@promptowl/contextnest-community 1.0.0 → 1.0.1

package/dist/{chunk-XDCW4HTW.js → chunk-5VHKEIAW.js}

@@ -1,13 +1,74 @@
 import {
   canUserApprove,
   resolveStewardsForNode
-} from "./chunk-2FXVMVZJ.js";
+} from "./chunk-K22GWPT4.js";
 import {
+  createVersion,
+  setApprovedVersion
+} from "./chunk-JMZ75ZCD.js";
+import {
+  config,
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";
+
+// src/nodes/engine.ts
+import { join } from "path";
+import {
+  NestStorage,
+  GraphQueryEngine,
+  VersionManager
+} from "@promptowl/contextnest-engine";
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = join(config.DATA_ROOT, "nests", nestId);
+      const storage = new NestStorage(nestPath);
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = { storage, query, versions };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+
+// src/governance/safe-publish.ts
+import {
+  publishDocument,
+  serializeDocument
+} from "@promptowl/contextnest-engine";
+async function safePublishDocument(storage, docId, options) {
+  const node = await storage.readDocument(docId);
+  const cleanedFrontmatter = stripUndefinedDeep(node.frontmatter);
+  const cleanedNode = { ...node, frontmatter: cleanedFrontmatter };
+  await storage.writeDocument(docId, serializeDocument(cleanedNode));
+  return publishDocument(storage, docId, options);
+}
+function stripUndefinedDeep(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => v !== void 0).map((v) => stripUndefinedDeep(v));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v === void 0) continue;
+      out[k] = stripUndefinedDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/governance/review-service.ts
 function submitForReview(params) {
   const db = getDb();
   const existing = db.prepare(
@@ -35,7 +96,7 @@ function submitForReview(params) {
   ).run(params.nestId, params.nodeId, params.version);
   return getReviewRequest(id);
 }
-function approve(params) {
+async function approve(params) {
   const db = getDb();
   const pending = db.prepare(
     "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
@@ -65,12 +126,45 @@ function approve(params) {
     pending.id
   );
   db.prepare(
-    "UPDATE node_versions SET status = 'approved' WHERE nest_id = ? AND node_id = ? AND version = ?"
+    "UPDATE node_versions SET status = 'published' WHERE nest_id = ? AND node_id = ? AND version = ?"
   ).run(params.nestId, params.nodeId, params.version);
   db.prepare(
     `INSERT OR REPLACE INTO approved_versions (nest_id, node_id, approved_version, approved_by)
      VALUES (?, ?, ?, ?)`
   ).run(params.nestId, params.nodeId, params.version, params.approvedBy);
+  try {
+    const { storage } = engineCache.get(params.nestId);
+    const result = await safePublishDocument(storage, params.nodeId, {
+      editedBy: params.approvedBy,
+      note: params.note || `Approved review request ${pending.id}`
+    });
+    const engineVersion = result.versionEntry.version;
+    if (engineVersion !== params.version) {
+      const node = result.node;
+      const tags = node.frontmatter.tags || [];
+      createVersion({
+        nestId: params.nestId,
+        nodeId: params.nodeId,
+        version: engineVersion,
+        content: node.body || "",
+        author: params.approvedBy,
+        status: "published",
+        tags,
+        changeNote: params.note || `Approved review request ${pending.id}`
+      });
+      setApprovedVersion(
+        params.nestId,
+        params.nodeId,
+        engineVersion,
+        params.approvedBy
+      );
+    }
+  } catch (err) {
+    console.error(
+      `publishDocument failed for ${params.nestId}/${params.nodeId} on approve:`,
+      err
+    );
+  }
   return getReviewRequest(pending.id);
 }
 function reject(params) {
@@ -189,6 +283,8 @@ function rowToReviewRequest(row) {
 }
 
 export {
+  engineCache,
+  safePublishDocument,
   submitForReview,
   approve,
   reject,

package/dist/{chunk-BLOPZDPL.js → chunk-JMZ75ZCD.js}

@@ -1,12 +1,16 @@
 import {
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
 function hashContent(content) {
   return createHash("sha256").update(content).digest("hex");
 }
+var SYSTEM_AUTHOR_PREFIX = "system:auto-publish:";
+function systemAuthor(email) {
+  return `${SYSTEM_AUTHOR_PREFIX}${email}`;
+}
 function createVersion(params) {
   const db = getDb();
   const contentHash = hashContent(params.content);
@@ -49,8 +53,10 @@ function getVersion(nestId, nodeId, version) {
 function getCurrentVersion(nestId, nodeId) {
   const db = getDb();
   const row = db.prepare(
-    "SELECT MAX(version) as v FROM node_versions WHERE nest_id = ? AND node_id = ?"
-  ).get(nestId, nodeId);
+    `SELECT MAX(version) as v FROM node_versions
+        WHERE nest_id = ? AND node_id = ?
+          AND author NOT LIKE ?`
+  ).get(nestId, nodeId, `${SYSTEM_AUTHOR_PREFIX}%`);
   return row?.v || 0;
 }
 function getApprovedVersion(nestId, nodeId) {
@@ -70,8 +76,13 @@ function setApprovedVersion(nestId, nodeId, version, approvedBy) {
 function checkConflict(nestId, nodeId, baseVersion) {
   const db = getDb();
   const current = db.prepare(
-    "SELECT version, content_hash, author, created_at FROM node_versions WHERE nest_id = ? AND node_id = ? ORDER BY version DESC LIMIT 1"
-  ).get(nestId, nodeId);
+    `SELECT version, content_hash, author, created_at
+         FROM node_versions
+        WHERE nest_id = ? AND node_id = ?
+          AND author NOT LIKE ?
+        ORDER BY version DESC
+        LIMIT 1`
+  ).get(nestId, nodeId, `${SYSTEM_AUTHOR_PREFIX}%`);
   if (!current) {
     return { conflict: false, currentVersion: 0, currentHash: "" };
   }
@@ -114,11 +125,13 @@ function getDisplayStatus(nestId, nodeId) {
        ORDER BY version DESC LIMIT 1`
   ).get(nestId, nodeId);
   if (!current) return "draft";
-  if (current.status === "approved") {
+  if (current.status === "published" || current.status === "approved") {
     const approved = db.prepare(
       "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?"
     ).get(nestId, nodeId);
-    if (approved?.approved_version === current.version) return "approved";
+    if (approved?.approved_version === current.version) {
+      return current.status === "published" ? "published" : "approved";
+    }
     return "draft";
   }
   if (current.status === "rejected") return "rejected";
@@ -138,6 +151,8 @@ function rowToVersion(row) {
 
 export {
   hashContent,
+  SYSTEM_AUTHOR_PREFIX,
+  systemAuthor,
   createVersion,
   getVersions,
   getVersion,

package/dist/{chunk-2FXVMVZJ.js → chunk-K22GWPT4.js}

@@ -1,7 +1,7 @@
 import {
   config,
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-KQCWNHDM.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -108,8 +108,8 @@ function assignSteward(data) {
   const id = uuid();
   db.prepare(
     `INSERT INTO stewards
-     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, can_approve, can_reject, assigned_by, is_active)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
   ).run(
     id,
     data.nestId,
@@ -119,8 +119,6 @@ function assignSteward(data) {
     data.userEmail,
     data.userId || null,
     data.role,
-    data.canApprove ? 1 : 0,
-    data.canReject ? 1 : 0,
     data.assignedBy,
     data.isActive ? 1 : 0
   );
@@ -128,7 +126,21 @@ function assignSteward(data) {
 }
 function removeSteward(id) {
   const db = getDb();
-  db.prepare("UPDATE stewards SET is_active = 0 WHERE id = ?").run(id);
+  const remove = db.transaction((stewardId) => {
+    const row = db.prepare("SELECT nest_id, user_email FROM stewards WHERE id = ?").get(stewardId);
+    db.prepare("DELETE FROM stewards WHERE id = ?").run(stewardId);
+    if (!row) return;
+    const remaining = db.prepare(
+      "SELECT 1 FROM stewards WHERE nest_id = ? AND LOWER(user_email) = LOWER(?) AND is_active = 1 LIMIT 1"
+    ).get(row.nest_id, row.user_email);
+    if (remaining) return;
+    const user = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(row.user_email);
+    if (!user) return;
+    db.prepare(
+      "DELETE FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+    ).run(row.nest_id, user.id);
+  });
+  remove(id);
 }
 function getSteward(id) {
   const db = getDb();
@@ -208,10 +220,6 @@ async function createStewardRecord(params) {
       if (!params.documentId) throw new Error("documentId required for document scope");
       nodePattern = params.documentId;
       break;
-    case "folder":
-      if (!params.folderPath) throw new Error("folderPath required for folder scope");
-      nodePattern = params.folderPath;
-      break;
     case "tag":
       if (!params.tagName) throw new Error("tagName required for tag scope");
       tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
@@ -249,8 +257,6 @@ async function createStewardRecord(params) {
       userEmail: email,
       userId: userRow?.id,
       role: user.role ?? "reviewer",
-      canApprove: user.canApprove !== false,
-      canReject: user.canReject !== false,
       assignedBy: params.assignedBy,
       assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
       isActive: true
@@ -283,17 +289,7 @@ function resolve(nestId, nodeId) {
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
           AND s.node_pattern = ?
       UNION ALL
-      SELECT s.*, 2 AS priority, ('folder: ' || s.node_pattern) AS match_source
-        FROM stewards s
-        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'folder'
-          AND s.node_pattern IS NOT NULL
-          AND instr(s.node_pattern, '*') = 0
-          AND (
-            ? LIKE s.node_pattern || '/%'
-            OR s.node_pattern = ?
-          )
-      UNION ALL
-      SELECT s.*, 3 AS priority, ('tag: ' || s.tag_name) AS match_source
+      SELECT s.*, 2 AS priority, ('tag: ' || s.tag_name) AS match_source
         FROM stewards s
         JOIN node_tag_index nt
           ON nt.nest_id = s.nest_id
@@ -301,7 +297,7 @@ function resolve(nestId, nodeId) {
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
           AND nt.node_id = ?
       UNION ALL
-      SELECT s.*, 4 AS priority, 'nest-level steward' AS match_source
+      SELECT s.*, 3 AS priority, 'nest-level steward' AS match_source
         FROM stewards s
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
       ORDER BY priority ASC, user_email ASC
@@ -312,10 +308,6 @@ function resolve(nestId, nodeId) {
     // document branch
     nestId,
     nodeId,
-    nestId,
-    // folder branch (path-prefix OR whole-nest folder)
-    nestId,
-    nodeId,
     // tag branch
     nestId
     // nest branch
@@ -325,23 +317,6 @@ function resolve(nestId, nodeId) {
     priority: row.priority,
     source: row.match_source
   }));
-  const legacyFolderGlobs = db.prepare(
-    `SELECT * FROM stewards
-       WHERE nest_id = ? AND is_active = 1 AND scope = 'folder'
-         AND node_pattern IS NOT NULL AND instr(node_pattern, '*') > 0`
-  ).all(nestId);
-  for (const row of legacyFolderGlobs) {
-    if (globMatch(nodeId, row.node_pattern)) {
-      resolved.push({
-        steward: rowToSteward(row),
-        priority: 2,
-        source: `folder: ${row.node_pattern}`
-      });
-    }
-  }
-  if (legacyFolderGlobs.length > 0) {
-    resolved.sort((a, b) => a.priority - b.priority);
-  }
   if (resolved.length > 0) {
     return { stewards: resolved, fallbackToOwner: false };
   }
@@ -408,7 +383,7 @@ function canUserApprove(nestId, nodeId, userEmail) {
     };
   }
   const match = resolved.find(
-    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "reviewer" && r.steward.canApprove
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "reviewer"
   );
   if (!match) {
     return {
@@ -444,14 +419,6 @@ function canUserAccess(nestId, nodeId, userEmail) {
   }
   return { allowed: false, reason: "no steward assignment", role: null };
 }
-function globMatch(value, pattern) {
-  if (pattern === "*") return true;
-  if (!pattern.includes("*")) return value === pattern;
-  const regex = new RegExp(
-    "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$"
-  );
-  return regex.test(value);
-}
 function syncFromConfig(nestId, config2) {
   const db = getDb();
   let count = 0;
@@ -474,8 +441,6 @@ function syncFromConfig(nestId, config2) {
         userEmail: entry.email.toLowerCase(),
         userId: user?.id,
         role,
-        canApprove: entry.can_approve !== false,
-        canReject: entry.can_reject !== false,
         assignedBy: "config",
         assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
         isActive: true
@@ -486,11 +451,6 @@ function syncFromConfig(nestId, config2) {
   if (config2.nest) {
     addEntries("nest", config2.nest);
   }
-  if (config2.folders) {
-    for (const [pattern, entries] of Object.entries(config2.folders)) {
-      addEntries("folder", entries, { nodePattern: pattern });
-    }
-  }
   if (config2.tags) {
     for (const [tagName, entries] of Object.entries(config2.tags)) {
       addEntries("tag", entries, { tagName });
@@ -513,8 +473,6 @@ function rowToSteward(row) {
     userEmail: row.user_email,
     userId: row.user_id || void 0,
     role: row.role,
-    canApprove: !!row.can_approve,
-    canReject: !!row.can_reject,
     assignedBy: row.assigned_by,
     assignedAt: row.assigned_at,
     isActive: !!row.is_active

package/dist/{chunk-2TW25QEA.js → chunk-KQCWNHDM.js}

@@ -10,12 +10,15 @@ var envCandidates = [
   join(__dirname, "..", ".env")
 ];
 var envFileLoaded = envCandidates.find((p) => existsSync(p)) || null;
-if (envFileLoaded) {
+var isTestRun = !!process.env.VITEST;
+if (envFileLoaded && !isTestRun) {
   dotenv.config({ path: envFileLoaded, override: true });
 }
-console.log(
-  `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
-);
+if (!isTestRun) {
+  console.log(
+    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
+  );
+}
 function dataRoot() {
   return process.env.DATA_ROOT || join(process.cwd(), "data");
 }
@@ -78,6 +81,10 @@ import Database from "better-sqlite3";
 import { mkdirSync } from "fs";
 import { dirname as dirname2 } from "path";
 
+// src/shared/constants.ts
+var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
+var ANON_EMAIL = "admin@localhost";
+
 // src/db/migrations.ts
 function runMigrations(db2) {
   db2.exec(`
@@ -148,19 +155,17 @@ function runMigrations(db2) {
   db2.exec(`
     -- Steward assignments (mirrors PromptOwl ContextSteward model)
     -- scope+target combination determines what the steward governs
-    -- Resolution priority: document(1) > folder(2) > tag(3) > nest(4)
+    -- Resolution priority: document(1) > tag(2) > nest(3)
     CREATE TABLE IF NOT EXISTS stewards (
       id TEXT PRIMARY KEY,
       nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-      scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
-      node_pattern TEXT,           -- glob for document/folder scope (e.g. "nodes/api-*")
+      scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+      node_pattern TEXT,           -- exact node id for document scope
       tag_name TEXT,               -- for tag scope
       user_email TEXT NOT NULL,
       user_id TEXT REFERENCES users(id),
       role TEXT NOT NULL DEFAULT 'reviewer'
         CHECK(role IN ('editor', 'reviewer', 'admin')),
-      can_approve INTEGER NOT NULL DEFAULT 1,
-      can_reject INTEGER NOT NULL DEFAULT 1,
       assigned_by TEXT NOT NULL,
       assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
       is_active INTEGER NOT NULL DEFAULT 1
@@ -231,6 +236,19 @@ function runMigrations(db2) {
   if (!userCols.includes("is_invited")) {
     db2.exec("ALTER TABLE users ADD COLUMN is_invited INTEGER NOT NULL DEFAULT 0");
   }
+  const stewardCols = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+  if (stewardCols.length > 0) {
+    if (!stewardCols.includes("can_approve")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_approve INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+    if (!stewardCols.includes("can_reject")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_reject INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+  }
   db2.exec(`
     CREATE TABLE IF NOT EXISTS schema_migrations (
       id TEXT PRIMARY KEY,
@@ -245,24 +263,23 @@ function runMigrations(db2) {
         CREATE TABLE stewards_new (
           id TEXT PRIMARY KEY,
           nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-          scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
+          scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
           node_pattern TEXT,
           tag_name TEXT,
           user_email TEXT NOT NULL,
           user_id TEXT REFERENCES users(id),
           role TEXT NOT NULL DEFAULT 'reviewer'
             CHECK(role IN ('editor', 'reviewer', 'viewer')),
-          can_approve INTEGER NOT NULL DEFAULT 1,
-          can_reject INTEGER NOT NULL DEFAULT 1,
           assigned_by TEXT NOT NULL,
           assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
           is_active INTEGER NOT NULL DEFAULT 1
         );
 
-        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email
+        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email.
+        -- Legacy can_approve/can_reject columns are dropped here (role is now the sole signal).
         INSERT INTO stewards_new
           (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
-           role, can_approve, can_reject, assigned_by, assigned_at, is_active)
+           role, assigned_by, assigned_at, is_active)
         SELECT
           id, nest_id, scope, node_pattern,
           CASE
@@ -272,7 +289,7 @@ function runMigrations(db2) {
           lower(user_email),
           user_id,
           CASE role WHEN 'admin' THEN 'reviewer' ELSE role END,
-          can_approve, can_reject, assigned_by, assigned_at, is_active
+          assigned_by, assigned_at, is_active
         FROM stewards;
 
         DROP TABLE stewards;
@@ -291,10 +308,6 @@ function runMigrations(db2) {
           ON stewards(nest_id, node_pattern, user_email)
           WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
 
-        CREATE UNIQUE INDEX idx_stewards_uniq_folder
-          ON stewards(nest_id, node_pattern, user_email)
-          WHERE scope = 'folder' AND node_pattern IS NOT NULL AND is_active = 1;
-
         CREATE UNIQUE INDEX idx_stewards_uniq_tag
           ON stewards(nest_id, tag_name, user_email)
           WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
@@ -303,9 +316,6 @@ function runMigrations(db2) {
         CREATE INDEX idx_stewards_tag_lookup
           ON stewards(nest_id, tag_name)
           WHERE scope = 'tag' AND is_active = 1;
-        CREATE INDEX idx_stewards_folder_lookup
-          ON stewards(nest_id, node_pattern)
-          WHERE scope = 'folder' AND is_active = 1;
         CREATE INDEX idx_stewards_doc_lookup
           ON stewards(nest_id, node_pattern)
           WHERE scope = 'document' AND is_active = 1;
@@ -401,6 +411,115 @@ function runMigrations(db2) {
       recordMigration("004_license_cache_owner_email");
     })();
   }
+  if (!hasMigration("005_anon_nest_public_default")) {
+    db2.transaction(() => {
+      db2.prepare(
+        "UPDATE nests SET visibility = 'public' WHERE user_id = ? AND visibility = 'private'"
+      ).run(ANON_USER_ID);
+      recordMigration("005_anon_nest_public_default");
+    })();
+  }
+  if (!hasMigration("006_node_versions_published_status")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE node_versions_new (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          version INTEGER NOT NULL,
+          content_hash TEXT NOT NULL,
+          author TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'draft'
+            CHECK(status IN ('draft', 'pending_review', 'approved', 'published', 'rejected')),
+          change_note TEXT,
+          tags_json TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          UNIQUE(nest_id, node_id, version)
+        );
+        INSERT INTO node_versions_new
+          (id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at)
+        SELECT
+          id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at
+        FROM node_versions;
+        DROP TABLE node_versions;
+        ALTER TABLE node_versions_new RENAME TO node_versions;
+        CREATE INDEX idx_versions_node ON node_versions(nest_id, node_id);
+      `);
+      recordMigration("006_node_versions_published_status");
+    })();
+  }
+  if (!hasMigration("007_drop_steward_capability_flags")) {
+    const stewardCols2 = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+    const hasLegacyCols = stewardCols2.includes("can_approve") || stewardCols2.includes("can_reject");
+    if (hasLegacyCols) {
+      db2.transaction(() => {
+        if (stewardCols2.includes("can_approve")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_approve");
+        }
+        if (stewardCols2.includes("can_reject")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_reject");
+        }
+        recordMigration("007_drop_steward_capability_flags");
+      })();
+    } else {
+      recordMigration("007_drop_steward_capability_flags");
+    }
+  }
+  if (!hasMigration("008_drop_steward_folder_scope")) {
+    db2.transaction(() => {
+      db2.exec("DELETE FROM stewards WHERE scope = 'folder'");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_uniq_folder");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_folder_lookup");
+      const tbl = db2.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='stewards'").get();
+      if (tbl?.sql && tbl.sql.includes("'folder'")) {
+        db2.exec(`
+          CREATE TABLE stewards_new (
+            id TEXT PRIMARY KEY,
+            nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+            scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+            node_pattern TEXT,
+            tag_name TEXT,
+            user_email TEXT NOT NULL,
+            user_id TEXT REFERENCES users(id),
+            role TEXT NOT NULL DEFAULT 'reviewer'
+              CHECK(role IN ('editor', 'reviewer', 'viewer')),
+            assigned_by TEXT NOT NULL,
+            assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
+            is_active INTEGER NOT NULL DEFAULT 1
+          );
+          INSERT INTO stewards_new
+            (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+             role, assigned_by, assigned_at, is_active)
+          SELECT
+            id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+            role, assigned_by, assigned_at, is_active
+          FROM stewards;
+          DROP TABLE stewards;
+          ALTER TABLE stewards_new RENAME TO stewards;
+
+          CREATE INDEX idx_stewards_nest ON stewards(nest_id);
+          CREATE INDEX idx_stewards_email ON stewards(user_email);
+          CREATE INDEX idx_stewards_scope ON stewards(nest_id, scope);
+          CREATE UNIQUE INDEX idx_stewards_uniq_nest
+            ON stewards(nest_id, user_email)
+            WHERE scope = 'nest' AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_document
+            ON stewards(nest_id, node_pattern, user_email)
+            WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_tag
+            ON stewards(nest_id, tag_name, user_email)
+            WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
+          CREATE INDEX idx_stewards_tag_lookup
+            ON stewards(nest_id, tag_name)
+            WHERE scope = 'tag' AND is_active = 1;
+          CREATE INDEX idx_stewards_doc_lookup
+            ON stewards(nest_id, node_pattern)
+            WHERE scope = 'document' AND is_active = 1;
+        `);
+      }
+      recordMigration("008_drop_steward_folder_scope");
+    })();
+  }
 }
 
 // src/db/client.ts
@@ -419,5 +538,7 @@ function getDb() {
 
 export {
   config,
+  ANON_USER_ID,
+  ANON_EMAIL,
   getDb
 };