@promptowl/contextnest-community 1.0.0 → 1.1.0

package/CONFIGURATION.md

@@ -48,11 +48,13 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `DATABASE_PATH` | `$DATA_ROOT/community.db` | Override the SQLite file location explicitly. |
 | `AUTH_MODE` | `key` | `key` or `open`. See above. |
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
-| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community Server license key (`pk_...`). Unlicensed instances still run but some features may be limited. |
+| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
+| `ENV_FILE_PATH` | `$cwd/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars). Override when your `.env` lives outside the working directory. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+| `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 
 ---
 
@@ -61,10 +63,10 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 ### Local dev / single user
 
 ```bash
-AUTH_MODE=open DATA_ROOT=./my-data pnpm dev
+AUTH_MODE=open DATA_ROOT=./my-data npm run dev
 ```
 
-Or the default dev mode if `pnpm dev` already sets `AUTH_MODE=open` in your scripts.
+Or the default dev mode if `npm run dev` already sets `AUTH_MODE=open` in your scripts.
 
 ### Team / multi-user behind a reverse proxy
 
@@ -73,7 +75,7 @@ AUTH_MODE=key \
 CORS_ORIGINS="https://team.example.com,https://admin.example.com" \
 DATA_ROOT=/var/lib/contextnest \
 PROMPTOWL_KEY=pk_... \
-pnpm start
+npm start
 ```
 
 Terminate TLS at the proxy, forward `X-Forwarded-For` and `X-Real-IP` headers (the rate limiter reads them), and bind the server to `127.0.0.1` so only the proxy can reach it.

package/README.md

@@ -11,7 +11,9 @@
 ContextNest Community Edition is a self-hosted server that lets you:
 
 - Store, version, and govern markdown-based context documents ("nests")
+- Import an existing folder or vault of markdown files in one step
 - Apply stewardship workflows — draft, pending review, approved
+- Share nests with collaborators or publish them read-only to the public
 - Serve approved context to AI agents via MCP, HTTP, or CLI
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
@@ -20,17 +22,60 @@ The server runs locally or on your own infrastructure. Your PromptOwl account ha
 ## Quickstart
 
 ```bash
-# 1. Get a license key — sign up free at https://app.promptowl.ai
-#    Settings → License Keys → Create a Community Server key
+# 1. Run the community server
+npx @promptowl/contextnest-community
 
-# 2. (Optional) Scaffold a local nest with the open-source CLI
-npx @promptowl/contextnest-cli init
+# 2. Open the server in your browser
+#    http://localhost:3838
+#    On first boot with no license, it lands on the License Setup Page.
 
-# 3. Run the community server
+# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
+```
+
+The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+> **Optional:** scaffold a local nest with the open-source CLI before connecting:
+> ```bash
+> npx @promptowl/contextnest-cli init
+> ```
+
+## License setup
+
+ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
+
+### 1. Create the key (free)
+
+1. Sign up or log in at <https://app.promptowl.ai>
+2. Open the **Overview** menu → **Community License**
+3. Click **Create a Community License key**
+4. Copy the generated key — it starts with `pk_`
+
+### 2. Activate the server
+
+Pick **one** of two ways:
+
+**A. Browser setup page (recommended for first run)**
+
+1. Start the server: `npx @promptowl/contextnest-community`
+2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
+3. Paste your `pk_...` key and submit
+4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
+
+**B. Environment variable (recommended for Docker / CI / scripted deploys)**
+
+```bash
 PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
 ```
 
-The server listens on `http://localhost:3000` by default. Without a valid `PROMPTOWL_KEY` the server still runs but some features are limited. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
+
+### 3. How licensing behaves at runtime
+
+- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
+- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
+- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
+
+For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
 
 ## System requirements
 
@@ -45,9 +90,15 @@ The server listens on `http://localhost:3000` by default. Without a valid `PROMP
 |---|:---:|:---:|
 | Self-hosted context server | ✅ | ✅ |
 | Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Import existing folder / vault | ✅ | ✅ |
+| Markdown rendering + wiki cross-linking | ✅ | ✅ |
+| External-edit detection + version diff | ✅ | ✅ |
 | Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| Per-nest sharing + collaborators | ✅ | ✅ |
+| Public read-only nests | ✅ | ✅ |
+| Custom logo / branding | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
-| Multi-user governance UI | — | ✅ |
+| Centralized multi-tenant admin console | — | ✅ |
 | SSO / SAML / SCIM | — | ✅ |
 | Audit log streaming | — | ✅ |
 | Policy transforms (redaction, summarization) | — | ✅ |
@@ -55,6 +106,28 @@ The server listens on `http://localhost:3000` by default. Without a valid `PROMP
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
+## What's new in 1.1.0
+
+- **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.
+- **Nest sharing + collaborators** — set per-nest visibility and add collaborators with read or write access. A Share affordance is now inline in the document view.
+- **Public read-only nests** — flip a nest to `visibility=public` to serve it to unauthenticated readers (bypasses auth for GETs only); writes still require a key.
+- **Custom logo / branding** — set `LOGO_URL` to show your own logo in the UI header and login screen. See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Governance** — nest owners can self-approve their own changes; new per-nest auto-approve toggle; role-based action gating (buttons reflect the viewer's role); stewards can edit scope during a role change.
+- **Editor** — `[[wikilink]]` autocomplete, broken-link click creates a new doc with the title pre-filled, tag chips filter the nest list, Notion-style H1 title, click-to-edit, and an unsaved-changes warning.
+- **Stability** — added an error boundary so a render error in one view no longer blanks the whole app; bumped `uuid` to 14.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
+## What's new in 1.0.1
+
+- **Document hashing pipeline** — external-edit detection, conflict-aware safe-publish, and inline version diffs powered by `@promptowl/contextnest-engine`. When a file is edited outside the UI, the editor shows an "External edit detected" banner with a side-by-side diff and an adopt / keep choice.
+- **Markdown rendering** — new `DocumentViewer` (react-markdown + remark-gfm + wikilink support) renders CLI/MCP-authored markdown correctly, with a view/edit toggle.
+- **License revocation now blocks writes synchronously** — revoke flips an in-process "writes blocked" flag immediately; the next write returns `503`.
+- **Dashboard stats** — new `GET /stats` endpoint surfaces nest / document / user counts.
+- **Docker fix** — Dockerfile now installs via npm against the shipped `package-lock.json`; base image bumped to `node:22-slim`.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
 ## Licensing
 
 ContextNest Community Edition is **commercial software**. It is **not open source**.

package/dist/{chunk-BLOPZDPL.js → chunk-7UTMBL6Z.js}

@@ -1,12 +1,16 @@
 import {
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-TDAX3JOT.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
 function hashContent(content) {
   return createHash("sha256").update(content).digest("hex");
 }
+var SYSTEM_AUTHOR_PREFIX = "system:auto-publish:";
+function systemAuthor(email) {
+  return `${SYSTEM_AUTHOR_PREFIX}${email}`;
+}
 function createVersion(params) {
   const db = getDb();
   const contentHash = hashContent(params.content);
@@ -49,8 +53,10 @@ function getVersion(nestId, nodeId, version) {
 function getCurrentVersion(nestId, nodeId) {
   const db = getDb();
   const row = db.prepare(
-    "SELECT MAX(version) as v FROM node_versions WHERE nest_id = ? AND node_id = ?"
-  ).get(nestId, nodeId);
+    `SELECT MAX(version) as v FROM node_versions
+        WHERE nest_id = ? AND node_id = ?
+          AND author NOT LIKE ?`
+  ).get(nestId, nodeId, `${SYSTEM_AUTHOR_PREFIX}%`);
   return row?.v || 0;
 }
 function getApprovedVersion(nestId, nodeId) {
@@ -70,8 +76,13 @@ function setApprovedVersion(nestId, nodeId, version, approvedBy) {
 function checkConflict(nestId, nodeId, baseVersion) {
   const db = getDb();
   const current = db.prepare(
-    "SELECT version, content_hash, author, created_at FROM node_versions WHERE nest_id = ? AND node_id = ? ORDER BY version DESC LIMIT 1"
-  ).get(nestId, nodeId);
+    `SELECT version, content_hash, author, created_at
+         FROM node_versions
+        WHERE nest_id = ? AND node_id = ?
+          AND author NOT LIKE ?
+        ORDER BY version DESC
+        LIMIT 1`
+  ).get(nestId, nodeId, `${SYSTEM_AUTHOR_PREFIX}%`);
   if (!current) {
     return { conflict: false, currentVersion: 0, currentHash: "" };
   }
@@ -114,11 +125,13 @@ function getDisplayStatus(nestId, nodeId) {
        ORDER BY version DESC LIMIT 1`
   ).get(nestId, nodeId);
   if (!current) return "draft";
-  if (current.status === "approved") {
+  if (current.status === "published" || current.status === "approved") {
     const approved = db.prepare(
       "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?"
     ).get(nestId, nodeId);
-    if (approved?.approved_version === current.version) return "approved";
+    if (approved?.approved_version === current.version) {
+      return current.status === "published" ? "published" : "approved";
+    }
     return "draft";
   }
   if (current.status === "rejected") return "rejected";
@@ -138,6 +151,8 @@ function rowToVersion(row) {
 
 export {
   hashContent,
+  SYSTEM_AUTHOR_PREFIX,
+  systemAuthor,
   createVersion,
   getVersions,
   getVersion,

package/dist/{chunk-XDCW4HTW.js → chunk-S2EWN2VA.js}

@@ -1,13 +1,48 @@
 import {
+  createVersion,
+  setApprovedVersion
+} from "./chunk-7UTMBL6Z.js";
+import {
+  buildTitleMap,
   canUserApprove,
+  engineCache,
   resolveStewardsForNode
-} from "./chunk-2FXVMVZJ.js";
+} from "./chunk-WCOUCBDJ.js";
 import {
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-TDAX3JOT.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";
+
+// src/governance/safe-publish.ts
+import {
+  publishDocument,
+  serializeDocument
+} from "@promptowl/contextnest-engine";
+async function safePublishDocument(storage, docId, options) {
+  const node = await storage.readDocument(docId);
+  const cleanedFrontmatter = stripUndefinedDeep(node.frontmatter);
+  const cleanedNode = { ...node, frontmatter: cleanedFrontmatter };
+  await storage.writeDocument(docId, serializeDocument(cleanedNode));
+  return publishDocument(storage, docId, options);
+}
+function stripUndefinedDeep(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => v !== void 0).map((v) => stripUndefinedDeep(v));
+  }
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v === void 0) continue;
+      out[k] = stripUndefinedDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/governance/review-service.ts
 function submitForReview(params) {
   const db = getDb();
   const existing = db.prepare(
@@ -35,7 +70,7 @@ function submitForReview(params) {
   ).run(params.nestId, params.nodeId, params.version);
   return getReviewRequest(id);
 }
-function approve(params) {
+async function approve(params) {
   const db = getDb();
   const pending = db.prepare(
     "SELECT * FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' ORDER BY requested_at DESC LIMIT 1"
@@ -65,12 +100,45 @@ function approve(params) {
     pending.id
   );
   db.prepare(
-    "UPDATE node_versions SET status = 'approved' WHERE nest_id = ? AND node_id = ? AND version = ?"
+    "UPDATE node_versions SET status = 'published' WHERE nest_id = ? AND node_id = ? AND version = ?"
   ).run(params.nestId, params.nodeId, params.version);
   db.prepare(
     `INSERT OR REPLACE INTO approved_versions (nest_id, node_id, approved_version, approved_by)
      VALUES (?, ?, ?, ?)`
   ).run(params.nestId, params.nodeId, params.version, params.approvedBy);
+  try {
+    const { storage } = engineCache.get(params.nestId);
+    const result = await safePublishDocument(storage, params.nodeId, {
+      editedBy: params.approvedBy,
+      note: params.note || `Approved review request ${pending.id}`
+    });
+    const engineVersion = result.versionEntry.version;
+    if (engineVersion !== params.version) {
+      const node = result.node;
+      const tags = node.frontmatter.tags || [];
+      createVersion({
+        nestId: params.nestId,
+        nodeId: params.nodeId,
+        version: engineVersion,
+        content: node.body || "",
+        author: params.approvedBy,
+        status: "published",
+        tags,
+        changeNote: params.note || `Approved review request ${pending.id}`
+      });
+      setApprovedVersion(
+        params.nestId,
+        params.nodeId,
+        engineVersion,
+        params.approvedBy
+      );
+    }
+  } catch (err) {
+    console.error(
+      `publishDocument failed for ${params.nestId}/${params.nodeId} on approve:`,
+      err
+    );
+  }
   return getReviewRequest(pending.id);
 }
 function reject(params) {
@@ -115,7 +183,7 @@ function cancelReview(params) {
   ).run(params.nestId, params.nodeId, pending.version);
   return getReviewRequest(pending.id);
 }
-function getReviewQueue(params) {
+async function getReviewQueue(params) {
   const db = getDb();
   let whereClauses = [];
   const args = [];
@@ -150,6 +218,15 @@ function getReviewQueue(params) {
       );
     });
   }
+  const titleMapsByNest = /* @__PURE__ */ new Map();
+  const nestIds = new Set(requests.map((r) => r.nestId));
+  for (const nid of nestIds) {
+    titleMapsByNest.set(nid, await buildTitleMap(nid));
+  }
+  requests = requests.map((r) => ({
+    ...r,
+    title: titleMapsByNest.get(r.nestId)?.get(r.nodeId)
+  }));
   return { requests, total };
 }
 function getReviewHistory(nestId, nodeId) {
@@ -189,6 +266,7 @@ function rowToReviewRequest(row) {
 }
 
 export {
+  safePublishDocument,
   submitForReview,
   approve,
   reject,

package/dist/{chunk-2TW25QEA.js → chunk-TDAX3JOT.js}

@@ -10,12 +10,15 @@ var envCandidates = [
   join(__dirname, "..", ".env")
 ];
 var envFileLoaded = envCandidates.find((p) => existsSync(p)) || null;
-if (envFileLoaded) {
+var isTestRun = !!process.env.VITEST;
+if (envFileLoaded && !isTestRun) {
   dotenv.config({ path: envFileLoaded, override: true });
 }
-console.log(
-  `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
-);
+if (!isTestRun) {
+  console.log(
+    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
+  );
+}
 function dataRoot() {
   return process.env.DATA_ROOT || join(process.cwd(), "data");
 }
@@ -49,6 +52,25 @@ var config = {
   get TELEMETRY_INTERVAL_MS() {
     return parseInt(process.env.TELEMETRY_INTERVAL_MS || "3600000", 10);
   },
+  /**
+   * Optional custom logo URL shown in UI header + login screen.
+   * Must be an absolute https://, http://, or data:image/… URL. Other
+   * schemes (file://, javascript:, relative paths) are rejected with a
+   * warning so an operator typo doesn't silently break the favicon.
+   * When unset or invalid, the UI falls back to the bundled icon.
+   */
+  get LOGO_URL() {
+    const raw = process.env.LOGO_URL?.trim();
+    if (!raw) return null;
+    const ok = /^(https?:\/\/|data:image\/)/i.test(raw);
+    if (!ok) {
+      console.warn(
+        `[config] LOGO_URL rejected: must start with https://, http://, or data:image/ (got "${raw}"). Falling back to default logo.`
+      );
+      return null;
+    }
+    return raw;
+  },
   get AUTH_MODE() {
     return process.env.AUTH_MODE || "key";
   },
@@ -78,6 +100,10 @@ import Database from "better-sqlite3";
 import { mkdirSync } from "fs";
 import { dirname as dirname2 } from "path";
 
+// src/shared/constants.ts
+var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
+var ANON_EMAIL = "admin@localhost";
+
 // src/db/migrations.ts
 function runMigrations(db2) {
   db2.exec(`
@@ -148,19 +174,17 @@ function runMigrations(db2) {
   db2.exec(`
     -- Steward assignments (mirrors PromptOwl ContextSteward model)
     -- scope+target combination determines what the steward governs
-    -- Resolution priority: document(1) > folder(2) > tag(3) > nest(4)
+    -- Resolution priority: document(1) > tag(2) > nest(3)
     CREATE TABLE IF NOT EXISTS stewards (
       id TEXT PRIMARY KEY,
       nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-      scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
-      node_pattern TEXT,           -- glob for document/folder scope (e.g. "nodes/api-*")
+      scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+      node_pattern TEXT,           -- exact node id for document scope
       tag_name TEXT,               -- for tag scope
       user_email TEXT NOT NULL,
       user_id TEXT REFERENCES users(id),
       role TEXT NOT NULL DEFAULT 'reviewer'
         CHECK(role IN ('editor', 'reviewer', 'admin')),
-      can_approve INTEGER NOT NULL DEFAULT 1,
-      can_reject INTEGER NOT NULL DEFAULT 1,
       assigned_by TEXT NOT NULL,
       assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
       is_active INTEGER NOT NULL DEFAULT 1
@@ -224,6 +248,12 @@ function runMigrations(db2) {
   if (!nestCols.includes("stewardship_enabled")) {
     db2.exec("ALTER TABLE nests ADD COLUMN stewardship_enabled INTEGER NOT NULL DEFAULT 0");
   }
+  if (!nestCols.includes("is_imported")) {
+    db2.exec("ALTER TABLE nests ADD COLUMN is_imported INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("allow_self_approve")) {
+    db2.exec("ALTER TABLE nests ADD COLUMN allow_self_approve INTEGER NOT NULL DEFAULT 0");
+  }
   const userCols = db2.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db2.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -231,6 +261,19 @@ function runMigrations(db2) {
   if (!userCols.includes("is_invited")) {
     db2.exec("ALTER TABLE users ADD COLUMN is_invited INTEGER NOT NULL DEFAULT 0");
   }
+  const stewardCols = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+  if (stewardCols.length > 0) {
+    if (!stewardCols.includes("can_approve")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_approve INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+    if (!stewardCols.includes("can_reject")) {
+      db2.exec(
+        "ALTER TABLE stewards ADD COLUMN can_reject INTEGER NOT NULL DEFAULT 1"
+      );
+    }
+  }
   db2.exec(`
     CREATE TABLE IF NOT EXISTS schema_migrations (
       id TEXT PRIMARY KEY,
@@ -245,24 +288,23 @@ function runMigrations(db2) {
         CREATE TABLE stewards_new (
           id TEXT PRIMARY KEY,
           nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
-          scope TEXT NOT NULL CHECK(scope IN ('document', 'folder', 'tag', 'nest')),
+          scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
           node_pattern TEXT,
           tag_name TEXT,
           user_email TEXT NOT NULL,
           user_id TEXT REFERENCES users(id),
           role TEXT NOT NULL DEFAULT 'reviewer'
             CHECK(role IN ('editor', 'reviewer', 'viewer')),
-          can_approve INTEGER NOT NULL DEFAULT 1,
-          can_reject INTEGER NOT NULL DEFAULT 1,
           assigned_by TEXT NOT NULL,
           assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
           is_active INTEGER NOT NULL DEFAULT 1
         );
 
-        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email
+        -- Copy rows; map legacy 'admin' role to 'reviewer', normalize tag_name + email.
+        -- Legacy can_approve/can_reject columns are dropped here (role is now the sole signal).
         INSERT INTO stewards_new
           (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
-           role, can_approve, can_reject, assigned_by, assigned_at, is_active)
+           role, assigned_by, assigned_at, is_active)
         SELECT
           id, nest_id, scope, node_pattern,
           CASE
@@ -272,7 +314,7 @@ function runMigrations(db2) {
           lower(user_email),
           user_id,
           CASE role WHEN 'admin' THEN 'reviewer' ELSE role END,
-          can_approve, can_reject, assigned_by, assigned_at, is_active
+          assigned_by, assigned_at, is_active
         FROM stewards;
 
         DROP TABLE stewards;
@@ -291,10 +333,6 @@ function runMigrations(db2) {
           ON stewards(nest_id, node_pattern, user_email)
           WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
 
-        CREATE UNIQUE INDEX idx_stewards_uniq_folder
-          ON stewards(nest_id, node_pattern, user_email)
-          WHERE scope = 'folder' AND node_pattern IS NOT NULL AND is_active = 1;
-
         CREATE UNIQUE INDEX idx_stewards_uniq_tag
           ON stewards(nest_id, tag_name, user_email)
           WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
@@ -303,9 +341,6 @@ function runMigrations(db2) {
         CREATE INDEX idx_stewards_tag_lookup
           ON stewards(nest_id, tag_name)
           WHERE scope = 'tag' AND is_active = 1;
-        CREATE INDEX idx_stewards_folder_lookup
-          ON stewards(nest_id, node_pattern)
-          WHERE scope = 'folder' AND is_active = 1;
         CREATE INDEX idx_stewards_doc_lookup
           ON stewards(nest_id, node_pattern)
           WHERE scope = 'document' AND is_active = 1;
@@ -401,6 +436,115 @@ function runMigrations(db2) {
       recordMigration("004_license_cache_owner_email");
     })();
   }
+  if (!hasMigration("005_anon_nest_public_default")) {
+    db2.transaction(() => {
+      db2.prepare(
+        "UPDATE nests SET visibility = 'public' WHERE user_id = ? AND visibility = 'private'"
+      ).run(ANON_USER_ID);
+      recordMigration("005_anon_nest_public_default");
+    })();
+  }
+  if (!hasMigration("006_node_versions_published_status")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE node_versions_new (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          version INTEGER NOT NULL,
+          content_hash TEXT NOT NULL,
+          author TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'draft'
+            CHECK(status IN ('draft', 'pending_review', 'approved', 'published', 'rejected')),
+          change_note TEXT,
+          tags_json TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          UNIQUE(nest_id, node_id, version)
+        );
+        INSERT INTO node_versions_new
+          (id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at)
+        SELECT
+          id, nest_id, node_id, version, content_hash, author, status, change_note, tags_json, created_at
+        FROM node_versions;
+        DROP TABLE node_versions;
+        ALTER TABLE node_versions_new RENAME TO node_versions;
+        CREATE INDEX idx_versions_node ON node_versions(nest_id, node_id);
+      `);
+      recordMigration("006_node_versions_published_status");
+    })();
+  }
+  if (!hasMigration("007_drop_steward_capability_flags")) {
+    const stewardCols2 = db2.prepare("PRAGMA table_info(stewards)").all().map((c) => c.name);
+    const hasLegacyCols = stewardCols2.includes("can_approve") || stewardCols2.includes("can_reject");
+    if (hasLegacyCols) {
+      db2.transaction(() => {
+        if (stewardCols2.includes("can_approve")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_approve");
+        }
+        if (stewardCols2.includes("can_reject")) {
+          db2.exec("ALTER TABLE stewards DROP COLUMN can_reject");
+        }
+        recordMigration("007_drop_steward_capability_flags");
+      })();
+    } else {
+      recordMigration("007_drop_steward_capability_flags");
+    }
+  }
+  if (!hasMigration("008_drop_steward_folder_scope")) {
+    db2.transaction(() => {
+      db2.exec("DELETE FROM stewards WHERE scope = 'folder'");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_uniq_folder");
+      db2.exec("DROP INDEX IF EXISTS idx_stewards_folder_lookup");
+      const tbl = db2.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='stewards'").get();
+      if (tbl?.sql && tbl.sql.includes("'folder'")) {
+        db2.exec(`
+          CREATE TABLE stewards_new (
+            id TEXT PRIMARY KEY,
+            nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+            scope TEXT NOT NULL CHECK(scope IN ('document', 'tag', 'nest')),
+            node_pattern TEXT,
+            tag_name TEXT,
+            user_email TEXT NOT NULL,
+            user_id TEXT REFERENCES users(id),
+            role TEXT NOT NULL DEFAULT 'reviewer'
+              CHECK(role IN ('editor', 'reviewer', 'viewer')),
+            assigned_by TEXT NOT NULL,
+            assigned_at TEXT NOT NULL DEFAULT (datetime('now')),
+            is_active INTEGER NOT NULL DEFAULT 1
+          );
+          INSERT INTO stewards_new
+            (id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+             role, assigned_by, assigned_at, is_active)
+          SELECT
+            id, nest_id, scope, node_pattern, tag_name, user_email, user_id,
+            role, assigned_by, assigned_at, is_active
+          FROM stewards;
+          DROP TABLE stewards;
+          ALTER TABLE stewards_new RENAME TO stewards;
+
+          CREATE INDEX idx_stewards_nest ON stewards(nest_id);
+          CREATE INDEX idx_stewards_email ON stewards(user_email);
+          CREATE INDEX idx_stewards_scope ON stewards(nest_id, scope);
+          CREATE UNIQUE INDEX idx_stewards_uniq_nest
+            ON stewards(nest_id, user_email)
+            WHERE scope = 'nest' AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_document
+            ON stewards(nest_id, node_pattern, user_email)
+            WHERE scope = 'document' AND node_pattern IS NOT NULL AND is_active = 1;
+          CREATE UNIQUE INDEX idx_stewards_uniq_tag
+            ON stewards(nest_id, tag_name, user_email)
+            WHERE scope = 'tag' AND tag_name IS NOT NULL AND is_active = 1;
+          CREATE INDEX idx_stewards_tag_lookup
+            ON stewards(nest_id, tag_name)
+            WHERE scope = 'tag' AND is_active = 1;
+          CREATE INDEX idx_stewards_doc_lookup
+            ON stewards(nest_id, node_pattern)
+            WHERE scope = 'document' AND is_active = 1;
+        `);
+      }
+      recordMigration("008_drop_steward_folder_scope");
+    })();
+  }
 }
 
 // src/db/client.ts
@@ -419,5 +563,7 @@ function getDb() {
 
 export {
   config,
+  ANON_USER_ID,
+  ANON_EMAIL,
   getDb
 };