@promptowl/contextnest-community 1.0.1 → 1.2.0

package/dist/chunk-5MT4ZBVF.js

@@ -0,0 +1,1413 @@
+import {
+  ANON_USER_ID,
+  config,
+  getDb
+} from "./chunk-G62P54ET.js";
+
+// src/governance/stewardship-service.ts
+import { v4 as uuid2 } from "uuid";
+
+// src/governance/access-service.ts
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+var accessConfig = null;
+function loadAccessConfig() {
+  const candidates = [
+    join(config.DATA_ROOT, "access.yaml"),
+    join(config.DATA_ROOT, "access.yml")
+  ];
+  for (const path of candidates) {
+    if (existsSync(path)) {
+      const content = readFileSync(path, "utf-8");
+      accessConfig = parseAccessYaml(content);
+      return accessConfig;
+    }
+  }
+  accessConfig = null;
+  return null;
+}
+function getAccessConfig() {
+  return accessConfig;
+}
+function isSuperAdmin(email) {
+  if (!accessConfig?.super_admins) return false;
+  return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
+}
+function parseAccessYaml(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let currentSection = null;
+  let currentGroup = null;
+  let inMembers = false;
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    if (!line || line.startsWith("#")) continue;
+    if (!line.startsWith(" ") && !line.startsWith("	")) {
+      const match = line.match(/^(\w+):\s*(.*)?$/);
+      if (!match) continue;
+      const key = match[1];
+      const value = match[2]?.trim();
+      if (key === "mode") {
+        result.mode = value;
+        currentSection = null;
+      } else if (key === "allowed_users") {
+        currentSection = "allowed_users";
+        result.allowed_users = [];
+      } else if (key === "groups") {
+        currentSection = "groups";
+        result.groups = {};
+      } else if (key === "super_admins") {
+        currentSection = "super_admins";
+        result.super_admins = [];
+      }
+      currentGroup = null;
+      inMembers = false;
+      continue;
+    }
+    const listMatch = line.match(/^\s+-\s+["']?([^"'\n]+?)["']?\s*$/);
+    if (currentSection === "allowed_users" && listMatch) {
+      result.allowed_users.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "super_admins" && listMatch) {
+      result.super_admins.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "groups") {
+      const groupMatch = line.match(/^  (\w+):$/);
+      if (groupMatch) {
+        currentGroup = groupMatch[1];
+        result.groups[currentGroup] = { members: [], default_permission: "read" };
+        inMembers = false;
+        continue;
+      }
+      if (currentGroup) {
+        const propMatch = line.match(/^\s{4}(\w+):\s*(.*)?$/);
+        if (propMatch) {
+          const prop = propMatch[1];
+          const val = propMatch[2]?.trim();
+          if (prop === "default_permission" && val) {
+            result.groups[currentGroup].default_permission = val;
+          }
+          if (prop === "members") {
+            inMembers = true;
+          }
+          continue;
+        }
+        if (inMembers && listMatch) {
+          result.groups[currentGroup].members.push(listMatch[1].trim());
+        }
+      }
+    }
+  }
+  return result;
+}
+
+// src/shared/errors.ts
+var AppError = class extends Error {
+  constructor(statusCode, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "AppError";
+  }
+  statusCode;
+};
+var NotFoundError = class extends AppError {
+  constructor(message = "Not found") {
+    super(404, message);
+    this.name = "NotFoundError";
+  }
+};
+var ForbiddenError = class extends AppError {
+  constructor(message = "Forbidden") {
+    super(403, message);
+    this.name = "ForbiddenError";
+  }
+};
+var ValidationError = class extends AppError {
+  constructor(message) {
+    super(400, message);
+    this.name = "ValidationError";
+  }
+};
+var ConflictError = class extends AppError {
+  constructor(message) {
+    super(409, message);
+    this.name = "ConflictError";
+  }
+};
+var LockedError = class extends AppError {
+  constructor(message = "Locked") {
+    super(423, message);
+    this.name = "LockedError";
+  }
+};
+
+// src/nodes/engine.ts
+import {
+  NestStorage as NestStorage3,
+  GraphQueryEngine,
+  VersionManager
+} from "@promptowl/contextnest-engine";
+
+// src/nests/service.ts
+import { join as join3 } from "path";
+import { rmSync as rmSync2, mkdirSync as mkdirSync2 } from "fs";
+import { v4 as uuid } from "uuid";
+import { NestStorage } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+import { mkdirSync, writeFileSync, rmSync } from "fs";
+import { join as join2, dirname, isAbsolute } from "path";
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules";
+}
+function safeSegments(rel) {
+  if (!rel || isAbsolute(rel)) return null;
+  const segs = rel.split(/[\\/]/).filter(Boolean);
+  if (!segs.length) return null;
+  for (const s of segs) {
+    if (s === "..") return null;
+    if (s !== ".versions" && isSkippedSegment(s)) return null;
+  }
+  return segs;
+}
+function writeImportedFiles(dest, files) {
+  let written = 0;
+  for (const f of files) {
+    const segs = safeSegments(f?.path || "");
+    if (!segs) continue;
+    const full = join2(dest, ...segs);
+    mkdirSync(dirname(full), { recursive: true });
+    writeFileSync(full, f.content ?? "", "utf-8");
+    written++;
+  }
+  return written;
+}
+function discardImportDir(dest) {
+  try {
+    rmSync(dest, { recursive: true, force: true });
+  } catch {
+  }
+}
+
+// src/telemetry/tracker.ts
+function trackEvent(event, data) {
+  if (!config.TELEMETRY_ENABLED) return;
+  try {
+    const db = getDb();
+    db.prepare(
+      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)"
+    ).run(event, data ? JSON.stringify(data) : null);
+  } catch {
+  }
+}
+async function flushTelemetry() {
+  if (!config.TELEMETRY_ENABLED || !config.PROMPTOWL_KEY) return;
+  const db = getDb();
+  const userCount = db.prepare("SELECT COUNT(*) as c FROM users").get()?.c || 0;
+  const nestCount = db.prepare("SELECT COUNT(*) as c FROM nests").get()?.c || 0;
+  const events = db.prepare(
+    "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
+  ).all();
+  if (events.length === 0 && userCount === 0) return;
+  const payload = {
+    server_key: config.PROMPTOWL_KEY,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    stats: { users: userCount, nests: nestCount },
+    events: events.map((e) => ({
+      event: e.event,
+      data: e.data_json ? JSON.parse(e.data_json) : null,
+      at: e.created_at
+    }))
+  };
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (res.ok && events.length > 0) {
+      const ids = events.map((e) => e.id);
+      db.prepare(
+        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
+      ).run(...ids);
+    }
+  } catch {
+  }
+}
+var telemetryTimer = null;
+function startTelemetryLoop() {
+  if (!config.TELEMETRY_ENABLED) return;
+  setTimeout(() => flushTelemetry(), 3e4);
+  telemetryTimer = setInterval(
+    () => flushTelemetry(),
+    config.TELEMETRY_INTERVAL_MS
+  );
+}
+
+// src/auth/license.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+var currentLicense = null;
+function getCurrentLicense() {
+  return currentLicense;
+}
+function isLicenseAdminEmail(email) {
+  if (!email) return false;
+  const lic = currentLicense;
+  if (!lic?.valid || !lic.ownerEmail) return false;
+  return lic.ownerEmail.toLowerCase() === email.toLowerCase();
+}
+function isLicenseAdminUserId(userId) {
+  try {
+    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
+    return isLicenseAdminEmail(row?.email);
+  } catch {
+    return false;
+  }
+}
+function upsertEnvVar(filePath, varName, value) {
+  const prefix = `${varName}=`;
+  let lines = [];
+  if (existsSync2(filePath)) {
+    lines = readFileSync2(filePath, "utf8").split(/\r?\n/);
+  }
+  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
+  if (value !== null) {
+    filtered.push(`${prefix}${value}`);
+  }
+  while (filtered.length && filtered[filtered.length - 1] === "") {
+    filtered.pop();
+  }
+  writeFileSync2(filePath, filtered.join("\n") + "\n", "utf8");
+}
+async function installLicenseKey(key) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith("pk_")) {
+    throw new Error("Invalid license key format. Must start with pk_.");
+  }
+  const previousKey = process.env.PROMPTOWL_KEY || "";
+  process.env.PROMPTOWL_KEY = trimmed;
+  const info = await validateLicense({ forceFresh: true });
+  if (!info.valid) {
+    process.env.PROMPTOWL_KEY = previousKey;
+    if (previousKey) {
+      await validateLicense({ forceFresh: true });
+    }
+    return info;
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+  } catch (err) {
+    console.warn("[license] failed to write .env:", err);
+  }
+  return info;
+}
+var safetyPollHandle = null;
+var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
+function startLicenseSafetyPoll() {
+  if (safetyPollHandle) return;
+  safetyPollHandle = setInterval(async () => {
+    if (!config.PROMPTOWL_KEY) return;
+    try {
+      const wasValid = !!currentLicense?.valid;
+      await validateLicense({ forceFresh: true });
+      const isValid = !!currentLicense?.valid;
+      if (wasValid && !isValid) {
+        console.log("[license] safety poll detected revocation");
+        handleLicenseRevoked();
+      }
+    } catch (err) {
+      console.warn(
+        `[license] safety poll error: ${err.message}`
+      );
+    }
+  }, SAFETY_POLL_INTERVAL_MS);
+  if (typeof safetyPollHandle.unref === "function") {
+    safetyPollHandle.unref();
+  }
+}
+function handleLicenseRevoked() {
+  try {
+    const db = getDb();
+    const result = db.prepare("DELETE FROM sessions").run();
+    console.warn(
+      `[license] revoked \u2014 wiped ${result.changes} active session(s).`
+    );
+  } catch (err) {
+    console.warn("[license] failed to wipe sessions:", err);
+  }
+  try {
+    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
+    console.warn(
+      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
+    );
+  } catch (err) {
+    console.warn("[license] failed to strip key from .env:", err);
+  }
+  process.env.PROMPTOWL_KEY = "";
+  currentLicense = {
+    valid: false,
+    tier: "none",
+    org: null,
+    limits: null,
+    suspended: false,
+    suspendedReason: null,
+    ownerEmail: null
+  };
+}
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var suspensionFirstSeen = null;
+var suspensionConfirmed = false;
+var suspensionReason = null;
+var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
+function isSuspended() {
+  return suspensionConfirmed;
+}
+function getSuspensionReason() {
+  return suspensionReason;
+}
+async function validateLicense(opts = {}) {
+  const info = await _validateLicenseImpl(!!opts.forceFresh);
+  currentLicense = info;
+  return info;
+}
+async function _validateLicenseImpl(forceFresh) {
+  const key = config.PROMPTOWL_KEY;
+  if (!key) {
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+  const db = getDb();
+  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
+  if (cached && !forceFresh) {
+    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
+    if (age < CACHE_TTL_MS) {
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+  }
+  try {
+    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ key })
+    });
+    if (!res.ok) {
+      if (cached) {
+        console.warn(
+          "  PromptOwl unreachable, using cached license (grace period)"
+        );
+        return {
+          valid: true,
+          tier: cached.tier,
+          org: cached.org,
+          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+          suspended: suspensionConfirmed,
+          suspendedReason: suspensionReason,
+          ownerEmail: cached.owner_email || null
+        };
+      }
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: null
+      };
+    }
+    const data = await res.json();
+    if (data.suspended === true) {
+      if (!suspensionFirstSeen) {
+        suspensionFirstSeen = Date.now();
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.warn(
+          `
+  WARNING: PromptOwl has flagged this server for suspension.`
+        );
+        console.warn(
+          `  Reason: ${suspensionReason}`
+        );
+        console.warn(
+          `  This will be confirmed in ~1 hour. If this is an error,`
+        );
+        console.warn(
+          `  contact support@promptowl.ai to reverse it.
+`
+        );
+      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
+        suspensionConfirmed = true;
+        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
+        console.error(
+          `
+  SERVER SUSPENDED: ${suspensionReason}`
+        );
+        console.error(
+          `  Write operations are disabled. Reads still work.`
+        );
+        console.error(
+          `  Contact support@promptowl.ai to resolve.
+`
+        );
+      }
+    } else {
+      if (suspensionFirstSeen) {
+        console.log("  Suspension flag cleared by PromptOwl.");
+      }
+      suspensionFirstSeen = null;
+      suspensionConfirmed = false;
+      suspensionReason = null;
+    }
+    if (!data.valid && !data.suspended) {
+      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
+      return {
+        valid: false,
+        tier: "none",
+        org: null,
+        limits: null,
+        suspended: false,
+        suspendedReason: null,
+        ownerEmail: data.owner_email || null
+      };
+    }
+    if (data.valid) {
+      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
+      db.prepare(
+        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
+         VALUES (?, ?, ?, ?, ?, datetime('now'))`
+      ).run(
+        key,
+        data.tier || "community",
+        data.org || null,
+        limitsJson,
+        data.owner_email || null
+      );
+    }
+    return {
+      valid: data.valid !== false,
+      tier: data.tier || "community",
+      org: data.org || null,
+      limits: data.limits || null,
+      suspended: suspensionConfirmed,
+      suspendedReason: suspensionReason,
+      ownerEmail: data.owner_email || null
+    };
+  } catch (err) {
+    if (cached) {
+      console.warn(
+        `  PromptOwl validation failed (${err.message}), using cached license`
+      );
+      return {
+        valid: true,
+        tier: cached.tier,
+        org: cached.org,
+        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
+        suspended: suspensionConfirmed,
+        suspendedReason: suspensionReason,
+        ownerEmail: cached.owner_email || null
+      };
+    }
+    return {
+      valid: false,
+      tier: "none",
+      org: null,
+      limits: null,
+      suspended: false,
+      suspendedReason: null,
+      ownerEmail: null
+    };
+  }
+}
+
+// src/nests/service.ts
+function resolveNestPath(nestId) {
+  return join3(config.DATA_ROOT, "nests", nestId);
+}
+function isImportedNest(nestId) {
+  const row = getDb().prepare("SELECT is_imported FROM nests WHERE id = ?").get(nestId);
+  return !!row?.is_imported;
+}
+function toSlug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function isStewardshipEnabled(nestId) {
+  const db = getDb();
+  const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
+  return !!row?.stewardship_enabled;
+}
+function setStewardshipEnabled(nestId, enabled) {
+  const db = getDb();
+  db.prepare("UPDATE nests SET stewardship_enabled = ? WHERE id = ?").run(
+    enabled ? 1 : 0,
+    nestId
+  );
+}
+function nestAllowsSelfApprove(nestId) {
+  const db = getDb();
+  const row = db.prepare("SELECT allow_self_approve FROM nests WHERE id = ?").get(nestId);
+  return !!row?.allow_self_approve;
+}
+function setAllowSelfApprove(nestId, allow) {
+  const db = getDb();
+  db.prepare("UPDATE nests SET allow_self_approve = ? WHERE id = ?").run(
+    allow ? 1 : 0,
+    nestId
+  );
+}
+function disableStewardshipAndWipeGovernance(nestId) {
+  const db = getDb();
+  const wipe = db.transaction((id) => {
+    const stewards = db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id).changes;
+    const pendingReviews = db.prepare(
+      "DELETE FROM review_requests WHERE nest_id = ? AND status = 'pending'"
+    ).run(id).changes;
+    db.prepare("UPDATE nests SET stewardship_enabled = 0 WHERE id = ?").run(id);
+    return { stewards, pendingReviews };
+  });
+  return wipe(nestId);
+}
+async function createNest(userId, name, description) {
+  const id = uuid();
+  const slug = toSlug(name);
+  const db = getDb();
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
+  db.prepare(
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)"
+  ).run(id, userId, name, slug, description || null, visibility);
+  const path = resolveNestPath(id);
+  mkdirSync2(path, { recursive: true });
+  const storage = new NestStorage(path);
+  await storage.init(name);
+  trackEvent("nest.create", { nestId: id, userId });
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+}
+async function importNest(userId, name, files) {
+  const nm = (name || "").trim();
+  if (!nm) {
+    throw new ValidationError("name is required");
+  }
+  if (!Array.isArray(files)) {
+    throw new ValidationError("files are required");
+  }
+  const db = getDb();
+  const id = uuid();
+  const slug = toSlug(nm);
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
+  const dest = resolveNestPath(id);
+  mkdirSync2(dest, { recursive: true });
+  try {
+    writeImportedFiles(dest, files);
+  } catch (err) {
+    console.error("[nests] import write failed", dest, err);
+    discardImportDir(dest);
+    throw new ValidationError("Failed to import folder");
+  }
+  db.prepare(
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)"
+  ).run(id, userId, nm, slug, null, visibility);
+  trackEvent("nest.import", { nestId: id, userId });
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+}
+function listNests(userId) {
+  const db = getDb();
+  if (userId === ANON_USER_ID) {
+    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
+  }
+  const includeAnon = config.AUTH_MODE === "open" || isLicenseAdminUserId(userId);
+  if (!includeAnon) {
+    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(userId);
+  }
+  return db.prepare(
+    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
+  ).all(userId, ANON_USER_ID);
+}
+function listSharedNests(userId) {
+  const db = getDb();
+  return db.prepare(
+    `SELECT DISTINCT n.* FROM nests n
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN stewards s
+         ON s.nest_id = n.id AND s.is_active = 1
+        AND LOWER(s.user_email) = LOWER(u.email)
+       WHERE n.user_id != ?
+         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
+       ORDER BY n.created_at DESC`
+  ).all(userId, userId, userId);
+}
+function listPublicNests(userId) {
+  const db = getDb();
+  return db.prepare(
+    `SELECT n.* FROM nests n
+       WHERE n.visibility = 'public'
+         AND n.user_id != ?
+         AND NOT EXISTS (
+           SELECT 1 FROM nest_collaborators nc
+           WHERE nc.nest_id = n.id AND nc.user_id = ?
+         )
+       ORDER BY n.created_at DESC`
+  ).all(userId, userId);
+}
+function getNest(nestId) {
+  const db = getDb();
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId) || null;
+}
+async function deleteNest(nestId) {
+  const db = getDb();
+  const wipe = db.transaction((id) => {
+    db.prepare("DELETE FROM approved_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM node_versions WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM review_requests WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nest_collaborators WHERE nest_id = ?").run(id);
+    try {
+      db.prepare("DELETE FROM node_tag_index WHERE nest_id = ?").run(id);
+    } catch {
+    }
+    db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(id);
+    db.prepare("DELETE FROM nests WHERE id = ?").run(id);
+  });
+  wipe(nestId);
+  const path = resolveNestPath(nestId);
+  try {
+    rmSync2(path, { recursive: true, force: true });
+  } catch (err) {
+    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
+  }
+  trackEvent("nest.delete", { nestId });
+}
+
+// src/nodes/flat-storage.ts
+import { readdirSync } from "fs";
+import { join as join4, relative, sep } from "path";
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+var META_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "QWEN.md"
+]);
+var FlatNestStorage = class extends NestStorage2 {
+  async discoverDocuments() {
+    const root = this.root;
+    let entries;
+    try {
+      entries = readdirSync(root, { recursive: true, withFileTypes: true });
+    } catch (err) {
+      console.error("[FlatNestStorage] cannot read folder", root, err);
+      return [];
+    }
+    const ids = [];
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith(".md")) continue;
+      if (META_FILES.has(e.name)) continue;
+      const dir = e.parentPath ?? e.path ?? root;
+      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
+      if (rel.split("/").some(isSkippedSegment)) {
+        continue;
+      }
+      ids.push(rel.replace(/\.md$/, ""));
+    }
+    const nodes = [];
+    for (const id of ids.sort()) {
+      try {
+        nodes.push(await this.readDocument(id));
+      } catch (err) {
+        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+      }
+    }
+    return nodes;
+  }
+};
+
+// src/nodes/engine.ts
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = resolveNestPath(nestId);
+      const storage = isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = { storage, query, versions };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+
+// src/governance/title-resolver.ts
+async function buildTitleMap(nestId) {
+  try {
+    const { storage } = engineCache.get(nestId);
+    const docs = await storage.discoverDocuments();
+    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+
+// src/shared/access.ts
+var PERMISSION_LEVELS = {
+  none: 0,
+  read: 1,
+  write: 2,
+  admin: 3,
+  owner: 4
+};
+function resolveNestPermission(nestId, userId) {
+  const db = getDb();
+  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
+  if (!nest) return "none";
+  if (nest.user_id === userId) return "owner";
+  if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
+    return "owner";
+  }
+  const directGrant = db.prepare(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+  ).get(nestId, userId);
+  if (directGrant) return directGrant.permission;
+  const stewardGrant = db.prepare(
+    `SELECT 1 FROM stewards s
+         JOIN users u ON u.id = ?
+        WHERE s.nest_id = ? AND s.is_active = 1
+          AND LOWER(s.user_email) = LOWER(u.email)
+        LIMIT 1`
+  ).get(userId, nestId);
+  if (stewardGrant) return "read";
+  if (nest.visibility === "public") return "read";
+  return "none";
+}
+function permissionLevel(p) {
+  return PERMISSION_LEVELS[p] ?? 0;
+}
+function isPublicReader(nestId, userId) {
+  const db = getDb();
+  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
+  if (!nest) return false;
+  if (nest.visibility !== "public") return false;
+  if (nest.user_id === userId) return false;
+  const directGrant = db.prepare(
+    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+  ).get(nestId, userId);
+  if (directGrant) return false;
+  const stewardGrant = db.prepare(
+    `SELECT 1 FROM stewards s
+         JOIN users u ON u.id = ?
+        WHERE s.nest_id = ? AND s.is_active = 1
+          AND LOWER(s.user_email) = LOWER(u.email)
+        LIMIT 1`
+  ).get(userId, nestId);
+  if (stewardGrant) return false;
+  return true;
+}
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var canManageWith = (roles) => includesAny(roles, ["owner", "admin"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+
+// src/governance/stewardship-service.ts
+function assignSteward(data) {
+  const db = getDb();
+  const id = uuid2();
+  db.prepare(
+    `INSERT INTO stewards
+     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    data.nestId,
+    data.scope,
+    data.nodePattern || null,
+    data.tagName || null,
+    data.userEmail,
+    data.userId || null,
+    data.role,
+    data.assignedBy,
+    data.isActive ? 1 : 0
+  );
+  return { ...data, id };
+}
+function removeSteward(id) {
+  const db = getDb();
+  db.prepare("DELETE FROM stewards WHERE id = ?").run(id);
+}
+var VALID_STEWARD_ROLES = ["editor", "reviewer", "viewer"];
+function updateSteward(id, update) {
+  const db = getDb();
+  const current = db.prepare("SELECT * FROM stewards WHERE id = ? AND is_active = 1").get(id);
+  if (!current) {
+    throw new ValidationError("Steward not found");
+  }
+  const role = update.role ?? current.role;
+  if (!VALID_STEWARD_ROLES.includes(role)) {
+    throw new ValidationError(
+      `Invalid role "${role}" \u2014 must be editor, reviewer, or viewer.`
+    );
+  }
+  let scope = current.scope;
+  let nodePattern = current.node_pattern ?? null;
+  let tagName = current.tag_name ?? null;
+  if (update.scope) {
+    scope = update.scope;
+    nodePattern = null;
+    tagName = null;
+    switch (scope) {
+      case "document":
+        if (!update.documentId)
+          throw new ValidationError("documentId required for document scope");
+        nodePattern = update.documentId;
+        break;
+      case "tag":
+        if (!update.tagName)
+          throw new ValidationError("tagName required for tag scope");
+        tagName = update.tagName.trim().replace(/^#+/, "").toLowerCase();
+        break;
+      case "nest":
+        break;
+    }
+    const dup = db.prepare(
+      `SELECT role FROM stewards
+         WHERE nest_id = ? AND is_active = 1 AND id != ? AND scope = ?
+           AND user_email = ?
+           AND COALESCE(node_pattern, '') = COALESCE(?, '')
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`
+    ).get(current.nest_id, id, scope, current.user_email, nodePattern, tagName);
+    if (dup) {
+      const scopeLabel = scope === "document" ? `document "${nodePattern}"` : scope === "tag" ? `tag "#${tagName}"` : "this nest";
+      throw new ConflictError(
+        `"${current.user_email}" is already a steward of ${scopeLabel} with the "${dup.role}" role.`
+      );
+    }
+  }
+  db.prepare(
+    "UPDATE stewards SET role = ?, scope = ?, node_pattern = ?, tag_name = ? WHERE id = ?"
+  ).run(role, scope, nodePattern, tagName, id);
+  const row = db.prepare("SELECT * FROM stewards WHERE id = ?").get(id);
+  return rowToSteward(row);
+}
+function updateStewardRole(id, role) {
+  return updateSteward(id, { role });
+}
+function getSteward(id) {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM stewards WHERE id = ?").get(id);
+  return row ? rowToSteward(row) : null;
+}
+async function getStewardsForNest(nestId) {
+  const db = getDb();
+  const rows = db.prepare("SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1").all(nestId);
+  return enrichWithTitles(nestId, rows.map(rowToSteward));
+}
+function getStewardsForScope(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.scopeTarget) {
+    sql += " AND (node_pattern = ? OR tag_name = ?)";
+    args.push(params.scopeTarget, params.scopeTarget);
+  }
+  return db.prepare(sql).all(...args).map(rowToSteward);
+}
+async function listStewards(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.search) {
+    sql += " AND (user_email LIKE ? OR tag_name LIKE ? OR node_pattern LIKE ?)";
+    const like = `%${params.search.toLowerCase()}%`;
+    args.push(like, like, like);
+  }
+  sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
+  const stewards = db.prepare(sql).all(...args).map(rowToSteward);
+  return enrichWithTitles(params.nestId, stewards);
+}
+async function enrichWithTitles(nestId, stewards) {
+  if (!stewards.some((s) => s.scope === "document")) return stewards;
+  const titleByNodeId = await buildTitleMap(nestId);
+  for (const s of stewards) {
+    if (s.scope === "document" && s.nodePattern) {
+      s.nodeTitle = titleByNodeId.get(s.nodePattern);
+    }
+  }
+  return stewards;
+}
+async function createStewardRecord(params) {
+  if (params.users.length === 0) {
+    throw new Error("At least one user is required");
+  }
+  let nodePattern;
+  let tagName;
+  switch (params.scope) {
+    case "document":
+      if (!params.documentId) throw new Error("documentId required for document scope");
+      nodePattern = params.documentId;
+      break;
+    case "tag":
+      if (!params.tagName) throw new Error("tagName required for tag scope");
+      tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
+      break;
+    case "nest":
+      break;
+  }
+  const db = getDb();
+  const results = [];
+  const actor = (params.assignedBy || "").trim().toLowerCase();
+  const ownerEmail = (getNestOwnerEmail(params.nestId) || "").toLowerCase();
+  for (const user of params.users) {
+    const email = user.email.trim().toLowerCase();
+    if (!email) continue;
+    if (email === actor) {
+      throw new ValidationError(
+        "You already manage this nest, so you can't add yourself as a steward."
+      );
+    }
+    if (ownerEmail && email === ownerEmail) {
+      throw new ValidationError(
+        "The nest owner already has full access and doesn't need a steward role."
+      );
+    }
+    const existing = db.prepare(
+      `SELECT * FROM stewards
+         WHERE nest_id = ? AND is_active = 1 AND scope = ? AND user_email = ?
+           AND COALESCE(node_pattern, '') = COALESCE(?, '')
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`
+    ).get(
+      params.nestId,
+      params.scope,
+      email,
+      nodePattern ?? null,
+      tagName ?? null
+    );
+    if (existing) {
+      const scopeLabel = params.scope === "document" ? `document "${nodePattern}"` : params.scope === "tag" ? `tag "#${tagName}"` : "this nest";
+      throw new ConflictError(
+        `"${email}" is already a steward of ${scopeLabel} with the "${existing.role}" role. Remove the existing assignment first to change the role.`
+      );
+    }
+    const userRow = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
+    const created = assignSteward({
+      nestId: params.nestId,
+      scope: params.scope,
+      nodePattern,
+      tagName,
+      userEmail: email,
+      userId: userRow?.id,
+      role: user.role ?? "reviewer",
+      assignedBy: params.assignedBy,
+      assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      isActive: true
+    });
+    results.push(created);
+  }
+  db.prepare(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0"
+  ).run(params.nestId);
+  return results;
+}
+function resolveStewardsForNode(nestId, nodeId) {
+  return resolve(nestId, nodeId).stewards;
+}
+function resolveStewardsWithFallback(nestId, nodeId) {
+  return resolve(nestId, nodeId);
+}
+function resolve(nestId, nodeId) {
+  const db = getDb();
+  const rows = db.prepare(
+    `
+      SELECT s.*, 1 AS priority, ('document: ' || s.node_pattern) AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
+          AND s.node_pattern = ?
+      UNION ALL
+      SELECT s.*, 2 AS priority, ('tag: ' || s.tag_name) AS match_source
+        FROM stewards s
+        JOIN node_tag_index nt
+          ON nt.nest_id = s.nest_id
+         AND nt.tag_name = s.tag_name
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
+          AND nt.node_id = ?
+      UNION ALL
+      SELECT s.*, 3 AS priority, 'nest-level steward' AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
+      ORDER BY priority ASC, user_email ASC
+      `
+  ).all(
+    nestId,
+    nodeId,
+    // document branch
+    nestId,
+    nodeId,
+    // tag branch
+    nestId
+    // nest branch
+  );
+  const resolved = rows.map((row) => ({
+    steward: rowToSteward(row),
+    priority: row.priority,
+    source: row.match_source
+  }));
+  if (resolved.length > 0) {
+    return { stewards: resolved, fallbackToOwner: false };
+  }
+  const owner = db.prepare(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`
+  ).get(nestId);
+  return {
+    stewards: [],
+    fallbackToOwner: true,
+    ownerEmail: owner?.email
+  };
+}
+function userIdForEmail(email) {
+  const db = getDb();
+  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  return row?.id;
+}
+function getStewardRolesForUser(nestId, userEmail) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT DISTINCT role FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)"
+  ).all(nestId, userEmail);
+  return rows.map((r) => r.role);
+}
+function getStewardsForUser(nestId, userEmail) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)"
+  ).all(nestId, userEmail);
+  return rows.map(rowToSteward);
+}
+function getCollaboratorRole(nestId, userEmail) {
+  const userId = userIdForEmail(userEmail);
+  if (!userId) return null;
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
+  ).get(nestId, userId);
+  return row?.permission ?? null;
+}
+function resolveUserRoles(nestId, userEmail, opts) {
+  const roles = /* @__PURE__ */ new Set();
+  if (isSuperAdmin2(userEmail)) roles.add("admin");
+  const owner = getNestOwnerEmail(nestId);
+  if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
+    roles.add("owner");
+  }
+  const userId = userIdForEmail(userEmail);
+  if (userId) {
+    const collabRole = collabPermToRole(resolveNestPermission(nestId, userId));
+    if (collabRole) roles.add(collabRole);
+  }
+  const stewardRoles = opts?.nodeId ? resolveStewardsForNode(nestId, opts.nodeId).filter(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
+  ).map((r) => r.steward.role) : getStewardRolesForUser(nestId, userEmail);
+  for (const role of stewardRoles) roles.add(role);
+  return [...roles];
+}
+function isSuperAdmin2(userEmail) {
+  const cfg = getAccessConfig();
+  return !!cfg?.super_admins?.includes(userEmail);
+}
+function canManageStewards(userEmail) {
+  if (config.AUTH_MODE === "open") return true;
+  return isLicenseAdminEmail(userEmail) || isSuperAdmin2(userEmail);
+}
+function canCreateInNest(nestId, userEmail) {
+  if (config.AUTH_MODE === "open" || isSuperAdmin2(userEmail)) return true;
+  const userId = userIdForEmail(userEmail);
+  if (userId) {
+    const perm = resolveNestPermission(nestId, userId);
+    if (perm === "owner" || perm === "admin" || perm === "write") return true;
+  }
+  return getStewardsForUser(nestId, userEmail).some(
+    (s) => s.role === "editor" && s.scope === "nest"
+  );
+}
+function getNestOwnerEmail(nestId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`
+  ).get(nestId);
+  return row?.email ?? null;
+}
+function canUserEdit(nestId, nodeId, userEmail) {
+  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+  if (roles.includes("owner")) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  if (isSuperAdmin2(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  if (canEditWith(roles)) {
+    return {
+      allowed: true,
+      reason: "editor access (collaborator or steward)",
+      role: roles.includes("admin") ? "admin" : "editor"
+    };
+  }
+  return { allowed: false, reason: "no editor role on this node", role: null };
+}
+function getCurrentVersionAuthor(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT author FROM node_versions
+       WHERE nest_id = ? AND node_id = ?
+       ORDER BY version DESC LIMIT 1`
+  ).get(nestId, nodeId);
+  return row?.author ?? null;
+}
+function getPendingReviewRequester(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT requested_by FROM review_requests
+       WHERE nest_id = ? AND node_id = ? AND status = 'pending'
+       ORDER BY requested_at DESC LIMIT 1`
+  ).get(nestId, nodeId);
+  return row?.requested_by ?? null;
+}
+function canUserApprove(nestId, nodeId, userEmail) {
+  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+  const isOwner = roles.includes("owner");
+  const isSuper = isSuperAdmin2(userEmail);
+  const allowSelf = nestAllowsSelfApprove(nestId);
+  const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
+  const actor = getPendingReviewRequester(nestId, nodeId) ?? getCurrentVersionAuthor(nestId, nodeId);
+  const isOwnSubmission = !!actor && actor.toLowerCase() === userEmail.toLowerCase();
+  if (hasStewardApprove) {
+    if (isOwnSubmission && !((isOwner || isSuper) && allowSelf)) {
+      return {
+        allowed: false,
+        reason: "You submitted this version for review, so you can't approve it yourself. Ask another reviewer to approve it (separation of duties).",
+        role: roles.includes("admin") ? "admin" : "reviewer"
+      };
+    }
+    return {
+      allowed: true,
+      reason: "reviewer access (collaborator or steward)",
+      role: roles.includes("admin") ? "admin" : "reviewer"
+    };
+  }
+  if (isOwner || isSuper) {
+    if (allowSelf) {
+      return {
+        allowed: true,
+        reason: isOwner ? "nest owner (self-approve enabled)" : "super admin",
+        role: isOwner ? "owner" : "super_admin"
+      };
+    }
+    return {
+      allowed: false,
+      reason: "Approvals go to assigned reviewers while self-approve is off. Enable self-approve in nest settings to approve directly (e.g. while seeding), or add a reviewer steward.",
+      role: isOwner ? "owner" : "super_admin"
+    };
+  }
+  const held = primaryRole(roles);
+  return {
+    allowed: false,
+    reason: held ? `You're a "${held}" on this document \u2014 only reviewers (or admins) can approve. Ask the nest owner to grant you the reviewer steward role.` : "You're not a steward on this document, so you can't approve it. Ask the nest owner to add you as a reviewer.",
+    role: held
+  };
+}
+function canUserAccess(nestId, nodeId, userEmail) {
+  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+  if (roles.includes("owner")) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  if (isSuperAdmin2(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  if (canViewWith(roles)) {
+    return {
+      allowed: true,
+      reason: "collaborator or steward access",
+      role: primaryRole(roles)
+    };
+  }
+  return { allowed: false, reason: "no collaborator or steward access", role: null };
+}
+function syncFromConfig(nestId, config2) {
+  const db = getDb();
+  let count = 0;
+  db.prepare(
+    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?"
+  ).run(nestId);
+  db.prepare(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?"
+  ).run(nestId);
+  const addEntries = (scope, entries, target) => {
+    for (const entry of entries) {
+      const user = db.prepare("SELECT id FROM users WHERE email = ?").get(entry.email);
+      const rawRole = entry.role || "reviewer";
+      const role = rawRole === "admin" ? "reviewer" : rawRole;
+      assignSteward({
+        nestId,
+        scope,
+        nodePattern: target?.nodePattern,
+        tagName: target?.tagName ? target.tagName.trim().replace(/^#+/, "").toLowerCase() : void 0,
+        userEmail: entry.email.toLowerCase(),
+        userId: user?.id,
+        role,
+        assignedBy: "config",
+        assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        isActive: true
+      });
+      count++;
+    }
+  };
+  if (config2.nest) {
+    addEntries("nest", config2.nest);
+  }
+  if (config2.tags) {
+    for (const [tagName, entries] of Object.entries(config2.tags)) {
+      addEntries("tag", entries, { tagName });
+    }
+  }
+  if (config2.documents) {
+    for (const [docPattern, entries] of Object.entries(config2.documents)) {
+      addEntries("document", entries, { nodePattern: docPattern });
+    }
+  }
+  return count;
+}
+function rowToSteward(row) {
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    scope: row.scope,
+    nodePattern: row.node_pattern || void 0,
+    tagName: row.tag_name || void 0,
+    userEmail: row.user_email,
+    userId: row.user_id || void 0,
+    role: row.role,
+    assignedBy: row.assigned_by,
+    assignedAt: row.assigned_at,
+    isActive: !!row.is_active
+  };
+}
+
+export {
+  AppError,
+  NotFoundError,
+  ForbiddenError,
+  ValidationError,
+  ConflictError,
+  LockedError,
+  trackEvent,
+  startTelemetryLoop,
+  getCurrentLicense,
+  isLicenseAdminEmail,
+  isLicenseAdminUserId,
+  installLicenseKey,
+  startLicenseSafetyPoll,
+  isSuspended,
+  getSuspensionReason,
+  validateLicense,
+  resolveNestPermission,
+  permissionLevel,
+  isPublicReader,
+  isStewardshipEnabled,
+  setStewardshipEnabled,
+  nestAllowsSelfApprove,
+  setAllowSelfApprove,
+  disableStewardshipAndWipeGovernance,
+  createNest,
+  importNest,
+  listNests,
+  listSharedNests,
+  listPublicNests,
+  getNest,
+  deleteNest,
+  engineCache,
+  loadAccessConfig,
+  isSuperAdmin,
+  buildTitleMap,
+  canManageWith,
+  assignSteward,
+  removeSteward,
+  updateSteward,
+  updateStewardRole,
+  getSteward,
+  getStewardsForNest,
+  getStewardsForScope,
+  listStewards,
+  createStewardRecord,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  getStewardRolesForUser,
+  getStewardsForUser,
+  getCollaboratorRole,
+  resolveUserRoles,
+  canManageStewards,
+  canCreateInNest,
+  canUserEdit,
+  canUserApprove,
+  canUserAccess,
+  syncFromConfig
+};