      if (suspensionFirstSeen) {
-        console.log("  Suspension flag cleared by PromptOwl.");
-      }
-      suspensionFirstSeen = null;
-      suspensionConfirmed = false;
-      suspensionReason = null;
-    }
-    if (!data.valid && !data.suspended) {
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null
-      };
-    }
-    if (data.valid) {
-      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
-      db.prepare(
-        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, validated_at)
-         VALUES (?, ?, ?, ?, datetime('now'))`
-      ).run(key, data.tier || "community", data.org || null, limitsJson);
-    }
-    return {
-      valid: data.valid !== false,
-      tier: data.tier || "community",
-      org: data.org || null,
-      limits: data.limits || null,
-      suspended: suspensionConfirmed,
-      suspendedReason: suspensionReason
-    };
-  } catch (err) {
-    if (cached) {
-      console.warn(
-        `  PromptOwl validation failed (${err.message}), using cached license`
-      );
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason
-      };
-    }
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null
-    };
+    ).run(ANON_USER_ID, ANON_EMAIL, "Admin", placeholder);
   }
+  return ANON_USER_ID;
 }
 
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
 import { dirname, join as join4, relative } from "path";
-var UI_DIR_ABS = join4(dirname(fileURLToPath(import.meta.url)), "web3");
+import { existsSync as existsSync3 } from "fs";
+var HERE = dirname(fileURLToPath(import.meta.url));
+var UI_DIR_CANDIDATES = [
+  join4(HERE, "web3"),
+  join4(process.cwd(), "dist", "web3")
+];
+var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync3(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
@@ -2685,8 +3668,9 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
   await next();
 });
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
-  const header = c.req.header("Authorization");
-  if (header?.startsWith("Bearer cnst_")) {
+  const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
+  const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
+  if (hasBearer || hasCookie) {
     return authMiddleware(c, next);
   }
   if (config.AUTH_MODE === "open") {
@@ -2695,11 +3679,10 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     c.set("nestScope", null);
     return next();
   }
-  return c.json({ error: "Missing or invalid API key" }, 401);
+  return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
   const app = new Hono8();
-  app.use("*", logger());
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -2730,7 +3713,101 @@ function createApp() {
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
+  app.use("/auth/invite", async (c, next) => {
+    if (!getCurrentLicense()?.valid) {
+      return c.json(
+        {
+          error: "License required",
+          reason: "Install a valid PromptOwl license key before inviting teammates."
+        },
+        503
+      );
+    }
+    return next();
+  });
+  app.use("/auth/teammates", async (c, next) => {
+    if (!getCurrentLicense()?.valid) {
+      return c.json(
+        {
+          error: "License required",
+          reason: "Install a valid PromptOwl license key to view teammates."
+        },
+        503
+      );
+    }
+    return next();
+  });
   app.route("/auth", authRoutes);
+  app.get("/license/status", (c) => {
+    const lic = getCurrentLicense();
+    return c.json({
+      valid: !!lic?.valid,
+      tier: lic?.tier || "none",
+      org: lic?.org || null,
+      owner_email: lic?.ownerEmail || null,
+      suspended: !!lic?.suspended,
+      suspended_reason: lic?.suspendedReason || null,
+      limits: lic?.limits || null
+    });
+  });
+  app.post("/license/install", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const key = body?.key?.trim();
+    if (!key || !key.startsWith("pk_")) {
+      return c.json(
+        { error: "Invalid license key. Must start with pk_." },
+        400
+      );
+    }
+    try {
+      const info = await installLicenseKey(key);
+      if (!info.valid) {
+        return c.json(
+          {
+            valid: false,
+            error: "PromptOwl rejected this license key. It wasn't saved. Verify the key is correct and active, then try again."
+          },
+          400
+        );
+      }
+      return c.json({
+        valid: true,
+        tier: info.tier,
+        org: info.org,
+        limits: info.limits
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Failed to install key";
+      return c.json({ error: msg }, 500);
+    }
+  });
+  app.use("/stats", flexAuthMiddleware);
+  app.get("/stats", async (c) => {
+    const db = getDb();
+    const userId = c.get("userId");
+    const userEmail = resolveCallerEmail(userId);
+    const visibleNests = [...listNests(userId), ...listSharedNests(userId)];
+    let documents = 0;
+    for (const nest of visibleNests) {
+      try {
+        const { storage } = engineCache.get(nest.id);
+        const docs = await storage.discoverDocuments();
+        documents += filterAccessible(nest.id, userEmail, docs).length;
+      } catch {
+      }
+    }
+    const usersRow = db.prepare("SELECT COUNT(*) as c FROM users").get();
+    return c.json({
+      nests: visibleNests.length,
+      documents,
+      users: usersRow.c
+    });
+  });
   const nestsApp = new Hono8();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
@@ -2753,6 +3830,24 @@ function createApp() {
         503
       );
     }
+    {
+      const path2 = c.req.path;
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit");
+      const needsLicense = c.req.method !== "GET" || isGovernance;
+      if (needsLicense) {
+        const lic = getCurrentLicense();
+        if (!lic?.valid) {
+          return c.json(
+            {
+              error: "License required",
+              reason: "Install a PromptOwl license key via the setup screen or POST /license/install.",
+              setup_url: "/setup"
+            },
+            503
+          );
+        }
+      }
+    }
     if (config.AUTH_MODE === "open") {
       c.set("nestPermission", "owner");
       return next();
@@ -2763,13 +3858,21 @@ function createApp() {
     }
     let required = "read";
     const path = c.req.path;
+    const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
     if (path.includes("/collaborators") || path.includes("/visibility")) {
       required = "admin";
-    } else if (c.req.method !== "GET") {
+    } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
     if (permissionLevel(permission) < permissionLevel(required)) {
-      return c.json({ error: "Insufficient permissions" }, 403);
+      return c.json(
+        {
+          error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
+          required_permission: required,
+          your_permission: permission
+        },
+        403
+      );
     }
     c.set("nestPermission", permission);
     return next();
@@ -2788,15 +3891,180 @@ function createApp() {
     if (err instanceof AppError) {
       return c.json({ error: err.message }, err.statusCode);
     }
+    const e = err;
+    const code = e.code;
+    const msg = e.message || "";
+    if (code === "SQLITE_CONSTRAINT_UNIQUE") {
+      let friendly = "That conflicts with existing data. Please change a value and try again.";
+      if (msg.includes("node_versions")) {
+        friendly = "A version record for this node already exists. The document may have been recreated with the same name \u2014 pick a different title or remove the old node first.";
+      } else if (msg.includes("review_requests")) {
+        friendly = "A review request for this node already exists.";
+      } else if (msg.includes("nests")) {
+        friendly = "A nest with that name already exists.";
+      } else if (msg.includes("users")) {
+        friendly = "An account with that email already exists.";
+      } else if (msg.includes("stewards")) {
+        friendly = "That steward is already assigned with the same scope.";
+      }
+      return c.json({ error: friendly }, 409);
+    }
+    if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+      return c.json(
+        {
+          error: "Required related record is missing. Ensure the parent resource still exists."
+        },
+        409
+      );
+    }
+    if (code === "SQLITE_CONSTRAINT_CHECK") {
+      return c.json(
+        {
+          error: "Provided value isn't allowed for one of the fields. Double-check your input."
+        },
+        400
+      );
+    }
+    if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+      return c.json(
+        { error: "A required field is missing. Please fill it in and retry." },
+        400
+      );
+    }
+    if (code === "ENOENT") {
+      return c.json(
+        { error: "The requested file or folder doesn't exist." },
+        404
+      );
+    }
+    if (code === "EACCES" || code === "EPERM") {
+      return c.json(
+        { error: "Server doesn't have permission to access that file." },
+        500
+      );
+    }
+    if (code === "ENOSPC") {
+      return c.json(
+        { error: "Out of disk space on the server. Free up space and retry." },
+        507
+      );
+    }
+    if (err instanceof SyntaxError && msg.toLowerCase().includes("json")) {
+      return c.json({ error: "Request body isn't valid JSON." }, 400);
+    }
     console.error("Unhandled error:", err);
-    return c.json({ error: "Internal server error" }, 500);
+    return c.json(
+      {
+        error: "Something went wrong on the server. Try again \u2014 if it keeps failing, check the server log."
+      },
+      500
+    );
   });
   return app;
 }
 
+// src/db/backfill.ts
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+import { join as join5 } from "path";
+var MIGRATION_ID = "005_backfill_node_versions_from_history";
+async function backfillNodeVersionsFromHistory(db) {
+  const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
+  if (already) return;
+  const nests = db.prepare("SELECT id FROM nests").all();
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO node_versions
+       (nest_id, node_id, version, content_hash, author, status, change_note, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  const approvedPin = db.prepare(
+    `INSERT OR REPLACE INTO approved_versions
+       (nest_id, node_id, approved_version, approved_by, approved_at)
+     VALUES (?, ?, ?, ?, COALESCE(
+       (SELECT approved_at FROM approved_versions WHERE nest_id = ? AND node_id = ?),
+       datetime('now')))`
+  );
+  let totalInserted = 0;
+  let totalDocs = 0;
+  for (const { id: nestId } of nests) {
+    const nestPath2 = join5(config.DATA_ROOT, "nests", nestId);
+    const storage = new NestStorage2(nestPath2);
+    let docs;
+    try {
+      docs = await storage.discoverDocuments();
+    } catch (err) {
+      console.warn(
+        `[backfill] discoverDocuments failed for nest ${nestId}:`,
+        err.message
+      );
+      continue;
+    }
+    for (const doc of docs) {
+      totalDocs += 1;
+      let history;
+      try {
+        history = await storage.readHistory(doc.id);
+      } catch {
+        history = null;
+      }
+      if (!history || history.versions.length === 0) continue;
+      const existing = db.prepare(
+        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`
+      ).all(nestId, doc.id);
+      const known = new Set(existing.map((r) => r.version));
+      const tagsJson = doc.frontmatter.tags ? JSON.stringify(doc.frontmatter.tags) : null;
+      const latestVersion = history.versions[history.versions.length - 1].version;
+      for (const entry of history.versions) {
+        if (known.has(entry.version)) continue;
+        insert.run(
+          nestId,
+          doc.id,
+          entry.version,
+          entry.content_hash || "",
+          entry.edited_by || "system:backfill",
+          "approved",
+          entry.note || null,
+          entry.edited_at || (/* @__PURE__ */ new Date()).toISOString()
+        );
+        totalInserted += 1;
+      }
+      const pin = db.prepare(
+        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`
+      ).get(nestId, doc.id);
+      if (!pin || pin.approved_version < latestVersion) {
+        approvedPin.run(
+          nestId,
+          doc.id,
+          latestVersion,
+          history.versions[history.versions.length - 1].edited_by || "system:backfill",
+          nestId,
+          doc.id
+        );
+      }
+      if (tagsJson) {
+        const updateTags = db.prepare(
+          `UPDATE node_versions SET tags_json = ?
+           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`
+        );
+        updateTags.run(tagsJson, nestId, doc.id, latestVersion);
+      }
+    }
+  }
+  db.prepare("INSERT OR IGNORE INTO schema_migrations (id) VALUES (?)").run(
+    MIGRATION_ID
+  );
+  console.log(
+    `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
+  );
+}
+
 // src/index.ts
 async function main() {
-  getDb();
+  const db = getDb();
+  try {
+    await backfillNodeVersionsFromHistory(db);
+  } catch (err) {
+    console.error("[backfill] node_versions backfill failed:", err);
+  }
   const accessCfg = loadAccessConfig();
   if (accessCfg) {
     console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);
@@ -2805,16 +4073,24 @@ async function main() {
   if (!license.valid) {
     console.warn(`
   WARNING: No valid PromptOwl license key found.
-  The server will run, but some features may be limited.
+  Server boots in SETUP MODE \u2014 writes return 503 and admin features
+  (stewards, teammates, governance) are locked until a key is installed.
 
-  To register:
+  To activate:
     1. Sign up at https://app.promptowl.ai
-    2. Go to Settings > License Keys
-    3. Create a Community Server key
-    4. Set PROMPTOWL_KEY=pk_... in your environment
+    2. Open Overview > Community License
+    3. Generate a key
+    4. Paste it into the setup screen (UI) or POST /license/install,
+       or set PROMPTOWL_KEY=pk_... in your environment and restart.
 `);
   }
   const app = createApp();
+  startLicenseWatcher();
+  startLicenseSafetyPoll();
+  const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
+  if (driftScanIntervalMs > 0) {
+    startDriftScanner(driftScanIntervalMs);
+  }
   startTelemetryLoop();
   trackEvent("server.start", {
     tier: license.tier,