@promptowl/contextnest-community 1.0.0 → 1.1.0

package/dist/index.js

@@ -6,16 +6,7 @@ import {
   hashPassword,
   parseBearerToken,
   verifyPassword
-} from "./chunk-7K2LLJXK.js";
-import {
-  checkConflict,
-  createVersion,
-  getApprovedVersion,
-  getCurrentVersion,
-  getDisplayStatus,
-  getVersions,
-  setApprovedVersion
-} from "./chunk-BLOPZDPL.js";
+} from "./chunk-XRK6SQSC.js";
 import {
   approve,
   cancelReview,
@@ -23,27 +14,77 @@ import {
   getReviewHistory,
   getReviewQueue,
   reject,
+  safePublishDocument,
   submitForReview
-} from "./chunk-XDCW4HTW.js";
+} from "./chunk-S2EWN2VA.js";
+import {
+  checkConflict,
+  createVersion,
+  getApprovedVersion,
+  getCurrentVersion,
+  getDisplayStatus,
+  getVersions,
+  setApprovedVersion
+} from "./chunk-7UTMBL6Z.js";
 import {
-  assignSteward,
+  AppError,
+  ConflictError,
+  ForbiddenError,
+  NotFoundError,
+  ValidationError,
+  canCreateInNest,
+  canManageStewards,
+  canManageWith,
   canUserAccess,
   canUserApprove,
   canUserEdit,
+  createNest,
   createStewardRecord,
+  deleteNest,
+  disableStewardshipAndWipeGovernance,
+  engineCache,
+  getCollaboratorRole,
+  getCurrentLicense,
+  getNest,
+  getStewardRolesForUser,
   getStewardsForNest,
+  getStewardsForUser,
+  getSuspensionReason,
+  importNest,
+  installLicenseKey,
+  isLicenseAdminEmail,
+  isLicenseAdminUserId,
+  isPublicReader,
+  isStewardshipEnabled,
   isSuperAdmin,
+  isSuspended,
+  listNests,
+  listPublicNests,
+  listSharedNests,
   listStewards,
   loadAccessConfig,
+  nestAllowsSelfApprove,
+  permissionLevel,
   removeSteward,
+  resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
-  syncFromConfig
-} from "./chunk-2FXVMVZJ.js";
+  resolveUserRoles,
+  setAllowSelfApprove,
+  setStewardshipEnabled,
+  startLicenseSafetyPoll,
+  startTelemetryLoop,
+  syncFromConfig,
+  trackEvent,
+  updateSteward,
+  validateLicense
+} from "./chunk-WCOUCBDJ.js";
 import {
+  ANON_EMAIL,
+  ANON_USER_ID,
   config,
   getDb
-} from "./chunk-2TW25QEA.js";
+} from "./chunk-TDAX3JOT.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -168,427 +209,9 @@ var authMiddleware = createMiddleware(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
-// src/shared/errors.ts
-var AppError = class extends Error {
-  constructor(statusCode, message) {
-    super(message);
-    this.statusCode = statusCode;
-    this.name = "AppError";
-  }
-  statusCode;
-};
-var NotFoundError = class extends AppError {
-  constructor(message = "Not found") {
-    super(404, message);
-    this.name = "NotFoundError";
-  }
-};
-var ValidationError = class extends AppError {
-  constructor(message) {
-    super(400, message);
-    this.name = "ValidationError";
-  }
-};
-var ConflictError = class extends AppError {
-  constructor(message) {
-    super(409, message);
-    this.name = "ConflictError";
-  }
-};
-
-// src/telemetry/tracker.ts
-function trackEvent(event, data) {
-  if (!config.TELEMETRY_ENABLED) return;
-  try {
-    const db = getDb();
-    db.prepare(
-      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)"
-    ).run(event, data ? JSON.stringify(data) : null);
-  } catch {
-  }
-}
-async function flushTelemetry() {
-  if (!config.TELEMETRY_ENABLED || !config.PROMPTOWL_KEY) return;
-  const db = getDb();
-  const userCount = db.prepare("SELECT COUNT(*) as c FROM users").get()?.c || 0;
-  const nestCount = db.prepare("SELECT COUNT(*) as c FROM nests").get()?.c || 0;
-  const events = db.prepare(
-    "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
-  ).all();
-  if (events.length === 0 && userCount === 0) return;
-  const payload = {
-    server_key: config.PROMPTOWL_KEY,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    stats: { users: userCount, nests: nestCount },
-    events: events.map((e) => ({
-      event: e.event,
-      data: e.data_json ? JSON.parse(e.data_json) : null,
-      at: e.created_at
-    }))
-  };
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload)
-    });
-    if (res.ok && events.length > 0) {
-      const ids = events.map((e) => e.id);
-      db.prepare(
-        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
-      ).run(...ids);
-    }
-  } catch {
-  }
-}
-var telemetryTimer = null;
-function startTelemetryLoop() {
-  if (!config.TELEMETRY_ENABLED) return;
-  setTimeout(() => flushTelemetry(), 3e4);
-  telemetryTimer = setInterval(
-    () => flushTelemetry(),
-    config.TELEMETRY_INTERVAL_MS
-  );
-}
-
-// src/auth/license.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-var currentLicense = null;
-function getCurrentLicense() {
-  return currentLicense;
-}
-function isLicenseAdminEmail(email) {
-  if (!email) return false;
-  const lic = currentLicense;
-  if (!lic?.valid || !lic.ownerEmail) return false;
-  return lic.ownerEmail.toLowerCase() === email.toLowerCase();
-}
-function isLicenseAdminUserId(userId) {
-  try {
-    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
-    return isLicenseAdminEmail(row?.email);
-  } catch {
-    return false;
-  }
-}
-function upsertEnvVar(filePath, varName, value) {
-  const prefix = `${varName}=`;
-  let lines = [];
-  if (existsSync(filePath)) {
-    lines = readFileSync(filePath, "utf8").split(/\r?\n/);
-  }
-  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
-  if (value !== null) {
-    filtered.push(`${prefix}${value}`);
-  }
-  while (filtered.length && filtered[filtered.length - 1] === "") {
-    filtered.pop();
-  }
-  writeFileSync(filePath, filtered.join("\n") + "\n", "utf8");
-}
-async function installLicenseKey(key) {
-  const trimmed = key.trim();
-  if (!trimmed.startsWith("pk_")) {
-    throw new Error("Invalid license key format. Must start with pk_.");
-  }
-  const previousKey = process.env.PROMPTOWL_KEY || "";
-  process.env.PROMPTOWL_KEY = trimmed;
-  const info = await validateLicense({ forceFresh: true });
-  if (!info.valid) {
-    process.env.PROMPTOWL_KEY = previousKey;
-    if (previousKey) {
-      await validateLicense({ forceFresh: true });
-    }
-    return info;
-  }
-  try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
-  } catch (err) {
-    console.warn("[license] failed to write .env:", err);
-  }
-  startLicenseWatcher();
-  return info;
-}
-var watcherActive = false;
-var watcherAbort = null;
-var WATCHER_BACKOFF_MIN_MS = 2 * 1e3;
-var WATCHER_BACKOFF_MAX_MS = 60 * 1e3;
-function startLicenseWatcher() {
-  if (watcherActive) {
-    watcherAbort?.abort();
-    return;
-  }
-  watcherActive = true;
-  void runLicenseWatcher();
-}
-async function runLicenseWatcher() {
-  let backoff = WATCHER_BACKOFF_MIN_MS;
-  while (watcherActive) {
-    const key = config.PROMPTOWL_KEY;
-    if (!key) {
-      await sleep(WATCHER_BACKOFF_MAX_MS);
-      continue;
-    }
-    try {
-      watcherAbort = new AbortController();
-      const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-      const res = await fetch(`${promptowlUrl}/api/license/listen`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          key,
-          since_updated_at: currentLicense ? (/* @__PURE__ */ new Date()).toISOString() : void 0
-        }),
-        signal: watcherAbort.signal
-      });
-      if (!res.ok) {
-        throw new Error(`listen returned ${res.status}`);
-      }
-      const data = await res.json();
-      backoff = WATCHER_BACKOFF_MIN_MS;
-      if (data.event && data.event !== "no_change") {
-        console.log(
-          `[license] event from PromptOwl: ${data.event} \u2014 revalidating`
-        );
-        const wasValid = !!currentLicense?.valid;
-        await validateLicense({ forceFresh: true });
-        const isValid = !!currentLicense?.valid;
-        if (wasValid && !isValid) {
-          handleLicenseRevoked();
-        }
-      }
-    } catch (err) {
-      if (err.name === "AbortError") {
-        continue;
-      }
-      console.warn(
-        `[license] watcher error: ${err.message}; backing off ${backoff}ms`
-      );
-      await sleep(backoff);
-      backoff = Math.min(backoff * 2, WATCHER_BACKOFF_MAX_MS);
-    } finally {
-      watcherAbort = null;
-    }
-  }
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-function handleLicenseRevoked() {
-  try {
-    const db = getDb();
-    const result = db.prepare("DELETE FROM sessions").run();
-    console.warn(
-      `[license] revoked \u2014 wiped ${result.changes} active session(s).`
-    );
-  } catch (err) {
-    console.warn("[license] failed to wipe sessions:", err);
-  }
-  try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
-    console.warn(
-      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
-    );
-  } catch (err) {
-    console.warn("[license] failed to strip key from .env:", err);
-  }
-  process.env.PROMPTOWL_KEY = "";
-  currentLicense = {
-    valid: false,
-    tier: "none",
-    org: null,
-    limits: null,
-    suspended: false,
-    suspendedReason: null,
-    ownerEmail: null
-  };
-}
-var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var suspensionFirstSeen = null;
-var suspensionConfirmed = false;
-var suspensionReason = null;
-var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
-function isSuspended() {
-  return suspensionConfirmed;
-}
-function getSuspensionReason() {
-  return suspensionReason;
-}
-async function validateLicense(opts = {}) {
-  const info = await _validateLicenseImpl(!!opts.forceFresh);
-  currentLicense = info;
-  return info;
-}
-async function _validateLicenseImpl(forceFresh) {
-  const key = config.PROMPTOWL_KEY;
-  if (!key) {
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null,
-      ownerEmail: null
-    };
-  }
-  const db = getDb();
-  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
-  if (cached && !forceFresh) {
-    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
-    if (age < CACHE_TTL_MS) {
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
-    }
-  }
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ key })
-    });
-    if (!res.ok) {
-      if (cached) {
-        console.warn(
-          "  PromptOwl unreachable, using cached license (grace period)"
-        );
-        return {
-          valid: true,
-          tier: cached.tier,
-          org: cached.org,
-          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-          suspended: suspensionConfirmed,
-          suspendedReason: suspensionReason,
-          ownerEmail: cached.owner_email || null
-        };
-      }
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null,
-        ownerEmail: null
-      };
-    }
-    const data = await res.json();
-    if (data.suspended === true) {
-      if (!suspensionFirstSeen) {
-        suspensionFirstSeen = Date.now();
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.warn(
-          `
-  WARNING: PromptOwl has flagged this server for suspension.`
-        );
-        console.warn(
-          `  Reason: ${suspensionReason}`
-        );
-        console.warn(
-          `  This will be confirmed in ~1 hour. If this is an error,`
-        );
-        console.warn(
-          `  contact support@promptowl.ai to reverse it.
-`
-        );
-      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
-        suspensionConfirmed = true;
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.error(
-          `
-  SERVER SUSPENDED: ${suspensionReason}`
-        );
-        console.error(
-          `  Write operations are disabled. Reads still work.`
-        );
-        console.error(
-          `  Contact support@promptowl.ai to resolve.
-`
-        );
-      }
-    } else {
-      if (suspensionFirstSeen) {
-        console.log("  Suspension flag cleared by PromptOwl.");
-      }
-      suspensionFirstSeen = null;
-      suspensionConfirmed = false;
-      suspensionReason = null;
-    }
-    if (!data.valid && !data.suspended) {
-      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null,
-        ownerEmail: data.owner_email || null
-      };
-    }
-    if (data.valid) {
-      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
-      db.prepare(
-        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
-         VALUES (?, ?, ?, ?, ?, datetime('now'))`
-      ).run(
-        key,
-        data.tier || "community",
-        data.org || null,
-        limitsJson,
-        data.owner_email || null
-      );
-    }
-    return {
-      valid: data.valid !== false,
-      tier: data.tier || "community",
-      org: data.org || null,
-      limits: data.limits || null,
-      suspended: suspensionConfirmed,
-      suspendedReason: suspensionReason,
-      ownerEmail: data.owner_email || null
-    };
-  } catch (err) {
-    if (cached) {
-      console.warn(
-        `  PromptOwl validation failed (${err.message}), using cached license`
-      );
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
-    }
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null,
-      ownerEmail: null
-    };
-  }
-}
-
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
-function tryConsume(key, cfg) {
-  const now = Date.now();
-  const cutoff = now - cfg.windowMs;
+function liveBucket(key, cutoff) {
   let bucket = buckets.get(key);
   if (!bucket) {
     bucket = { hits: [] };
@@ -597,14 +220,29 @@ function tryConsume(key, cfg) {
   while (bucket.hits.length && bucket.hits[0] < cutoff) {
     bucket.hits.shift();
   }
+  return bucket;
+}
+function tryConsume(key, cfg) {
+  const now = Date.now();
+  const bucket = liveBucket(key, now - cfg.windowMs);
   if (bucket.hits.length >= cfg.max) {
     return false;
   }
   bucket.hits.push(now);
   return true;
 }
+function isLimited(key, cfg) {
+  return liveBucket(key, Date.now() - cfg.windowMs).hits.length >= cfg.max;
+}
+function recordFailure(key, cfg) {
+  liveBucket(key, Date.now() - cfg.windowMs).hits.push(Date.now());
+}
+function clear(key) {
+  buckets.delete(key);
+}
 
 // src/auth/routes.ts
+import { getConnInfo } from "@hono/node-server/conninfo";
 var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
@@ -613,6 +251,11 @@ function clientIp(c) {
   if (xff) return xff.split(",")[0].trim();
   const realIp = c.req.header("x-real-ip");
   if (realIp) return realIp.trim();
+  try {
+    const addr = getConnInfo(c).remote.address;
+    if (addr) return addr;
+  } catch {
+  }
   return "unknown";
 }
 function resolveCallerUserId(c) {
@@ -691,7 +334,10 @@ authRoutes.post("/login", async (c) => {
   }
   const ip = clientIp(c);
   const emailLower = body.email.toLowerCase();
-  if (!tryConsume(`login:ip:${ip}`, LOGIN_LIMIT) || !tryConsume(`login:email:${emailLower}`, LOGIN_LIMIT)) {
+  const hasIp = ip !== "unknown";
+  const ipKey = `login:ip:${ip}`;
+  const emailKey = `login:email:${emailLower}`;
+  if (hasIp && isLimited(ipKey, LOGIN_LIMIT) || isLimited(emailKey, LOGIN_LIMIT)) {
     return c.json({ error: "Too many login attempts, try again later" }, 429);
   }
   const db = getDb();
@@ -700,8 +346,14 @@ authRoutes.post("/login", async (c) => {
   ).get(body.email);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
+    if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
+    recordFailure(emailKey, LOGIN_LIMIT);
+    console.warn(`[auth] login FAIL \u2014 counter++ ip=${ip} email=${emailLower}`);
     return c.json({ error: "Invalid credentials" }, 401);
   }
+  console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
+  if (hasIp) clear(ipKey);
+  clear(emailKey);
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -1030,17 +682,22 @@ authRoutes.get("/teammates", async (c) => {
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
-       WHERE u.id != '00000000-0000-0000-0000-000000000000'
+       WHERE u.id != ?
        ORDER BY u.created_at DESC`
-  ).all();
+  ).all(ANON_USER_ID);
   const pendingStewards = db.prepare(
     `SELECT DISTINCT s.user_email AS email
          FROM stewards s
         WHERE s.is_active = 1
           AND NOT EXISTS (
             SELECT 1 FROM users u
-              JOIN api_keys k ON k.user_id = u.id
              WHERE lower(u.email) = lower(s.user_email)
+               AND (
+                 u.is_invited = 0
+                 OR EXISTS (
+                   SELECT 1 FROM api_keys k WHERE k.user_id = u.id
+                 )
+               )
           )
         ORDER BY s.user_email`
   ).all();
@@ -1054,162 +711,736 @@ authRoutes.get("/teammates", async (c) => {
 // src/nests/routes.ts
 import { Hono as Hono2 } from "hono";
 
-// src/shared/access.ts
-var PERMISSION_LEVELS = {
-  none: 0,
-  read: 1,
-  write: 2,
-  admin: 3,
-  owner: 4
-};
-function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  const directGrant = db.prepare(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
-  ).get(nestId, userId);
-  if (directGrant) return directGrant.permission;
-  if (nest.visibility === "public") return "read";
-  return "none";
-}
-function permissionLevel(p) {
-  return PERMISSION_LEVELS[p] ?? 0;
-}
+// src/nodes/service.ts
+import { serializeDocument, parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
 
-// src/nests/service.ts
-import { join } from "path";
-import { rmSync, mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
-import { NestStorage } from "@promptowl/contextnest-engine";
-function nestPath(nestId) {
-  return join(config.DATA_ROOT, "nests", nestId);
-}
-function toSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function isStewardshipEnabled(nestId) {
-  const db = getDb();
-  const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
-  return !!row?.stewardship_enabled;
+// src/governance/tag-index-service.ts
+function normalizeTag(raw) {
+  return raw.trim().replace(/^#+/, "").toLowerCase();
 }
-function setStewardshipEnabled(nestId, enabled) {
+function syncNodeTags(nestId, nodeId, tags) {
   const db = getDb();
-  db.prepare("UPDATE nests SET stewardship_enabled = ? WHERE id = ?").run(
-    enabled ? 1 : 0,
-    nestId
+  const normalized = Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
+    )
   );
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    const insert = db.prepare(
+      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+    );
+    for (const tag of normalized) {
+      insert.run(nestId, nodeId, tag);
+    }
+  })();
 }
-async function createNest(userId, name, description) {
-  const id = uuid2();
-  const slug = toSlug(name);
+function removeNodeFromTagIndex(nestId, nodeId) {
   const db = getDb();
   db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description) VALUES (?, ?, ?, ?, ?)"
-  ).run(id, userId, name, slug, description || null);
-  const path = nestPath(id);
-  mkdirSync(path, { recursive: true });
-  const storage = new NestStorage(path);
-  await storage.init(name);
-  trackEvent("nest.create", { nestId: id, userId });
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
-}
-var ANON_USER_ID = "00000000-0000-0000-0000-000000000000";
-function listNests(userId) {
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+  ).run(nestId, nodeId);
+}
+
+// src/governance/access-guard.ts
+function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
   const db = getDb();
-  if (userId === ANON_USER_ID) {
-    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
+  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  return row?.email || "admin@localhost";
+}
+function canReadNode(nestId, nodeId, userId, userEmail) {
+  if (isPublicReader(nestId, userId)) {
+    return getApprovedVersion(nestId, nodeId) !== null;
   }
-  return db.prepare(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
-  ).all(userId, ANON_USER_ID);
+  if (!isStewardshipEnabled(nestId)) return true;
+  return canUserAccess(nestId, nodeId, userEmail).allowed;
 }
-function listSharedNests(userId) {
-  const db = getDb();
-  return db.prepare(
-    `SELECT DISTINCT n.* FROM nests n
-       JOIN nest_collaborators nc ON nc.nest_id = n.id
-       WHERE n.user_id != ? AND nc.user_id = ?
-       ORDER BY n.created_at DESC`
-  ).all(userId, userId);
-}
-function getNest(nestId) {
-  const db = getDb();
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId) || null;
+function filterAccessible(nestId, userId, userEmail, nodes) {
+  if (isPublicReader(nestId, userId)) {
+    return nodes.filter((n) => getApprovedVersion(nestId, n.id) !== null);
+  }
+  if (!isStewardshipEnabled(nestId)) return nodes;
+  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
 }
-async function deleteNest(nestId) {
-  const db = getDb();
-  db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(nestId);
-  db.prepare("DELETE FROM nests WHERE id = ?").run(nestId);
-  const path = nestPath(nestId);
+
+// src/governance/external-edit-service.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+import {
+  detectDrift,
+  stageSuggestion,
+  approveSuggestion,
+  rejectSuggestion,
+  listSuggestions,
+  readSuggestion,
+  parseDocument,
+  VersionManager,
+  computeContentHash,
+  getChecksumContent
+} from "@promptowl/contextnest-engine";
+var communityRbac = {
+  isCzar: () => false,
+  canIngest: () => true,
+  isDocOwner: () => true
+};
+function docPath(nestId, documentId) {
+  return join(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
+}
+async function readRaw(nestId, documentId) {
   try {
-    rmSync(path, { recursive: true, force: true });
+    return await readFile(docPath(nestId, documentId), "utf-8");
   } catch {
+    return null;
   }
-  trackEvent("nest.delete", { nestId });
 }
-
-// src/nests/routes.ts
-var ANON_USER_ID2 = "00000000-0000-0000-0000-000000000000";
-function effectivePermission(nestId, userId) {
-  if (config.AUTH_MODE === "open") {
-    const db = getDb();
-    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
-    if (nest && nest.user_id === ANON_USER_ID2) return "owner";
+async function loadChainHead(storage, documentId) {
+  const history = await storage.readHistory(documentId);
+  if (!history || history.versions.length === 0) return null;
+  const latest = history.versions[history.versions.length - 1];
+  try {
+    const content = await new VersionManager(storage).reconstructVersion(
+      documentId,
+      latest.version
+    );
+    return { version: latest.version, content };
+  } catch {
+    return null;
   }
-  return resolveNestPermission(nestId, userId);
 }
-var nestRoutes = new Hono2();
-nestRoutes.get("/", async (c) => {
-  const userId = c.get("userId");
-  const owned = listNests(userId);
-  const shared = listSharedNests(userId);
-  return c.json({ nests: [...owned, ...shared] });
-});
-nestRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.name) {
-    throw new ValidationError("name is required");
-  }
-  const nest = await createNest(c.get("userId"), body.name, body.description);
-  return c.json({ nest }, 201);
-});
-nestRoutes.get("/:nestId", async (c) => {
-  const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission === "none") {
-    throw new NotFoundError("Nest not found");
-  }
-  const nest = getNest(nestId);
-  return c.json({ nest, permission });
-});
-nestRoutes.delete("/:nestId", async (c) => {
-  const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission !== "owner") {
-    throw new NotFoundError("Nest not found");
-  }
-  await deleteNest(nestId);
-  return c.json({ deleted: true });
-});
-nestRoutes.get("/:nestId/settings", async (c) => {
-  const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission === "none") {
-    throw new NotFoundError("Nest not found");
+async function loadLatestApprovedNode(nestId, documentId) {
+  const { storage } = engineCache.get(nestId);
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return null;
+  return parseDocument(docPath(nestId, documentId), head.content, documentId);
+}
+async function bodyMatchesLatestVersion(storage, documentId, liveBodyHash) {
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return false;
+  const headBodyHash = computeContentHash(getChecksumContent(head.content));
+  return headBodyHash === liveBodyHash;
+}
+async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
+  const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
+  return res?.meta ?? null;
+}
+async function scanDocumentForDriftInternal(nestId, documentId, actor) {
+  const { storage } = engineCache.get(nestId);
+  const node = await storage.readDocument(documentId).catch(() => null);
+  if (!node) return null;
+  const raw = await readRaw(nestId, documentId);
+  if (raw == null) return null;
+  const drift = detectDrift(raw, node.frontmatter.checksum);
+  if (!drift.drifted) return null;
+  if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
+    return null;
   }
-  return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId)
+  const approved = await loadChainHead(storage, documentId);
+  if (!approved) return null;
+  const existing = await listSuggestions(storage, documentId);
+  const dup = existing.find((s) => s.proposed_hash === drift.actualHash);
+  if (dup) return { meta: dup, created: false };
+  const result = await stageSuggestion({
+    storage,
+    documentId,
+    approvedRawContent: approved.content,
+    proposedRawContent: raw,
+    source: "out-of-band-edit",
+    actor,
+    docTier: "standard"
   });
-});
-nestRoutes.patch("/:nestId/settings", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const isServerAdmin = isLicenseAdminUserId(userId);
-  const permission = effectivePermission(nestId, userId);
-  if (!isServerAdmin && permission !== "owner") {
-    return c.json(
+  return { meta: result.meta, created: true };
+}
+async function scanNestForDrift(nestId, actor = "system:scanner") {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const results = await Promise.all(
+    docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
+  );
+  const staged = results.filter((r) => r?.created).length;
+  return { scanned: docs.length, staged };
+}
+async function getPendingChange(nestId, documentId) {
+  const { storage } = engineCache.get(nestId);
+  const list = await listSuggestions(storage, documentId);
+  for (let i = list.length - 1; i >= 0; i--) {
+    const meta = list[i];
+    if (await bodyMatchesLatestVersion(storage, documentId, meta.proposed_hash)) {
+      continue;
+    }
+    return {
+      suggestion_id: meta.suggestion_id,
+      detected_at: meta.detected_at,
+      source: meta.source,
+      proposed_hash: meta.proposed_hash
+    };
+  }
+  return null;
+}
+async function listNestExternalEdits(nestId) {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const lists = await Promise.all(
+    docs.map(async (doc) => {
+      const metas = await listSuggestions(storage, doc.id);
+      const fresh = [];
+      for (const meta of metas) {
+        if (await bodyMatchesLatestVersion(storage, doc.id, meta.proposed_hash)) {
+          continue;
+        }
+        fresh.push(meta);
+      }
+      return fresh;
+    })
+  );
+  const entries = lists.flat().map((meta) => ({
+    suggestion_id: meta.suggestion_id,
+    nest_id: nestId,
+    document_id: meta.document_id,
+    source: meta.source,
+    detected_at: meta.detected_at,
+    actor: meta.actor,
+    target_hash: meta.target_hash,
+    proposed_hash: meta.proposed_hash,
+    note: meta.note
+  }));
+  return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
+}
+async function getExternalEditDetail(nestId, documentId, suggestionId) {
+  const { storage } = engineCache.get(nestId);
+  const found = await readSuggestion(storage, documentId, suggestionId);
+  if (!found) return null;
+  return {
+    suggestion_id: found.meta.suggestion_id,
+    nest_id: nestId,
+    document_id: found.meta.document_id,
+    source: found.meta.source,
+    detected_at: found.meta.detected_at,
+    actor: found.meta.actor,
+    target_hash: found.meta.target_hash,
+    proposed_hash: found.meta.proposed_hash,
+    note: found.meta.note,
+    patch: found.patch
+  };
+}
+async function approveExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  let result;
+  try {
+    result = await approveSuggestion({
+      storage,
+      rbac: communityRbac,
+      documentId: input.documentId,
+      suggestionId: input.suggestionId,
+      actor: input.actor,
+      zone: "default",
+      comment: input.comment
+    });
+  } catch (err) {
+    console.error(
+      `[external-edit] approveSuggestion failed for ${input.nestId}/${input.documentId} suggestion=${input.suggestionId}:`,
+      err
+    );
+    throw err;
+  }
+  try {
+    const node = await storage.readDocument(input.documentId);
+    const versionNum = result.versionEntry.version;
+    const tags = node.frontmatter.tags || [];
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
+    createVersion2({
+      nestId: input.nestId,
+      nodeId: input.documentId,
+      version: versionNum,
+      content: node.body || "",
+      author: input.actor,
+      status: "published",
+      tags,
+      changeNote: input.comment || "External edit approved"
+    });
+    setApprovedVersion2(input.nestId, input.documentId, versionNum, input.actor);
+  } catch (err) {
+    console.error(
+      `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+async function rejectExternalEdit(input) {
+  const { storage } = engineCache.get(input.nestId);
+  const result = await rejectSuggestion({
+    storage,
+    rbac: communityRbac,
+    documentId: input.documentId,
+    suggestionId: input.suggestionId,
+    actor: input.actor,
+    zone: "default",
+    reason: input.reason
+  });
+  try {
+    const approved = await loadChainHead(storage, input.documentId);
+    if (approved) {
+      await storage.writeDocument(input.documentId, approved.content);
+    }
+  } catch (err) {
+    console.error(
+      `[external-edit] revert-on-reject failed for ${input.nestId}/${input.documentId}:`,
+      err
+    );
+  }
+  return result;
+}
+var scannerTimer = null;
+async function scanAllNests() {
+  const db = getDb();
+  const rows = db.prepare("SELECT id FROM nests").all();
+  await Promise.all(
+    rows.map(
+      ({ id }) => scanNestForDrift(id).catch(
+        (err) => console.error(`[external-edit] scan failed for nest ${id}:`, err)
+      )
+    )
+  );
+}
+function startDriftScanner(intervalMs = 3e4) {
+  if (scannerTimer) return;
+  scannerTimer = setInterval(() => {
+    scanAllNests().catch(
+      (err) => console.error("[external-edit] scanner tick failed:", err)
+    );
+  }, intervalMs);
+  scannerTimer.unref?.();
+}
+
+// src/nodes/service.ts
+function userIdFromEmail(email) {
+  const db = getDb();
+  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  return row?.id ?? ANON_USER_ID;
+}
+var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
+var stripUndefined = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+function bodyOnly(nodeId, raw) {
+  try {
+    return parseDocument2(`${nodeId}.md`, raw, nodeId).body ?? "";
+  } catch {
+    return raw;
+  }
+}
+function toNodeResponse(node) {
+  const fm = node.frontmatter;
+  const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
+  const tags = Array.isArray(fm.tags) ? fm.tags.map((t) => String(t)) : [];
+  return {
+    id: node.id,
+    title,
+    type: fm.type || "document",
+    tags,
+    status: fm.status || "draft",
+    version: fm.version || 1,
+    author: fm.author,
+    description: fm.description,
+    created_at: fm.created_at,
+    updated_at: fm.updated_at,
+    content: node.body || "",
+    pendingChange: node.pendingChange ?? void 0
+  };
+}
+async function listNodesForCaller(nestId, userId, filters = {}) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  let documents = await storage.discoverDocuments();
+  if (filters.type) {
+    documents = documents.filter((n) => n.frontmatter.type === filters.type);
+  }
+  if (filters.tag) {
+    const tag = normalizeTag2(filters.tag);
+    documents = documents.filter(
+      (n) => (n.frontmatter.tags || []).includes(tag)
+    );
+  }
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const publicReader = isPublicReader(nestId, userId);
+  const enriched = await Promise.all(
+    accessible.map(async (doc) => {
+      const r = toNodeResponse(doc);
+      if (publicReader) {
+        const approved = getApprovedVersion(nestId, doc.id);
+        if (approved != null) {
+          try {
+            const raw = await versionManager.reconstructVersion(doc.id, approved);
+            r.content = bodyOnly(doc.id, raw);
+          } catch (err) {
+            console.error("reconstructVersion failed (list)", doc.id, approved, err);
+            r.content = "";
+          }
+          r.version = approved;
+          r.status = "published";
+        }
+        return r;
+      }
+      let pending = null;
+      try {
+        pending = await getPendingChange(nestId, doc.id);
+      } catch {
+        pending = null;
+      }
+      if (pending) {
+        r.pendingChange = pending;
+        r.status = "external_edit_pending";
+      } else {
+        r.status = getDisplayStatus(nestId, r.id);
+      }
+      return r;
+    })
+  );
+  return filters.limit ? enriched.slice(0, filters.limit) : enriched;
+}
+async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
+  return listNodesForCaller(nestId, userIdFromEmail(userEmail), filters);
+}
+async function createNode(nestId, input, userEmail) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const id = `nodes/${slug}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const tags = (input.tags || []).map(normalizeTag2);
+  const hasStewards = isStewardshipEnabled(nestId);
+  const initialStatus = hasStewards ? "draft" : "published";
+  const initialVersion = hasStewards ? 1 : 0;
+  let node = {
+    id,
+    filePath: "",
+    frontmatter: {
+      title: input.title,
+      type: input.type || "document",
+      tags,
+      status: input.status || initialStatus,
+      version: initialVersion,
+      created_at: now,
+      updated_at: now,
+      metadata: { owners: ["*"], scope: input.scope || "team" }
+    },
+    body: input.content,
+    rawContent: ""
+  };
+  await storage.writeDocument(id, serializeDocument(node));
+  syncNodeTags(nestId, id, tags);
+  let savedVersion = 1;
+  if (hasStewards) {
+    try {
+      await versionManager.createVersion(node, userEmail);
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node create)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId: id,
+      version: 1,
+      content: input.content,
+      author: userEmail,
+      status: "draft",
+      tags
+    });
+  } else {
+    try {
+      const result = await safePublishDocument(storage, id, {
+        editedBy: userEmail,
+        note: "Auto-published on create (no stewards configured)"
+      });
+      savedVersion = result.node.frontmatter.version || 1;
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: savedVersion,
+        content: result.node.body || "",
+        author: userEmail,
+        status: "published",
+        tags
+      });
+      setApprovedVersion(nestId, id, savedVersion, userEmail);
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node create auto-publish)", err);
+      createVersion({
+        nestId,
+        nodeId: id,
+        version: 1,
+        content: input.content,
+        author: userEmail,
+        status: "draft",
+        tags
+      });
+    }
+  }
+  trackEvent("node.create", { nestId, nodeId: id });
+  return { node, version: savedVersion };
+}
+async function registerImportedDocuments(nestId, userEmail) {
+  const { storage } = engineCache.get(nestId);
+  let docs;
+  try {
+    docs = await storage.discoverDocuments();
+  } catch (err) {
+    console.error("registerImportedDocuments: discovery failed", nestId, err);
+    return 0;
+  }
+  let registered = 0;
+  for (const doc of docs) {
+    const nodeId = doc.id;
+    if (getCurrentVersion(nestId, nodeId) > 0) continue;
+    const rawTags = Array.isArray(doc.frontmatter?.tags) ? doc.frontmatter.tags : [];
+    const tags = rawTags.map((t) => normalizeTag2(String(t)));
+    const fmVersion = Number(doc.frontmatter?.version);
+    let version = Number.isFinite(fmVersion) && fmVersion > 0 ? fmVersion : 1;
+    let content = doc.body || "";
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: userEmail,
+        note: "Imported from existing folder"
+      });
+      version = result.node.frontmatter.version || version;
+      content = result.node.body || content;
+    } catch (err) {
+      console.error("safePublishDocument failed (import register)", nodeId, err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version,
+      content,
+      author: userEmail,
+      status: "published",
+      changeNote: "Imported from existing folder",
+      tags
+    });
+    setApprovedVersion(nestId, nodeId, version, userEmail);
+    syncNodeTags(nestId, nodeId, tags);
+    registered++;
+  }
+  trackEvent("nest.import.documents", { nestId, registered });
+  return registered;
+}
+async function updateNode(nestId, nodeId, patch, userEmail) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  let node;
+  try {
+    node = await storage.readDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  if (patch.content !== void 0) {
+    node = { ...node, body: patch.content };
+  }
+  if (patch.append) {
+    node = { ...node, body: (node.body || "") + "\n\n" + patch.append };
+  }
+  if (patch.tags) {
+    const newTags = patch.tags.map(normalizeTag2);
+    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
+    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
+  }
+  if (patch.status) {
+    node = { ...node, frontmatter: { ...node.frontmatter, status: patch.status } };
+  }
+  if (patch.title) {
+    node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
+  }
+  const hasStewards = isStewardshipEnabled(nestId);
+  const currentTags = node.frontmatter.tags || [];
+  if (getPendingReview(nestId, nodeId)) {
+    cancelReview({ nestId, nodeId, cancelledBy: userEmail });
+  }
+  let responseVersion;
+  if (hasStewards) {
+    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const newVersion = currentVersion + 1;
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        version: newVersion,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Drop stale published-state checksum so the next verified read
+        // doesn't flag this write as external drift.
+        checksum: void 0
+      }
+    };
+    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    try {
+      await versionManager.createVersion(node, userEmail, { note: patch.changeNote });
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node patch)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: newVersion,
+      content: node.body || "",
+      author: userEmail,
+      status: "draft",
+      tags: currentTags,
+      changeNote: patch.changeNote
+    });
+    responseVersion = newVersion;
+  } else {
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        checksum: void 0
+      }
+    };
+    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    let publishedVersion = (node.frontmatter.version || 0) + 1;
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: userEmail,
+        note: patch.changeNote || "Auto-published on edit (no stewards)"
+      });
+      publishedVersion = result.node.frontmatter.version || publishedVersion;
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node patch auto-publish)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: publishedVersion,
+      content: node.body || "",
+      author: userEmail,
+      status: "published",
+      tags: currentTags,
+      changeNote: patch.changeNote
+    });
+    setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
+    responseVersion = publishedVersion;
+  }
+  return { node, version: responseVersion };
+}
+
+// src/nests/routes.ts
+function effectivePermission(nestId, userId) {
+  if (config.AUTH_MODE === "open") {
+    const db = getDb();
+    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+    if (nest && nest.user_id === ANON_USER_ID) return "owner";
+  }
+  return resolveNestPermission(nestId, userId);
+}
+var nestRoutes = new Hono2();
+nestRoutes.get("/", async (c) => {
+  const userId = c.get("userId");
+  const owned = listNests(userId);
+  const shared = listSharedNests(userId);
+  const publicExtras = listPublicNests(userId);
+  const db = getDb();
+  const ownerEmailStmt = db.prepare(
+    "SELECT email FROM users WHERE id = ?"
+  );
+  const callerEmail = resolveCallerEmail(userId);
+  const annotate = (n) => {
+    const permission = effectivePermission(n.id, userId);
+    const is_owner = permission === "owner";
+    let owner_email = null;
+    const roles = is_owner ? ["owner"] : resolveUserRoles(n.id, callerEmail);
+    if (!is_owner && n.user_id !== ANON_USER_ID) {
+      const row = ownerEmailStmt.get(n.user_id);
+      owner_email = row?.email ?? null;
+    }
+    return { ...n, permission, is_owner, owner_email, roles };
+  };
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (seen.has(n.id)) continue;
+    seen.add(n.id);
+    out.push(annotate(n));
+  }
+  return c.json({ nests: out });
+});
+nestRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.name) {
+    throw new ValidationError("name is required");
+  }
+  const nest = await createNest(c.get("userId"), body.name, body.description);
+  return c.json({ nest }, 201);
+});
+nestRoutes.post("/import", async (c) => {
+  const body = await c.req.json();
+  if (!body.name) {
+    throw new ValidationError("name is required");
+  }
+  const files = Array.isArray(body.files) ? body.files : [];
+  const userId = c.get("userId");
+  const nest = await importNest(userId, body.name, files);
+  const documents = await registerImportedDocuments(
+    nest.id,
+    resolveCallerEmail(userId)
+  );
+  return c.json({ nest, documents }, 201);
+});
+nestRoutes.get("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const permission = effectivePermission(nestId, userId);
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  const email = resolveCallerEmail(userId);
+  let roles = resolveUserRoles(nestId, email);
+  if (permission === "owner" && !roles.includes("owner")) {
+    roles = ["owner", ...roles];
+  }
+  const myStewards = getStewardsForUser(nestId, email);
+  const nest = getNest(nestId);
+  return c.json({ nest, permission, roles, myStewards });
+});
+nestRoutes.delete("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nest = getNest(nestId);
+  if (!nest) {
+    throw new NotFoundError("Nest not found");
+  }
+  const permission = effectivePermission(nestId, userId);
+  const isAnonOwned = nest.user_id === ANON_USER_ID;
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  if (permission !== "owner" && !adminCaretaker) {
+    throw new ForbiddenError(
+      "You don't have permission to delete this nest. Only the nest owner can delete it."
+    );
+  }
+  await deleteNest(nestId);
+  return c.json({ deleted: true });
+});
+nestRoutes.get("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const permission = effectivePermission(nestId, c.get("userId"));
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  return c.json({
+    stewardship_enabled: isStewardshipEnabled(nestId),
+    allow_self_approve: nestAllowsSelfApprove(nestId)
+  });
+});
+nestRoutes.patch("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const isServerAdmin = isLicenseAdminUserId(userId);
+  const permission = effectivePermission(nestId, userId);
+  if (!isServerAdmin && permission !== "owner") {
+    return c.json(
       {
         error: "Only the nest owner or the server license-admin can update nest settings."
       },
@@ -1217,61 +1448,111 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
     );
   }
   const body = await c.req.json();
+  let wiped = null;
   if (typeof body.stewardship_enabled === "boolean") {
-    setStewardshipEnabled(nestId, body.stewardship_enabled);
+    if (body.stewardship_enabled) {
+      setStewardshipEnabled(nestId, true);
+    } else {
+      wiped = disableStewardshipAndWipeGovernance(nestId);
+    }
+  }
+  if (typeof body.allow_self_approve === "boolean") {
+    setAllowSelfApprove(nestId, body.allow_self_approve);
   }
   return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId)
+    stewardship_enabled: isStewardshipEnabled(nestId),
+    allow_self_approve: nestAllowsSelfApprove(nestId),
+    wiped
   });
 });
 
 // src/nests/sharing-routes.ts
 import { Hono as Hono3 } from "hono";
-import { v4 as uuid3 } from "uuid";
-var sharingRoutes = new Hono3();
-sharingRoutes.get("/collaborators", async (c) => {
-  const db = getDb();
-  const collabs = db.prepare(
-    `SELECT nc.*, u.email FROM nest_collaborators nc
-       LEFT JOIN users u ON nc.user_id = u.id
-       WHERE nc.nest_id = ?
-       ORDER BY nc.granted_at`
-  ).all(c.req.param("nestId"));
-  return c.json({ collaborators: collabs });
-});
-sharingRoutes.post("/collaborators", async (c) => {
-  const body = await c.req.json();
-  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
+
+// src/nests/sharing-service.ts
+import { v4 as uuid2 } from "uuid";
+var VALID_PERMISSIONS = ["read", "write", "admin"];
+async function addCollaborator(params) {
+  const { nestId } = params;
+  if (!params.permission || !VALID_PERMISSIONS.includes(params.permission)) {
     throw new ValidationError("permission must be read, write, or admin");
   }
   const db = getDb();
-  let userId = body.user_id;
-  if (!userId && body.email) {
-    let user = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
-    if (!user) {
-      const { hashPassword: hashPassword2 } = await import("./keys-YV33AJK3.js");
-      userId = uuid3();
+  let userId = params.userId;
+  if (!userId && params.email) {
+    const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(params.email);
+    if (existing) {
+      userId = existing.id;
+    } else {
+      const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
+      userId = uuid2();
       db.prepare(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, body.email, null, await hashPassword2(uuid3()));
-    } else {
-      userId = user.id;
+      ).run(userId, params.email, null, await hashPassword2(uuid2()));
     }
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
   }
-  const collabId = uuid3();
+  const ownerRow = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+  if (!ownerRow) {
+    throw new ValidationError("Nest not found");
+  }
+  if (ownerRow.user_id === userId) {
+    throw new ValidationError(
+      "The nest owner already has full access and can't be added as a collaborator."
+    );
+  }
+  const selfByEmail = !!params.email && !!params.grantedByEmail && params.email.trim().toLowerCase() === params.grantedByEmail.trim().toLowerCase();
+  const selfById = !!params.grantedByUserId && params.grantedByUserId === userId;
+  if (selfByEmail || selfById) {
+    throw new ValidationError("You can't add yourself as a collaborator.");
+  }
+  const dupe = db.prepare("SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?").get(nestId, userId);
+  if (dupe) {
+    throw new ConflictError(
+      `${params.email || "This user"} already has access to this nest. Change their permission instead of adding them again.`
+    );
+  }
+  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(params.grantedByEmail)?.id : void 0;
+  const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
+  const collabId = uuid2();
   db.prepare(
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    collabId,
-    c.req.param("nestId"),
-    userId,
-    body.permission,
-    c.get("userId")
-  );
-  const collab = db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+  ).run(collabId, nestId, userId, params.permission, granterId);
+  return db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+}
+
+// src/nests/sharing-routes.ts
+var sharingRoutes = new Hono3();
+sharingRoutes.get("/collaborators", async (c) => {
+  const db = getDb();
+  const nestId = c.req.param("nestId");
+  const collabs = db.prepare(
+    `SELECT nc.*, u.email FROM nest_collaborators nc
+       LEFT JOIN users u ON nc.user_id = u.id
+       WHERE nc.nest_id = ?
+       ORDER BY nc.granted_at`
+  ).all(nestId);
+  const enriched = collabs.map((collab) => {
+    if (!collab.email) return { ...collab, stewardRoles: [], roles: [] };
+    return {
+      ...collab,
+      stewardRoles: getStewardRolesForUser(nestId, collab.email),
+      roles: resolveUserRoles(nestId, collab.email)
+    };
+  });
+  return c.json({ collaborators: enriched });
+});
+sharingRoutes.post("/collaborators", async (c) => {
+  const body = await c.req.json();
+  const collab = await addCollaborator({
+    nestId: c.req.param("nestId"),
+    email: body.email,
+    userId: body.user_id,
+    permission: body.permission ?? "",
+    grantedByUserId: c.get("userId")
+  });
   return c.json({ collaborator: collab }, 201);
 });
 sharingRoutes.patch("/collaborators/:collabId", async (c) => {
@@ -1305,174 +1586,36 @@ sharingRoutes.patch("/visibility", async (c) => {
   );
   return c.json({ visibility: body.visibility });
 });
-
-// src/nodes/routes.ts
-import { Hono as Hono4 } from "hono";
-import { serializeDocument } from "@promptowl/contextnest-engine";
-
-// src/nodes/engine.ts
-import { join as join2 } from "path";
-import {
-  NestStorage as NestStorage2,
-  GraphQueryEngine,
-  VersionManager
-} from "@promptowl/contextnest-engine";
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath2 = join2(config.DATA_ROOT, "nests", nestId);
-      const storage = new NestStorage2(nestPath2);
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-
-// src/governance/tag-index-service.ts
-function normalizeTag(raw) {
-  return raw.trim().replace(/^#+/, "").toLowerCase();
-}
-function syncNodeTags(nestId, nodeId, tags) {
-  const db = getDb();
-  const normalized = Array.from(
-    new Set(
-      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
-    )
-  );
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    const insert = db.prepare(
-      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
-    );
-    for (const tag of normalized) {
-      insert.run(nestId, nodeId, tag);
-    }
-  })();
-}
-function removeNodeFromTagIndex(nestId, nodeId) {
-  const db = getDb();
-  db.prepare(
-    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-  ).run(nestId, nodeId);
-}
-
-// src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
-  if (!userId) return "admin@localhost";
-  const db = getDb();
-  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
-  return row?.email || "admin@localhost";
-}
-function canReadNode(nestId, nodeId, userEmail) {
-  if (!isStewardshipEnabled(nestId)) return true;
-  return canUserAccess(nestId, nodeId, userEmail).allowed;
-}
-function filterAccessible(nestId, userEmail, nodes) {
-  if (!isStewardshipEnabled(nestId)) return nodes;
-  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
-}
-
-// src/nodes/routes.ts
-var nodeRoutes = new Hono4();
-function toNodeResponse(node) {
-  return {
-    id: node.id,
-    title: node.frontmatter.title,
-    type: node.frontmatter.type || "document",
-    tags: node.frontmatter.tags || [],
-    // Widen to string so callers can layer review-workflow states like
-    // "pending_review" / "rejected" on top of the on-disk frontmatter
-    // status. The engine's Status enum only knows draft/approved.
-    status: node.frontmatter.status || "draft",
-    version: node.frontmatter.version || 1,
-    author: node.frontmatter.author,
-    description: node.frontmatter.description,
-    created_at: node.frontmatter.created_at,
-    updated_at: node.frontmatter.updated_at,
-    content: node.body
-  };
-}
-nodeRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
-  const documents = await storage.discoverDocuments();
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, documents);
-  return c.json({
-    count: accessible.length,
-    nodes: accessible.map((doc) => {
-      const r = toNodeResponse(doc);
-      r.status = getDisplayStatus(nestId, r.id);
-      return r;
-    })
-  });
-});
-nodeRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.title || !body.content) {
-    throw new ValidationError("title and content are required");
-  }
-  const nestId = c.req.param("nestId");
-  const { storage, versions: versionManager } = engineCache.get(nestId);
-  const slug = body.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  const id = `nodes/${slug}`;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const tags = body.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
-  const hasStewards = isStewardshipEnabled(nestId);
-  const initialStatus = hasStewards ? "draft" : "approved";
-  const node = {
-    id,
-    filePath: "",
-    frontmatter: {
-      title: body.title,
-      type: body.type || "document",
-      tags,
-      status: body.status || initialStatus,
-      version: 1,
-      created_at: now,
-      updated_at: now,
-      metadata: {
-        owners: ["*"],
-        scope: body.scope || "team"
-      }
-    },
-    body: body.content,
-    rawContent: ""
-  };
-  const serialized = serializeDocument(node);
-  await storage.writeDocument(id, serialized);
-  syncNodeTags(nestId, id, tags);
-  const authorEmail = getUserEmail(c);
-  try {
-    await versionManager.createVersion(node, authorEmail);
-  } catch (err) {
-    console.error("VersionManager.createVersion failed (node create)", err);
+
+// src/nodes/routes.ts
+import { Hono as Hono4 } from "hono";
+var nodeRoutes = new Hono4();
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nodes = await listNodesForCaller(nestId, userId);
+  return c.json({ count: nodes.length, nodes });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
   }
-  createVersion({
+  const nestId = c.req.param("nestId");
+  const authorEmail = getUserEmail(c);
+  const { node } = await createNode(
     nestId,
-    nodeId: id,
-    version: 1,
-    content: body.content,
-    author: authorEmail,
-    status: initialStatus,
-    tags
-  });
-  if (initialStatus === "approved") {
-    setApprovedVersion(nestId, id, 1, authorEmail);
-  }
-  trackEvent("node.create", { nestId, nodeId: id });
-  const resolved = resolveStewardsForNode(nestId, id);
+    {
+      title: body.title,
+      content: body.content,
+      type: body.type,
+      tags: body.tags,
+      scope: body.scope,
+      status: body.status
+    },
+    authorEmail
+  );
+  const resolved = resolveStewardsForNode(nestId, node.id);
   return c.json({
     node: toNodeResponse(node),
     stewards: resolved.length > 0 ? resolved.map((r) => ({
@@ -1485,7 +1628,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZJATH6OM.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-3XGX7QIN.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1497,8 +1640,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -1507,7 +1649,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-2MZJGE3H.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1538,16 +1680,17 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2JHZHZWJ.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-3OJIPYNV.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  if (!canReadNode(nestId, nodeId, userEmail)) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json(
       { error: "Access denied \u2014 no steward assignment for this node" },
       403
@@ -1555,18 +1698,61 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
   }
   let node;
   try {
-    node = await storage.readDocument(nodeId);
+    node = await storage.readDocument(nodeId, { verifyChecksum: true });
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
+  if (node.pendingChange) {
+    try {
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
+    } catch (err) {
+      console.error("[external-edit] stage-on-read failed:", err);
+    }
+    try {
+      const latest = await loadLatestApprovedNode(nestId, nodeId);
+      if (latest) {
+        node = { ...latest, pendingChange: node.pendingChange };
+      }
+    } catch (err) {
+      console.error("[external-edit] reconstruct-latest failed:", err);
+    }
+  }
   const response = toNodeResponse(node);
-  response.status = getDisplayStatus(nestId, nodeId);
+  if (isPublicReader(nestId, userId)) {
+    const approved = getApprovedVersion(nestId, nodeId);
+    if (approved != null) {
+      try {
+        const raw = await versionManager.reconstructVersion(
+          nodeId,
+          approved
+        );
+        response.content = bodyOnly(nodeId, raw);
+      } catch (err) {
+        console.error(
+          "reconstructVersion failed (public single)",
+          nodeId,
+          approved,
+          err
+        );
+        response.content = "";
+      }
+      response.version = approved;
+      response.status = "published";
+      return c.json({ node: response });
+    }
+  }
+  response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
+  if (response.status === "pending_review") {
+    const pending = getPendingReview(nestId, nodeId);
+    response.pendingReviewBy = pending?.requestedBy ?? null;
+  }
   return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = engineCache.get(nestId);
   const body = await c.req.json();
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
@@ -1586,80 +1772,21 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       );
     }
   }
-  let node;
-  try {
-    node = await storage.readDocument(nodeId);
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  if (body.content !== void 0) {
-    node = { ...node, body: body.content };
-  }
-  if (body.append) {
-    node = { ...node, body: (node.body || "") + "\n\n" + body.append };
-  }
-  if (body.tags) {
-    const newTags = body.tags.map((t) => t.startsWith("#") ? t : `#${t}`);
-    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
-    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
-  }
-  if (body.status) {
-    node = {
-      ...node,
-      frontmatter: { ...node.frontmatter, status: body.status }
-    };
-  }
-  if (body.title) {
-    node = {
-      ...node,
-      frontmatter: { ...node.frontmatter, title: body.title }
-    };
-  }
-  const currentVersion = getCurrentVersion(nestId, nodeId);
-  const newVersion = currentVersion + 1;
-  node = {
-    ...node,
-    frontmatter: {
-      ...node.frontmatter,
-      version: newVersion,
-      updated_at: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  const fm = Object.fromEntries(
-    Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
-  );
-  node = { ...node, frontmatter: fm };
-  const serialized = serializeDocument(node);
-  await storage.writeDocument(nodeId, serialized);
   const authorEmail = getUserEmail(c);
-  const hasStewards = isStewardshipEnabled(nestId);
-  const currentTags = node.frontmatter.tags || [];
-  syncNodeTags(nestId, nodeId, currentTags);
-  try {
-    await versionManager.createVersion(node, authorEmail, {
-      note: body.changeNote
-    });
-  } catch (err) {
-    console.error("VersionManager.createVersion failed (node patch)", err);
-  }
-  createVersion({
+  const { node, version: responseVersion } = await updateNode(
     nestId,
     nodeId,
-    version: newVersion,
-    content: node.body || "",
-    author: authorEmail,
-    status: hasStewards ? "draft" : "approved",
-    tags: currentTags,
-    changeNote: body.changeNote
-  });
-  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-2JHZHZWJ.js");
-  if (getPendingReview2(nestId, nodeId)) {
-    cancelReview2({ nestId, nodeId, cancelledBy: authorEmail });
-  }
-  if (!hasStewards) {
-    setApprovedVersion(nestId, nodeId, newVersion, authorEmail);
-  }
-  return c.json({ node: toNodeResponse(node), version: newVersion });
+    {
+      content: body.content,
+      append: body.append,
+      tags: body.tags,
+      title: body.title,
+      status: body.status,
+      changeNote: body.changeNote
+    },
+    authorEmail
+  );
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
 });
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
@@ -1682,6 +1809,10 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
     db.prepare(
       "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
     ).run(nestId, nodeId);
+    db.prepare(
+      `DELETE FROM stewards
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`
+    ).run(nestId, nodeId);
   })();
   trackEvent("node.delete", { nestId, nodeId });
   return c.json({ deleted: true });
@@ -1951,9 +2082,10 @@ queryRoutes.post("/context", async (c) => {
       }
     }
   }
-  const userEmail = resolveCallerEmail(c.get("userId"));
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
   const beforePermission = documents.length;
-  const accessible = filterAccessible(nestId, userEmail, documents);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
   const included = [];
   let tokenCount = 0;
@@ -2010,8 +2142,9 @@ queryRoutes.post("/query", async (c) => {
   const result = await queryEngine.query(body.query, {
     hops: body.hops ?? 2
   });
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, result.documents);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, result.documents);
   return c.json({
     query: body.query,
     count: accessible.length,
@@ -2042,8 +2175,9 @@ queryRoutes.get("/search", async (c) => {
     ].join(" ").toLowerCase();
     return terms.every((term) => haystack.includes(term));
   });
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, matches);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
@@ -2144,7 +2278,6 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 // src/mcp/tools.ts
-import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
 var TOOL_DEFINITIONS = [
   {
     name: "context_init",
@@ -2346,17 +2479,32 @@ var TOOL_DEFINITIONS = [
   },
   {
     name: "context_assign_steward",
-    description: "Assign a data steward to govern a scope (nest, tag, folder pattern, or specific document). Stewards review and approve changes before they go live.",
+    description: "Assign a data steward to govern a scope (nest, tag, or specific document). Stewards review and approve changes before they go live.",
     inputSchema: {
       type: "object",
       properties: {
         email: { type: "string", description: "Email of the person to assign as steward" },
-        scope: { type: "string", description: "Scope: nest (all docs), tag, folder, or document" },
-        target: { type: "string", description: "Scope target: tag name (e.g. #architecture), folder pattern (e.g. nodes/api-*), or document title" },
+        scope: { type: "string", description: "Scope: nest (all docs), tag, or document" },
+        target: { type: "string", description: "Scope target: tag name (e.g. #architecture) or document title" },
         role: { type: "string", description: "Role: reviewer (default), editor, or viewer" }
       },
       required: ["email", "scope"]
     }
+  },
+  {
+    name: "context_share_nest",
+    description: "Share this nest with another person by granting them access. This is plain access sharing (not a steward role): viewer = read, editor = read+edit, admin = full access except deleting the nest.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        email: { type: "string", description: "Email of the person to share with" },
+        permission: {
+          type: "string",
+          description: "Access level: read (viewer, default), write (editor), or admin"
+        }
+      },
+      required: ["email"]
+    }
   }
 ];
 async function resolveLlmBody(ctx, node) {
@@ -2472,24 +2620,14 @@ ${list}`;
 ${body || "(no content)"}`;
     }
     case "context_list": {
-      let docs = await storage.discoverDocuments();
-      if (args.type)
-        docs = docs.filter((n) => n.frontmatter.type === args.type);
-      if (args.tag) {
-        const tag = args.tag.startsWith("#") ? args.tag : `#${args.tag}`;
-        docs = docs.filter((n) => n.frontmatter.tags?.includes(tag));
-      }
-      if (isStewardshipEnabled(nestId)) {
-        docs = docs.filter(
-          (n) => getApprovedVersion(nestId, n.id) != null
-        );
-      }
-      docs = docs.slice(0, args.limit || 50);
-      if (!docs.length) return "No nodes found with the given filters.";
-      const list = docs.map(
-        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}]`
-      ).join("\n");
-      return `${docs.length} node(s):
+      const nodes = await listNodesForCallerByEmail(nestId, userEmail, {
+        type: args.type,
+        tag: args.tag,
+        limit: args.limit || 50
+      });
+      if (!nodes.length) return "No nodes found with the given filters.";
+      const list = nodes.map((n, i) => `${i + 1}. **${n.title}** [${n.type}]`).join("\n");
+      return `${nodes.length} node(s):
 
 ${list}`;
     }
@@ -2510,50 +2648,21 @@ ${n.body || ""}`;
       return resolved.join("\n\n---\n\n") || "No nodes resolved.";
     }
     case "context_create": {
-      const slug = args.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-      const id = `nodes/${slug}`;
-      const now = (/* @__PURE__ */ new Date()).toISOString();
-      const tags = (args.tags || []).map(
-        (t) => t.startsWith("#") ? t : `#${t}`
-      );
-      const hasStewards = isStewardshipEnabled(nestId);
-      const initialStatus = hasStewards ? "draft" : "approved";
-      const node = {
-        id,
-        filePath: "",
-        frontmatter: {
-          title: args.title,
-          type: args.type || "document",
-          tags,
-          status: initialStatus,
-          version: 1,
-          created_at: now,
-          updated_at: now,
-          metadata: { owners: ["*"], scope: args.scope || "team" }
-        },
-        body: args.content,
-        rawContent: ""
-      };
-      await storage.writeDocument(id, serializeDocument3(node));
-      syncNodeTags(nestId, id, tags);
-      try {
-        await versionManager.createVersion(node, userEmail);
-      } catch (err) {
-        console.error("VersionManager.createVersion failed (mcp create)", err);
+      if (!canCreateInNest(nestId, userEmail)) {
+        return "You don't have permission to create documents in this nest.";
       }
-      createVersion({
+      const { node } = await createNode(
         nestId,
-        nodeId: id,
-        version: 1,
-        content: args.content,
-        author: userEmail,
-        status: initialStatus,
-        tags
-      });
-      if (initialStatus === "approved") {
-        setApprovedVersion(nestId, id, 1, userEmail);
-      }
-      return `Created node: **${args.title}** (${id}) \u2014 status: ${initialStatus}`;
+        {
+          title: args.title,
+          content: args.content,
+          type: args.type,
+          tags: args.tags,
+          scope: args.scope
+        },
+        userEmail
+      );
+      return `Created node: **${args.title}** (${node.id}) \u2014 status: ${node.frontmatter.status}`;
     }
     case "context_update": {
       const docs = await storage.discoverDocuments();
@@ -2561,56 +2670,21 @@ ${n.body || ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      let body = node.body || "";
-      if (args.content !== void 0) body = args.content;
-      if (args.append) body = body + "\n\n" + args.append;
-      let tags = node.frontmatter.tags || [];
-      if (args.tags) {
-        const newTags = args.tags.map(
-          (t) => t.startsWith("#") ? t : `#${t}`
-        );
-        tags = [.../* @__PURE__ */ new Set([...tags, ...newTags])];
-      }
-      const prevVersion = getCurrentVersion(nestId, node.id);
-      const newVersion = prevVersion + 1;
-      const hasStewards = isStewardshipEnabled(nestId);
-      const updated = {
-        ...node,
-        body,
-        frontmatter: {
-          ...node.frontmatter,
-          tags,
-          version: newVersion,
-          updated_at: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      };
-      await storage.writeDocument(node.id, serializeDocument3(updated));
-      try {
-        await versionManager.createVersion(updated, userEmail);
-      } catch (err) {
-        console.error("VersionManager.createVersion failed (mcp update)", err);
+      const editCheck = canUserEdit(nestId, node.id, userEmail);
+      if (!editCheck.allowed) {
+        return `You don't have permission to edit "${args.title}": ${editCheck.reason}`;
       }
-      syncNodeTags(nestId, node.id, tags);
-      createVersion({
+      const { node: updated } = await updateNode(
         nestId,
-        nodeId: node.id,
-        version: newVersion,
-        content: body,
-        author: userEmail,
-        status: hasStewards ? "draft" : "approved",
-        tags
-      });
-      if (getPendingReview(nestId, node.id)) {
-        cancelReview({
-          nestId,
-          nodeId: node.id,
-          cancelledBy: userEmail
-        });
-      }
-      if (!hasStewards) {
-        setApprovedVersion(nestId, node.id, newVersion, userEmail);
-      }
-      return `Updated node: **${node.frontmatter.title}**`;
+        node.id,
+        {
+          content: args.content,
+          append: args.append,
+          tags: args.tags
+        },
+        userEmail
+      );
+      return `Updated node: **${updated.frontmatter.title}**`;
     }
     // ─── Governance Tool Handlers ──────────────────────────────────────
     case "context_stewards": {
@@ -2625,24 +2699,27 @@ ${n.body || ""}`;
           return `No stewards configured for "${args.title}". Changes are auto-approved.`;
         }
         const list = resolved.map(
-          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.canApprove ? " \u2713 can approve" : ""}`
+          (r, i) => `${i + 1}. **${r.steward.userEmail}** \u2014 ${r.steward.role} (${r.source})${r.steward.role === "reviewer" ? " \u2713 can approve" : ""}`
         ).join("\n");
         return `# Stewards for "${args.title}"
 
 ${list}`;
       }
-      const allStewards = getStewardsForNest(ctx.nestId);
+      if (!canManageStewards(ctx.userEmail)) {
+        return "You don't have permission to list stewards. Only the super admin can do this.";
+      }
+      const allStewards = await getStewardsForNest(ctx.nestId);
       if (allStewards.length === 0) {
         return "No stewards configured. All changes are auto-approved.\n\nTo configure stewards, add a `stewards.yaml` file to the vault root, or use `context_assign_steward`.";
       }
       const byScope = {};
       for (const s of allStewards) {
-        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : s.scope === "folder" ? `Folder: ${s.nodePattern}` : `Document: ${s.nodePattern}`;
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodeTitle || s.nodePattern}`;
         (byScope[key] = byScope[key] || []).push(s);
       }
       const sections = Object.entries(byScope).map(
         ([scope, stewards]) => `## ${scope}
-${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.canApprove ? " \u2014 can approve" : ""}`).join("\n")}`
+${stewards.map((s) => `- **${s.userEmail}** (${s.role})${s.role === "reviewer" ? " \u2014 can approve" : ""}`).join("\n")}`
       ).join("\n\n");
       return `# Data Stewards
 
@@ -2650,7 +2727,7 @@ ${sections}`;
     }
     case "context_review_queue": {
       const status = args.status || "pending";
-      const result = getReviewQueue({
+      const result = await getReviewQueue({
         nestId: ctx.nestId,
         status
       });
@@ -2658,7 +2735,7 @@ ${sections}`;
         return status === "pending" ? "No documents pending review. All caught up!" : `No reviews with status "${status}".`;
       }
       const list = result.requests.map(
-        (r, i) => `${i + 1}. **${r.nodeId}** v${r.version} \u2014 ${r.priority} priority
+        (r, i) => `${i + 1}. **${r.title || r.nodeId}** v${r.version} \u2014 ${r.priority} priority
    Submitted by: ${r.requestedBy} at ${r.requestedAt}${r.requestNote ? `
    Note: "${r.requestNote}"` : ""}`
       ).join("\n\n");
@@ -2673,6 +2750,10 @@ ${list}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
+      const submitCheck = canUserEdit(ctx.nestId, node.id, userEmail);
+      if (!submitCheck.allowed) {
+        return `You don't have permission to submit "${args.title}" for review: ${submitCheck.reason}`;
+      }
       const currentVersion = getCurrentVersion(ctx.nestId, node.id);
       if (currentVersion === 0) return `No versions found for "${args.title}"`;
       try {
@@ -2705,7 +2786,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
       if (!node) return `Node not found: ${args.title}`;
       const currentVersion = getCurrentVersion(ctx.nestId, node.id);
       try {
-        const request = approve({
+        const request = await approve({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -2760,22 +2841,20 @@ ${list}`;
     }
     case "context_assign_steward": {
       const scope = args.scope;
-      if (!["nest", "tag", "folder", "document"].includes(scope)) {
-        return `Invalid scope "${args.scope}". Use: nest, tag, folder, or document.`;
+      if (!["nest", "tag", "document"].includes(scope)) {
+        return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
+      }
+      if (!canManageStewards(ctx.userEmail)) {
+        return "You don't have permission to manage stewards. Only the super admin can do this.";
       }
       try {
-        assignSteward({
+        await createStewardRecord({
           nestId: ctx.nestId,
           scope,
-          nodePattern: scope === "folder" || scope === "document" ? args.target : void 0,
+          documentId: scope === "document" ? args.target : void 0,
           tagName: scope === "tag" ? args.target : void 0,
-          userEmail: args.email,
-          role: args.role || "reviewer",
-          canApprove: true,
-          canReject: true,
-          assignedBy: ctx.userEmail,
-          assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          isActive: true
+          users: [{ email: args.email, role: args.role || "reviewer" }],
+          assignedBy: ctx.userEmail
         });
         const targetDesc = scope === "nest" ? "all documents" : `${scope}: ${args.target}`;
         return `Assigned **${args.email}** as ${args.role || "reviewer"} for ${targetDesc}.`;
@@ -2783,6 +2862,25 @@ ${list}`;
         return `Failed to assign steward: ${err.message}`;
       }
     }
+    case "context_share_nest": {
+      const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
+      if (!canManageWith(roles)) {
+        return "You don't have permission to share this nest. Only the nest owner or an admin can add people.";
+      }
+      const permission = args.permission || "read";
+      try {
+        await addCollaborator({
+          nestId: ctx.nestId,
+          email: args.email,
+          permission,
+          grantedByEmail: ctx.userEmail
+        });
+        const label = permission === "admin" ? "admin" : permission === "write" ? "editor" : "viewer";
+        return `Shared this nest with **${args.email}** as ${label}.`;
+      } catch (err) {
+        return `Failed to share nest: ${err.message}`;
+      }
+    }
     default:
       return `Unknown tool: ${toolName}`;
   }
@@ -2851,8 +2949,8 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync, existsSync } from "fs";
+import { join as join2 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -2863,9 +2961,6 @@ function parseStewardsYaml(content) {
     if (!currentSection || currentEntries.length === 0) return;
     if (currentSection === "nest") {
       result.nest = [...result.nest || [], ...currentEntries];
-    } else if (currentSection === "folders" && currentTarget) {
-      result.folders = result.folders || {};
-      result.folders[currentTarget] = currentEntries;
     } else if (currentSection === "tags" && currentTarget) {
       result.tags = result.tags || {};
       result.tags[currentTarget] = currentEntries;
@@ -2885,12 +2980,12 @@ function parseStewardsYaml(content) {
       if (key === "version") continue;
       if (key === "nest" || key === "data_room") {
         currentSection = "nest";
-      } else if (key === "folders") {
-        currentSection = "folders";
       } else if (key === "tags") {
         currentSection = "tags";
       } else if (key === "documents") {
         currentSection = "documents";
+      } else if (key === "folders") {
+        currentSection = null;
       }
       continue;
     }
@@ -2916,25 +3011,19 @@ function parseEntry(str) {
   const entry = { email: emailMatch[1] };
   const roleMatch = str.match(/role:\s*["']?(\w+)["']?/);
   if (roleMatch) entry.role = roleMatch[1];
-  if (str.includes("can_approve:")) {
-    entry.can_approve = str.includes("can_approve: true");
-  }
-  if (str.includes("can_reject:")) {
-    entry.can_reject = str.includes("can_reject: true");
-  }
   return entry;
 }
 function loadStewardsConfig(nestId) {
   const dataRoot = config.DATA_ROOT;
-  const nestPath2 = join3(dataRoot, "nests", nestId);
+  const nestPath = join2(dataRoot, "nests", nestId);
   const candidates = [
-    join3(nestPath2, "stewards.yaml"),
-    join3(nestPath2, "stewards.yml"),
-    join3(nestPath2, ".context", "stewards.yaml")
+    join2(nestPath, "stewards.yaml"),
+    join2(nestPath, "stewards.yml"),
+    join2(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
-    if (existsSync2(candidatePath)) {
-      const content = readFileSync2(candidatePath, "utf-8");
+    if (existsSync(candidatePath)) {
+      const content = readFileSync(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -2947,24 +3036,41 @@ governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
   const search = c.req.query("search");
-  const stewards = listStewards({
+  const stewards = await listStewards({
     nestId,
     scope: scope || void 0,
     search: search || void 0
   });
-  return c.json({ stewards });
+  const cache = /* @__PURE__ */ new Map();
+  const enriched = stewards.map((s) => {
+    const key = s.userEmail.toLowerCase();
+    let merged = cache.get(key);
+    if (!merged) {
+      merged = {
+        collaboratorRole: getCollaboratorRole(nestId, s.userEmail),
+        roles: resolveUserRoles(nestId, s.userEmail)
+      };
+      cache.set(key, merged);
+    }
+    return { ...s, ...merged };
+  });
+  return c.json({ stewards: enriched });
 });
 governanceRoutes.post("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const body = await c.req.json();
   const assignedBy = getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
+  if (body.scope === "folder") {
+    throw new ValidationError(
+      "folder scope is no longer supported \u2014 use 'nest' or 'document'"
+    );
+  }
   if (Array.isArray(body.users)) {
     const created2 = await createStewardRecord({
       nestId,
       scope: body.scope,
       documentId: body.documentId,
-      folderPath: body.folderPath,
       tagName: body.tagName,
       users: body.users,
       assignedBy
@@ -2978,20 +3084,31 @@ governanceRoutes.post("/stewards", async (c) => {
     nestId,
     scope: body.scope,
     documentId: body.scope === "document" ? body.nodePattern : void 0,
-    folderPath: body.scope === "folder" ? body.nodePattern : void 0,
     tagName: body.scope === "tag" ? body.tagName : void 0,
     users: [
       {
         email: body.email,
-        role: body.role,
-        canApprove: body.canApprove,
-        canReject: body.canReject
+        role: body.role
       }
     ],
     assignedBy
   });
   return c.json({ steward: created[0] }, 201);
 });
+governanceRoutes.patch("/stewards/:stewardId", async (c) => {
+  const stewardId = c.req.param("stewardId");
+  const body = await c.req.json();
+  if (!body.role && !body.scope) {
+    throw new ValidationError("role or scope is required");
+  }
+  const steward = updateSteward(stewardId, {
+    role: body.role,
+    scope: body.scope,
+    documentId: body.nodePattern,
+    tagName: body.tagName
+  });
+  return c.json({ steward });
+});
 governanceRoutes.delete("/stewards/:stewardId", async (c) => {
   const stewardId = c.req.param("stewardId");
   removeSteward(stewardId);
@@ -3011,7 +3128,7 @@ governanceRoutes.get("/review-queue", async (c) => {
   const status = c.req.query("status") || "pending";
   const limit = parseInt(c.req.query("limit") || "50", 10);
   const offset = parseInt(c.req.query("offset") || "0", 10);
-  const result = getReviewQueue({
+  const result = await getReviewQueue({
     nestId,
     status,
     limit,
@@ -3019,6 +3136,21 @@ governanceRoutes.get("/review-queue", async (c) => {
   });
   return c.json(result);
 });
+governanceRoutes.get("/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const refresh = c.req.query("refresh") === "true";
+  if (refresh) {
+    await scanNestForDrift(nestId, "user:refresh");
+  }
+  const entries = await listNestExternalEdits(nestId);
+  return c.json({ entries, total: entries.length });
+});
+governanceRoutes.post("/external-edits/scan", async (c) => {
+  const nestId = c.req.param("nestId");
+  const actor = getUserEmail3(c);
+  const result = await scanNestForDrift(nestId, actor);
+  return c.json(result);
+});
 var governanceNodeRoutes = new Hono7();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3031,8 +3163,7 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
       role: r.steward.role,
       scope: r.steward.scope,
       source: r.source,
-      priority: r.priority,
-      canApprove: r.steward.canApprove
+      priority: r.priority
     })),
     fallbackToOwner,
     ownerEmail
@@ -3101,7 +3232,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const userEmail = getUserEmail3(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
-    const request = approve({
+    const request = await approve({
       nestId,
       nodeId,
       version: getCurrentVersion(nestId, nodeId),
@@ -3153,6 +3284,90 @@ governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const userEmail = getUserEmail3(c);
   return c.json(canUserEdit(nestId, nodeId, userEmail));
 });
+governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const pending = await getPendingChange(nestId, nodeId);
+  return c.json({ pending });
+});
+governanceNodeRoutes.get(
+  "/:nodeId{.+?}/external-edits/:suggestionId",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const detail = await getExternalEditDetail(
+      nestId,
+      nodeId,
+      suggestionId
+    );
+    if (!detail) {
+      return c.json({ error: "Suggestion not found" }, 404);
+    }
+    return c.json({ entry: detail });
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/approve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    const actor = getUserEmail3(c);
+    try {
+      const result = await approveExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        comment: body.comment
+      });
+      return c.json({
+        approved: true,
+        version: result.versionEntry.version,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      console.error(
+        `[external-edit-route] approve failed nest=${nestId} node=${nodeId} suggestion=${suggestionId}`,
+        { message: err?.message, name: err?.name, stack: err?.stack }
+      );
+      return c.json(
+        { error: err.message, name: err?.name },
+        400
+      );
+    }
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/external-edits/:suggestionId/reject",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.reason) {
+      throw new ValidationError("Rejection reason is required");
+    }
+    const actor = getUserEmail3(c);
+    try {
+      const result = await rejectExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        reason: body.reason
+      });
+      return c.json({
+        rejected: true,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  }
+);
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3173,31 +3388,29 @@ function getUserEmail3(c) {
 
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
-var ANON_USER_ID3 = "00000000-0000-0000-0000-000000000000";
-var ANON_EMAIL = "admin@localhost";
 function ensureAnonymousUser() {
   const db = getDb();
-  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID3);
+  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID);
   if (!exists) {
     const placeholder = bcrypt.hashSync("anon-no-login", 4);
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(ANON_USER_ID3, ANON_EMAIL, "Admin", placeholder);
+    ).run(ANON_USER_ID, ANON_EMAIL, "Admin", placeholder);
   }
-  return ANON_USER_ID3;
+  return ANON_USER_ID;
 }
 
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join4, relative } from "path";
-import { existsSync as existsSync3 } from "fs";
+import { dirname, join as join3, relative } from "path";
+import { existsSync as existsSync2 } from "fs";
 var HERE = dirname(fileURLToPath(import.meta.url));
 var UI_DIR_CANDIDATES = [
-  join4(HERE, "web3"),
-  join4(process.cwd(), "dist", "web3")
+  join3(HERE, "web3"),
+  join3(process.cwd(), "dist", "web3")
 ];
-var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync3(p)) || UI_DIR_CANDIDATES[0];
+var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
@@ -3205,6 +3418,11 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
   c.set("nestScope", null);
   await next();
 });
+function isPublicReadEligiblePath(method, path) {
+  if (method !== "GET") return false;
+  if (!/^\/nests\/[^/]+(\/.*)?$/.test(path)) return false;
+  return !/\/(collaborators|visibility|settings|mcp)/.test(path);
+}
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
   const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
@@ -3217,6 +3435,12 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     c.set("nestScope", null);
     return next();
   }
+  if (isPublicReadEligiblePath(c.req.method, c.req.path)) {
+    const anonId = ensureAnonymousUser();
+    c.set("userId", anonId);
+    c.set("nestScope", null);
+    return next();
+  }
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
@@ -3248,6 +3472,7 @@ function createApp() {
       service: "contextnest-community",
       version: "0.1.0",
       auth_mode: config.AUTH_MODE,
+      logo_url: config.LOGO_URL,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
@@ -3308,7 +3533,7 @@ function createApp() {
         return c.json(
           {
             valid: false,
-            error: "License key was saved but PromptOwl rejected it. Verify the key is correct and active."
+            error: "PromptOwl rejected this license key. It wasn't saved. Verify the key is correct and active, then try again."
           },
           400
         );
@@ -3324,6 +3549,28 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
+  app.use("/stats", flexAuthMiddleware);
+  app.get("/stats", async (c) => {
+    const db = getDb();
+    const userId = c.get("userId");
+    const userEmail = resolveCallerEmail(userId);
+    const visibleNests = [...listNests(userId), ...listSharedNests(userId)];
+    let documents = 0;
+    for (const nest of visibleNests) {
+      try {
+        const { storage } = engineCache.get(nest.id);
+        const docs = await storage.discoverDocuments();
+        documents += filterAccessible(nest.id, userId, userEmail, docs).length;
+      } catch {
+      }
+    }
+    const usersRow = db.prepare("SELECT COUNT(*) as c FROM users").get();
+    return c.json({
+      nests: visibleNests.length,
+      documents,
+      users: usersRow.c
+    });
+  });
   const nestsApp = new Hono8();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
@@ -3375,12 +3622,42 @@ function createApp() {
     let required = "read";
     const path = c.req.path;
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
+    const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
+    if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
+      return c.json(
+        {
+          error: "You don't have permission to manage stewards. Only the super admin can do this."
+        },
+        403
+      );
+    }
     if (path.includes("/collaborators") || path.includes("/visibility")) {
       required = "admin";
     } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
-    if (permissionLevel(permission) < permissionLevel(required)) {
+    let stewardEditorBypass = false;
+    if (required === "write" && permission === "read" && parts[1] === "nodes") {
+      const userEmail = resolveCallerEmail(userId);
+      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE")) {
+        const rawNodeId = parts.slice(2).join("/");
+        let nodeId = rawNodeId;
+        try {
+          nodeId = decodeURIComponent(rawNodeId);
+        } catch {
+        }
+        const resolved = resolveStewardsForNode(nestId, nodeId);
+        stewardEditorBypass = resolved.some(
+          (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor"
+        );
+      } else if (parts.length === 2 && c.req.method === "POST") {
+        const resolved = resolveStewardsForNode(nestId, "");
+        stewardEditorBypass = resolved.some(
+          (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && r.steward.scope === "nest"
+        );
+      }
+    }
+    if (!stewardEditorBypass && permissionLevel(permission) < permissionLevel(required)) {
       return c.json(
         {
           error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
@@ -3479,9 +3756,108 @@ function createApp() {
   return app;
 }
 
+// src/db/backfill.ts
+import { NestStorage } from "@promptowl/contextnest-engine";
+import { join as join4 } from "path";
+var MIGRATION_ID = "005_backfill_node_versions_from_history";
+async function backfillNodeVersionsFromHistory(db) {
+  const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
+  if (already) return;
+  const nests = db.prepare("SELECT id FROM nests").all();
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO node_versions
+       (nest_id, node_id, version, content_hash, author, status, change_note, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  const approvedPin = db.prepare(
+    `INSERT OR REPLACE INTO approved_versions
+       (nest_id, node_id, approved_version, approved_by, approved_at)
+     VALUES (?, ?, ?, ?, COALESCE(
+       (SELECT approved_at FROM approved_versions WHERE nest_id = ? AND node_id = ?),
+       datetime('now')))`
+  );
+  let totalInserted = 0;
+  let totalDocs = 0;
+  for (const { id: nestId } of nests) {
+    const nestPath = join4(config.DATA_ROOT, "nests", nestId);
+    const storage = new NestStorage(nestPath);
+    let docs;
+    try {
+      docs = await storage.discoverDocuments();
+    } catch (err) {
+      console.warn(
+        `[backfill] discoverDocuments failed for nest ${nestId}:`,
+        err.message
+      );
+      continue;
+    }
+    for (const doc of docs) {
+      totalDocs += 1;
+      let history;
+      try {
+        history = await storage.readHistory(doc.id);
+      } catch {
+        history = null;
+      }
+      if (!history || history.versions.length === 0) continue;
+      const existing = db.prepare(
+        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`
+      ).all(nestId, doc.id);
+      const known = new Set(existing.map((r) => r.version));
+      const tagsJson = doc.frontmatter.tags ? JSON.stringify(doc.frontmatter.tags) : null;
+      const latestVersion = history.versions[history.versions.length - 1].version;
+      for (const entry of history.versions) {
+        if (known.has(entry.version)) continue;
+        insert.run(
+          nestId,
+          doc.id,
+          entry.version,
+          entry.content_hash || "",
+          entry.edited_by || "system:backfill",
+          "approved",
+          entry.note || null,
+          entry.edited_at || (/* @__PURE__ */ new Date()).toISOString()
+        );
+        totalInserted += 1;
+      }
+      const pin = db.prepare(
+        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`
+      ).get(nestId, doc.id);
+      if (!pin || pin.approved_version < latestVersion) {
+        approvedPin.run(
+          nestId,
+          doc.id,
+          latestVersion,
+          history.versions[history.versions.length - 1].edited_by || "system:backfill",
+          nestId,
+          doc.id
+        );
+      }
+      if (tagsJson) {
+        const updateTags = db.prepare(
+          `UPDATE node_versions SET tags_json = ?
+           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`
+        );
+        updateTags.run(tagsJson, nestId, doc.id, latestVersion);
+      }
+    }
+  }
+  db.prepare("INSERT OR IGNORE INTO schema_migrations (id) VALUES (?)").run(
+    MIGRATION_ID
+  );
+  console.log(
+    `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
+  );
+}
+
 // src/index.ts
 async function main() {
-  getDb();
+  const db = getDb();
+  try {
+    await backfillNodeVersionsFromHistory(db);
+  } catch (err) {
+    console.error("[backfill] node_versions backfill failed:", err);
+  }
   const accessCfg = loadAccessConfig();
   if (accessCfg) {
     console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);
@@ -3502,7 +3878,11 @@ async function main() {
 `);
   }
   const app = createApp();
-  startLicenseWatcher();
+  startLicenseSafetyPoll();
+  const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
+  if (driftScanIntervalMs > 0) {
+    startDriftScanner(driftScanIntervalMs);
+  }
   startTelemetryLoop();
   trackEvent("server.start", {
     tier: license.tier,