@promptowl/contextnest-community 1.0.1 → 1.2.0

package/dist/index.js

@@ -6,48 +6,86 @@ import {
   hashPassword,
   parseBearerToken,
   verifyPassword
-} from "./chunk-7K2LLJXK.js";
+} from "./chunk-XRK6SQSC.js";
 import {
   approve,
   cancelReview,
-  engineCache,
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-5VHKEIAW.js";
+} from "./chunk-E7E3JMQR.js";
+import {
+  checkConflict,
+  createVersion,
+  getApprovedVersion,
+  getCurrentVersion,
+  getDisplayStatus,
+  getVersions,
+  setApprovedVersion
+} from "./chunk-LO54V4AU.js";
 import {
-  assignSteward,
+  AppError,
+  ConflictError,
+  ForbiddenError,
+  LockedError,
+  NotFoundError,
+  ValidationError,
+  canCreateInNest,
+  canManageStewards,
+  canManageWith,
   canUserAccess,
   canUserApprove,
   canUserEdit,
+  createNest,
   createStewardRecord,
+  deleteNest,
+  disableStewardshipAndWipeGovernance,
+  engineCache,
+  getCollaboratorRole,
+  getCurrentLicense,
+  getNest,
+  getStewardRolesForUser,
   getStewardsForNest,
+  getStewardsForUser,
+  getSuspensionReason,
+  importNest,
+  installLicenseKey,
+  isLicenseAdminEmail,
+  isLicenseAdminUserId,
+  isPublicReader,
+  isStewardshipEnabled,
   isSuperAdmin,
+  isSuspended,
+  listNests,
+  listPublicNests,
+  listSharedNests,
   listStewards,
   loadAccessConfig,
+  nestAllowsSelfApprove,
+  permissionLevel,
   removeSteward,
+  resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
-  syncFromConfig
-} from "./chunk-K22GWPT4.js";
-import {
-  checkConflict,
-  createVersion,
-  getApprovedVersion,
-  getCurrentVersion,
-  getDisplayStatus,
-  getVersions,
-  setApprovedVersion
-} from "./chunk-JMZ75ZCD.js";
+  resolveUserRoles,
+  setAllowSelfApprove,
+  setStewardshipEnabled,
+  startLicenseSafetyPoll,
+  startTelemetryLoop,
+  syncFromConfig,
+  trackEvent,
+  updateSteward,
+  validateLicense
+} from "./chunk-5MT4ZBVF.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-KQCWNHDM.js";
+} from "./chunk-G62P54ET.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -172,463 +210,9 @@ var authMiddleware = createMiddleware(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
-// src/shared/errors.ts
-var AppError = class extends Error {
-  constructor(statusCode, message) {
-    super(message);
-    this.statusCode = statusCode;
-    this.name = "AppError";
-  }
-  statusCode;
-};
-var NotFoundError = class extends AppError {
-  constructor(message = "Not found") {
-    super(404, message);
-    this.name = "NotFoundError";
-  }
-};
-var ForbiddenError = class extends AppError {
-  constructor(message = "Forbidden") {
-    super(403, message);
-    this.name = "ForbiddenError";
-  }
-};
-var ValidationError = class extends AppError {
-  constructor(message) {
-    super(400, message);
-    this.name = "ValidationError";
-  }
-};
-var ConflictError = class extends AppError {
-  constructor(message) {
-    super(409, message);
-    this.name = "ConflictError";
-  }
-};
-
-// src/telemetry/tracker.ts
-function trackEvent(event, data) {
-  if (!config.TELEMETRY_ENABLED) return;
-  try {
-    const db = getDb();
-    db.prepare(
-      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)"
-    ).run(event, data ? JSON.stringify(data) : null);
-  } catch {
-  }
-}
-async function flushTelemetry() {
-  if (!config.TELEMETRY_ENABLED || !config.PROMPTOWL_KEY) return;
-  const db = getDb();
-  const userCount = db.prepare("SELECT COUNT(*) as c FROM users").get()?.c || 0;
-  const nestCount = db.prepare("SELECT COUNT(*) as c FROM nests").get()?.c || 0;
-  const events = db.prepare(
-    "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
-  ).all();
-  if (events.length === 0 && userCount === 0) return;
-  const payload = {
-    server_key: config.PROMPTOWL_KEY,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    stats: { users: userCount, nests: nestCount },
-    events: events.map((e) => ({
-      event: e.event,
-      data: e.data_json ? JSON.parse(e.data_json) : null,
-      at: e.created_at
-    }))
-  };
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload)
-    });
-    if (res.ok && events.length > 0) {
-      const ids = events.map((e) => e.id);
-      db.prepare(
-        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
-      ).run(...ids);
-    }
-  } catch {
-  }
-}
-var telemetryTimer = null;
-function startTelemetryLoop() {
-  if (!config.TELEMETRY_ENABLED) return;
-  setTimeout(() => flushTelemetry(), 3e4);
-  telemetryTimer = setInterval(
-    () => flushTelemetry(),
-    config.TELEMETRY_INTERVAL_MS
-  );
-}
-
-// src/auth/license.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-var currentLicense = null;
-function getCurrentLicense() {
-  return currentLicense;
-}
-function isLicenseAdminEmail(email) {
-  if (!email) return false;
-  const lic = currentLicense;
-  if (!lic?.valid || !lic.ownerEmail) return false;
-  return lic.ownerEmail.toLowerCase() === email.toLowerCase();
-}
-function isLicenseAdminUserId(userId) {
-  try {
-    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
-    return isLicenseAdminEmail(row?.email);
-  } catch {
-    return false;
-  }
-}
-function upsertEnvVar(filePath, varName, value) {
-  const prefix = `${varName}=`;
-  let lines = [];
-  if (existsSync(filePath)) {
-    lines = readFileSync(filePath, "utf8").split(/\r?\n/);
-  }
-  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
-  if (value !== null) {
-    filtered.push(`${prefix}${value}`);
-  }
-  while (filtered.length && filtered[filtered.length - 1] === "") {
-    filtered.pop();
-  }
-  writeFileSync(filePath, filtered.join("\n") + "\n", "utf8");
-}
-async function installLicenseKey(key) {
-  const trimmed = key.trim();
-  if (!trimmed.startsWith("pk_")) {
-    throw new Error("Invalid license key format. Must start with pk_.");
-  }
-  const previousKey = process.env.PROMPTOWL_KEY || "";
-  process.env.PROMPTOWL_KEY = trimmed;
-  const info = await validateLicense({ forceFresh: true });
-  if (!info.valid) {
-    process.env.PROMPTOWL_KEY = previousKey;
-    if (previousKey) {
-      await validateLicense({ forceFresh: true });
-    }
-    return info;
-  }
-  try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
-  } catch (err) {
-    console.warn("[license] failed to write .env:", err);
-  }
-  startLicenseWatcher();
-  return info;
-}
-var watcherActive = false;
-var watcherAbort = null;
-var WATCHER_BACKOFF_MIN_MS = 2 * 1e3;
-var WATCHER_BACKOFF_MAX_MS = 60 * 1e3;
-function startLicenseWatcher() {
-  if (watcherActive) {
-    watcherAbort?.abort();
-    return;
-  }
-  watcherActive = true;
-  void runLicenseWatcher();
-}
-async function runLicenseWatcher() {
-  let backoff = WATCHER_BACKOFF_MIN_MS;
-  while (watcherActive) {
-    const key = config.PROMPTOWL_KEY;
-    if (!key) {
-      await sleep(WATCHER_BACKOFF_MAX_MS);
-      continue;
-    }
-    try {
-      watcherAbort = new AbortController();
-      const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-      const fetchTimeout = AbortSignal.timeout(30 * 1e3);
-      const signal = typeof AbortSignal.any === "function" ? AbortSignal.any([watcherAbort.signal, fetchTimeout]) : watcherAbort.signal;
-      const res = await fetch(`${promptowlUrl}/api/license/listen`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          key,
-          since_updated_at: currentLicense ? (/* @__PURE__ */ new Date()).toISOString() : void 0
-        }),
-        signal
-      });
-      if (!res.ok) {
-        if (res.status === 504 || res.status === 408 || res.status === 502) {
-          backoff = WATCHER_BACKOFF_MIN_MS;
-          continue;
-        }
-        throw new Error(`listen returned ${res.status}`);
-      }
-      const data = await res.json();
-      backoff = WATCHER_BACKOFF_MIN_MS;
-      if (data.event && data.event !== "no_change") {
-        console.log(
-          `[license] event from PromptOwl: ${data.event} \u2014 revalidating`
-        );
-        const wasValid = !!currentLicense?.valid;
-        await validateLicense({ forceFresh: true });
-        const isValid = !!currentLicense?.valid;
-        if (wasValid && !isValid) {
-          handleLicenseRevoked();
-        }
-      }
-    } catch (err) {
-      if (err.name === "AbortError") {
-        continue;
-      }
-      console.warn(
-        `[license] watcher error: ${err.message}; backing off ${backoff}ms`
-      );
-      await sleep(backoff);
-      backoff = Math.min(backoff * 2, WATCHER_BACKOFF_MAX_MS);
-    } finally {
-      watcherAbort = null;
-    }
-  }
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-var safetyPollHandle = null;
-var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
-function startLicenseSafetyPoll() {
-  if (safetyPollHandle) return;
-  safetyPollHandle = setInterval(async () => {
-    if (!config.PROMPTOWL_KEY) return;
-    try {
-      const wasValid = !!currentLicense?.valid;
-      await validateLicense({ forceFresh: true });
-      const isValid = !!currentLicense?.valid;
-      if (wasValid && !isValid) {
-        console.log("[license] safety poll detected revocation");
-        handleLicenseRevoked();
-      }
-    } catch (err) {
-      console.warn(
-        `[license] safety poll error: ${err.message}`
-      );
-    }
-  }, SAFETY_POLL_INTERVAL_MS);
-  if (typeof safetyPollHandle.unref === "function") {
-    safetyPollHandle.unref();
-  }
-}
-function handleLicenseRevoked() {
-  try {
-    const db = getDb();
-    const result = db.prepare("DELETE FROM sessions").run();
-    console.warn(
-      `[license] revoked \u2014 wiped ${result.changes} active session(s).`
-    );
-  } catch (err) {
-    console.warn("[license] failed to wipe sessions:", err);
-  }
-  try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
-    console.warn(
-      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
-    );
-  } catch (err) {
-    console.warn("[license] failed to strip key from .env:", err);
-  }
-  process.env.PROMPTOWL_KEY = "";
-  currentLicense = {
-    valid: false,
-    tier: "none",
-    org: null,
-    limits: null,
-    suspended: false,
-    suspendedReason: null,
-    ownerEmail: null
-  };
-}
-var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var suspensionFirstSeen = null;
-var suspensionConfirmed = false;
-var suspensionReason = null;
-var SUSPENSION_CONFIRM_WINDOW_MS = 60 * 60 * 1e3;
-function isSuspended() {
-  return suspensionConfirmed;
-}
-function getSuspensionReason() {
-  return suspensionReason;
-}
-async function validateLicense(opts = {}) {
-  const info = await _validateLicenseImpl(!!opts.forceFresh);
-  currentLicense = info;
-  return info;
-}
-async function _validateLicenseImpl(forceFresh) {
-  const key = config.PROMPTOWL_KEY;
-  if (!key) {
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null,
-      ownerEmail: null
-    };
-  }
-  const db = getDb();
-  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
-  if (cached && !forceFresh) {
-    const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
-    if (age < CACHE_TTL_MS) {
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
-    }
-  }
-  try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/license/validate`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ key })
-    });
-    if (!res.ok) {
-      if (cached) {
-        console.warn(
-          "  PromptOwl unreachable, using cached license (grace period)"
-        );
-        return {
-          valid: true,
-          tier: cached.tier,
-          org: cached.org,
-          limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-          suspended: suspensionConfirmed,
-          suspendedReason: suspensionReason,
-          ownerEmail: cached.owner_email || null
-        };
-      }
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null,
-        ownerEmail: null
-      };
-    }
-    const data = await res.json();
-    if (data.suspended === true) {
-      if (!suspensionFirstSeen) {
-        suspensionFirstSeen = Date.now();
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.warn(
-          `
-  WARNING: PromptOwl has flagged this server for suspension.`
-        );
-        console.warn(
-          `  Reason: ${suspensionReason}`
-        );
-        console.warn(
-          `  This will be confirmed in ~1 hour. If this is an error,`
-        );
-        console.warn(
-          `  contact support@promptowl.ai to reverse it.
-`
-        );
-      } else if (Date.now() - suspensionFirstSeen >= SUSPENSION_CONFIRM_WINDOW_MS) {
-        suspensionConfirmed = true;
-        suspensionReason = data.suspended_reason || "Suspended by PromptOwl";
-        console.error(
-          `
-  SERVER SUSPENDED: ${suspensionReason}`
-        );
-        console.error(
-          `  Write operations are disabled. Reads still work.`
-        );
-        console.error(
-          `  Contact support@promptowl.ai to resolve.
-`
-        );
-      }
-    } else {
-      if (suspensionFirstSeen) {
-        console.log("  Suspension flag cleared by PromptOwl.");
-      }
-      suspensionFirstSeen = null;
-      suspensionConfirmed = false;
-      suspensionReason = null;
-    }
-    if (!data.valid && !data.suspended) {
-      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
-      return {
-        valid: false,
-        tier: "none",
-        org: null,
-        limits: null,
-        suspended: false,
-        suspendedReason: null,
-        ownerEmail: data.owner_email || null
-      };
-    }
-    if (data.valid) {
-      const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
-      db.prepare(
-        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
-         VALUES (?, ?, ?, ?, ?, datetime('now'))`
-      ).run(
-        key,
-        data.tier || "community",
-        data.org || null,
-        limitsJson,
-        data.owner_email || null
-      );
-    }
-    return {
-      valid: data.valid !== false,
-      tier: data.tier || "community",
-      org: data.org || null,
-      limits: data.limits || null,
-      suspended: suspensionConfirmed,
-      suspendedReason: suspensionReason,
-      ownerEmail: data.owner_email || null
-    };
-  } catch (err) {
-    if (cached) {
-      console.warn(
-        `  PromptOwl validation failed (${err.message}), using cached license`
-      );
-      return {
-        valid: true,
-        tier: cached.tier,
-        org: cached.org,
-        limits: cached.limits_json ? JSON.parse(cached.limits_json) : null,
-        suspended: suspensionConfirmed,
-        suspendedReason: suspensionReason,
-        ownerEmail: cached.owner_email || null
-      };
-    }
-    return {
-      valid: false,
-      tier: "none",
-      org: null,
-      limits: null,
-      suspended: false,
-      suspendedReason: null,
-      ownerEmail: null
-    };
-  }
-}
-
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
-function tryConsume(key, cfg) {
-  const now = Date.now();
-  const cutoff = now - cfg.windowMs;
+function liveBucket(key, cutoff) {
   let bucket = buckets.get(key);
   if (!bucket) {
     bucket = { hits: [] };
@@ -637,14 +221,29 @@ function tryConsume(key, cfg) {
   while (bucket.hits.length && bucket.hits[0] < cutoff) {
     bucket.hits.shift();
   }
+  return bucket;
+}
+function tryConsume(key, cfg) {
+  const now = Date.now();
+  const bucket = liveBucket(key, now - cfg.windowMs);
   if (bucket.hits.length >= cfg.max) {
     return false;
   }
   bucket.hits.push(now);
   return true;
 }
+function isLimited(key, cfg) {
+  return liveBucket(key, Date.now() - cfg.windowMs).hits.length >= cfg.max;
+}
+function recordFailure(key, cfg) {
+  liveBucket(key, Date.now() - cfg.windowMs).hits.push(Date.now());
+}
+function clear(key) {
+  buckets.delete(key);
+}
 
 // src/auth/routes.ts
+import { getConnInfo } from "@hono/node-server/conninfo";
 var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
@@ -653,6 +252,11 @@ function clientIp(c) {
   if (xff) return xff.split(",")[0].trim();
   const realIp = c.req.header("x-real-ip");
   if (realIp) return realIp.trim();
+  try {
+    const addr = getConnInfo(c).remote.address;
+    if (addr) return addr;
+  } catch {
+  }
   return "unknown";
 }
 function resolveCallerUserId(c) {
@@ -669,6 +273,15 @@ function resolveCallerUserId(c) {
   }
   return null;
 }
+function deviceGateBlocked(c) {
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate === "open") return null;
+  const error = "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.";
+  if (gate === "disabled") return { error, gate };
+  const callerId = resolveCallerUserId(c);
+  if (callerId && !isLicenseAdminUserId(callerId)) return { error, gate };
+  return null;
+}
 function setSessionCookie(c, sessionId) {
   c.header(
     "Set-Cookie",
@@ -731,7 +344,10 @@ authRoutes.post("/login", async (c) => {
   }
   const ip = clientIp(c);
   const emailLower = body.email.toLowerCase();
-  if (!tryConsume(`login:ip:${ip}`, LOGIN_LIMIT) || !tryConsume(`login:email:${emailLower}`, LOGIN_LIMIT)) {
+  const hasIp = ip !== "unknown";
+  const ipKey = `login:ip:${ip}`;
+  const emailKey = `login:email:${emailLower}`;
+  if (hasIp && isLimited(ipKey, LOGIN_LIMIT) || isLimited(emailKey, LOGIN_LIMIT)) {
     return c.json({ error: "Too many login attempts, try again later" }, 429);
   }
   const db = getDb();
@@ -740,8 +356,14 @@ authRoutes.post("/login", async (c) => {
   ).get(body.email);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
+    if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
+    recordFailure(emailKey, LOGIN_LIMIT);
+    console.warn(`[auth] login FAIL \u2014 counter++ ip=${ip} email=${emailLower}`);
     return c.json({ error: "Invalid credentials" }, 401);
   }
+  console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
+  if (hasIp) clear(ipKey);
+  clear(emailKey);
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -843,6 +465,8 @@ authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
   }
@@ -864,6 +488,8 @@ authRoutes.post("/device", async (c) => {
   return c.json(data);
 });
 authRoutes.get("/device/poll", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   const code = c.req.query("code");
   const clientSecret = c.req.query("client_secret");
   if (!code || !clientSecret) {
@@ -899,6 +525,18 @@ authRoutes.post("/promptowl", async (c) => {
       401
     );
   }
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate !== "open") {
+    if (gate === "disabled" || !isLicenseAdminEmail(me.email)) {
+      return c.json(
+        {
+          error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
+          gate
+        },
+        403
+      );
+    }
+  }
   const db = getDb();
   let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
   if (!user) {
@@ -980,9 +618,17 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   const db = getDb();
   const userId = c.get("userId");
   const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
-  if (!user) return c.json({ error: "User not found" }, 404);
+  if (!user) throw new ValidationError("User not found");
   const check = await verifyPassword(body.current, user.password_hash);
-  if (!check.ok) return c.json({ error: "Invalid current password" }, 401);
+  if (!check.ok) {
+    throw new ValidationError("Current password is incorrect");
+  }
+  const sameAsCurrent = await verifyPassword(body.next, user.password_hash);
+  if (sameAsCurrent.ok) {
+    throw new ValidationError(
+      "new password must be different from the current password"
+    );
+  }
   const newHash = await hashPassword(body.next);
   db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
     newHash,
@@ -992,6 +638,92 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
+authRoutes.post("/admin/reset-password/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can reset passwords." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  let supplied;
+  try {
+    supplied = (await c.req.json()).password;
+  } catch {
+    supplied = void 0;
+  }
+  if (supplied && supplied.length < 8) {
+    throw new ValidationError("password must be at least 8 characters");
+  }
+  const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
+  const newPassword = supplied ?? generated;
+  const newHash = await hashPassword(newPassword);
+  db.transaction(() => {
+    db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+      newHash,
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
+  return c.json({
+    ok: true,
+    email: target.email,
+    keys_revoked: true,
+    // Plaintext returned ONCE, only when the server generated it.
+    temporary_password: generated ?? void 0
+  });
+});
+authRoutes.delete("/users/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can remove users." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  if (targetId === callerId) {
+    return c.json({ error: "You can't remove your own admin account." }, 400);
+  }
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  const ownedNests = db.prepare("SELECT COUNT(*) AS c FROM nests WHERE user_id = ?").get(target.id).c;
+  if (ownedNests > 0) {
+    return c.json(
+      {
+        error: `This user owns ${ownedNests} nest${ownedNests === 1 ? "" : "s"}. Transfer or delete them before removing the user.`,
+        owned_nests: ownedNests
+      },
+      409
+    );
+  }
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)"
+    ).run(target.id, target.email);
+    db.prepare("DELETE FROM nest_collaborators WHERE user_id = ?").run(
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+    db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.remove_user", { adminId: callerId, userId: target.id });
+  return c.json({ ok: true, email: target.email });
+});
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
@@ -1079,8 +811,13 @@ authRoutes.get("/teammates", async (c) => {
         WHERE s.is_active = 1
           AND NOT EXISTS (
             SELECT 1 FROM users u
-              JOIN api_keys k ON k.user_id = u.id
              WHERE lower(u.email) = lower(s.user_email)
+               AND (
+                 u.is_invited = 0
+                 OR EXISTS (
+                   SELECT 1 FROM api_keys k WHERE k.user_id = u.id
+                 )
+               )
           )
         ORDER BY s.user_email`
   ).all();
@@ -1094,355 +831,64 @@ authRoutes.get("/teammates", async (c) => {
 // src/nests/routes.ts
 import { Hono as Hono2 } from "hono";
 
-// src/shared/access.ts
-var PERMISSION_LEVELS = {
-  none: 0,
-  read: 1,
-  write: 2,
-  admin: 3,
-  owner: 4
-};
-function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
-    return "owner";
-  }
-  const directGrant = db.prepare(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
-  ).get(nestId, userId);
-  if (directGrant) return directGrant.permission;
-  if (nest.visibility === "public") return "read";
-  return "none";
-}
-function permissionLevel(p) {
-  return PERMISSION_LEVELS[p] ?? 0;
-}
+// src/nodes/service.ts
+import { serializeDocument, parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
 
-// src/nests/service.ts
-import { join } from "path";
-import { rmSync, mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
-import { NestStorage } from "@promptowl/contextnest-engine";
-function nestPath(nestId) {
-  return join(config.DATA_ROOT, "nests", nestId);
-}
-function toSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function isStewardshipEnabled(nestId) {
-  const db = getDb();
-  const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
-  return !!row?.stewardship_enabled;
+// src/governance/tag-index-service.ts
+function normalizeTag(raw) {
+  return raw.trim().replace(/^#+/, "").toLowerCase();
 }
-function setStewardshipEnabled(nestId, enabled) {
+function syncNodeTags(nestId, nodeId, tags) {
   const db = getDb();
-  db.prepare("UPDATE nests SET stewardship_enabled = ? WHERE id = ?").run(
-    enabled ? 1 : 0,
-    nestId
+  const normalized = Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
+    )
   );
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+    ).run(nestId, nodeId);
+    const insert = db.prepare(
+      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+    );
+    for (const tag of normalized) {
+      insert.run(nestId, nodeId, tag);
+    }
+  })();
 }
-async function createNest(userId, name, description) {
-  const id = uuid2();
-  const slug = toSlug(name);
+function removeNodeFromTagIndex(nestId, nodeId) {
   const db = getDb();
-  const visibility = userId === ANON_USER_ID ? "public" : "private";
   db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)"
-  ).run(id, userId, name, slug, description || null, visibility);
-  const path = nestPath(id);
-  mkdirSync(path, { recursive: true });
-  const storage = new NestStorage(path);
-  await storage.init(name);
-  trackEvent("nest.create", { nestId: id, userId });
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
+  ).run(nestId, nodeId);
 }
-function listNests(userId) {
-  const db = getDb();
-  if (userId === ANON_USER_ID) {
-    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
-  }
-  const includeAnon = config.AUTH_MODE === "open" || isLicenseAdminUserId(userId);
-  if (!includeAnon) {
-    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(userId);
-  }
-  return db.prepare(
-    "SELECT * FROM nests WHERE user_id = ? OR (user_id = ? AND visibility = 'public') ORDER BY created_at DESC"
-  ).all(userId, ANON_USER_ID);
-}
-function listSharedNests(userId) {
-  const db = getDb();
-  return db.prepare(
-    `SELECT DISTINCT n.* FROM nests n
-       JOIN nest_collaborators nc ON nc.nest_id = n.id
-       WHERE n.user_id != ? AND nc.user_id = ?
-       ORDER BY n.created_at DESC`
-  ).all(userId, userId);
-}
-function getNest(nestId) {
-  const db = getDb();
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId) || null;
-}
-async function deleteNest(nestId) {
-  const db = getDb();
-  const wipe = db.transaction((id) => {
-    db.prepare("DELETE FROM approved_versions WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM node_versions WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM review_requests WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM nest_collaborators WHERE nest_id = ?").run(id);
-    try {
-      db.prepare("DELETE FROM node_tag_index WHERE nest_id = ?").run(id);
-    } catch {
-    }
-    db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM nests WHERE id = ?").run(id);
-  });
-  wipe(nestId);
-  const path = nestPath(nestId);
-  try {
-    rmSync(path, { recursive: true, force: true });
-  } catch (err) {
-    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
-  }
-  trackEvent("nest.delete", { nestId });
-}
-
-// src/nests/routes.ts
-function effectivePermission(nestId, userId) {
-  if (config.AUTH_MODE === "open") {
-    const db = getDb();
-    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
-    if (nest && nest.user_id === ANON_USER_ID) return "owner";
-  }
-  return resolveNestPermission(nestId, userId);
-}
-var nestRoutes = new Hono2();
-nestRoutes.get("/", async (c) => {
-  const userId = c.get("userId");
-  const owned = listNests(userId);
-  const shared = listSharedNests(userId);
-  const db = getDb();
-  const ownerEmailStmt = db.prepare(
-    "SELECT email FROM users WHERE id = ?"
-  );
-  const annotate = (n) => {
-    const permission = effectivePermission(n.id, userId);
-    const is_owner = permission === "owner";
-    let owner_email = null;
-    if (!is_owner && n.user_id !== ANON_USER_ID) {
-      const row = ownerEmailStmt.get(n.user_id);
-      owner_email = row?.email ?? null;
-    }
-    return { ...n, permission, is_owner, owner_email };
-  };
-  return c.json({
-    nests: [...owned.map(annotate), ...shared.map(annotate)]
-  });
-});
-nestRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.name) {
-    throw new ValidationError("name is required");
-  }
-  const nest = await createNest(c.get("userId"), body.name, body.description);
-  return c.json({ nest }, 201);
-});
-nestRoutes.get("/:nestId", async (c) => {
-  const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission === "none") {
-    throw new NotFoundError("Nest not found");
-  }
-  const nest = getNest(nestId);
-  return c.json({ nest, permission });
-});
-nestRoutes.delete("/:nestId", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const nest = getNest(nestId);
-  if (!nest) {
-    throw new NotFoundError("Nest not found");
-  }
-  const permission = effectivePermission(nestId, userId);
-  const isAnonOwned = nest.user_id === ANON_USER_ID;
-  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
-  if (permission !== "owner" && !adminCaretaker) {
-    throw new ForbiddenError(
-      "You don't have permission to delete this nest. Only the nest owner can delete it."
-    );
-  }
-  await deleteNest(nestId);
-  return c.json({ deleted: true });
-});
-nestRoutes.get("/:nestId/settings", async (c) => {
-  const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
-  if (permission === "none") {
-    throw new NotFoundError("Nest not found");
-  }
-  return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId)
-  });
-});
-nestRoutes.patch("/:nestId/settings", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const isServerAdmin = isLicenseAdminUserId(userId);
-  const permission = effectivePermission(nestId, userId);
-  if (!isServerAdmin && permission !== "owner") {
-    return c.json(
-      {
-        error: "Only the nest owner or the server license-admin can update nest settings."
-      },
-      403
-    );
-  }
-  const body = await c.req.json();
-  if (typeof body.stewardship_enabled === "boolean") {
-    setStewardshipEnabled(nestId, body.stewardship_enabled);
-  }
-  return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId)
-  });
-});
-
-// src/nests/sharing-routes.ts
-import { Hono as Hono3 } from "hono";
-import { v4 as uuid3 } from "uuid";
-var sharingRoutes = new Hono3();
-sharingRoutes.get("/collaborators", async (c) => {
-  const db = getDb();
-  const collabs = db.prepare(
-    `SELECT nc.*, u.email FROM nest_collaborators nc
-       LEFT JOIN users u ON nc.user_id = u.id
-       WHERE nc.nest_id = ?
-       ORDER BY nc.granted_at`
-  ).all(c.req.param("nestId"));
-  return c.json({ collaborators: collabs });
-});
-sharingRoutes.post("/collaborators", async (c) => {
-  const body = await c.req.json();
-  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
-    throw new ValidationError("permission must be read, write, or admin");
-  }
-  const db = getDb();
-  let userId = body.user_id;
-  if (!userId && body.email) {
-    let user = db.prepare("SELECT id FROM users WHERE email = ?").get(body.email);
-    if (!user) {
-      const { hashPassword: hashPassword2 } = await import("./keys-YV33AJK3.js");
-      userId = uuid3();
-      db.prepare(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, body.email, null, await hashPassword2(uuid3()));
-    } else {
-      userId = user.id;
-    }
-  }
-  if (!userId) {
-    throw new ValidationError("user_id or email is required");
-  }
-  const collabId = uuid3();
-  db.prepare(
-    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
-  ).run(
-    collabId,
-    c.req.param("nestId"),
-    userId,
-    body.permission,
-    c.get("userId")
-  );
-  const collab = db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
-  return c.json({ collaborator: collab }, 201);
-});
-sharingRoutes.patch("/collaborators/:collabId", async (c) => {
-  const body = await c.req.json();
-  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
-    throw new ValidationError("permission must be read, write, or admin");
-  }
-  const db = getDb();
-  db.prepare("UPDATE nest_collaborators SET permission = ? WHERE id = ?").run(
-    body.permission,
-    c.req.param("collabId")
-  );
-  return c.json({ updated: true });
-});
-sharingRoutes.delete("/collaborators/:collabId", async (c) => {
-  const db = getDb();
-  db.prepare("DELETE FROM nest_collaborators WHERE id = ?").run(
-    c.req.param("collabId")
-  );
-  return c.json({ removed: true });
-});
-sharingRoutes.patch("/visibility", async (c) => {
-  const body = await c.req.json();
-  if (!body.visibility || !["private", "public"].includes(body.visibility)) {
-    throw new ValidationError("visibility must be private or public");
-  }
-  const db = getDb();
-  db.prepare("UPDATE nests SET visibility = ? WHERE id = ?").run(
-    body.visibility,
-    c.req.param("nestId")
-  );
-  return c.json({ visibility: body.visibility });
-});
-
-// src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
-  if (!userId) return "admin@localhost";
+
+// src/governance/access-guard.ts
+function resolveCallerEmail(userId) {
+  if (!userId) return "admin@localhost";
   const db = getDb();
   const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
   return row?.email || "admin@localhost";
 }
-function canReadNode(nestId, nodeId, userEmail) {
+function canReadNode(nestId, nodeId, userId, userEmail) {
+  if (isPublicReader(nestId, userId)) {
+    return getApprovedVersion(nestId, nodeId) !== null;
+  }
   if (!isStewardshipEnabled(nestId)) return true;
   return canUserAccess(nestId, nodeId, userEmail).allowed;
 }
-function filterAccessible(nestId, userEmail, nodes) {
+function filterAccessible(nestId, userId, userEmail, nodes) {
+  if (isPublicReader(nestId, userId)) {
+    return nodes.filter((n) => getApprovedVersion(nestId, n.id) !== null);
+  }
   if (!isStewardshipEnabled(nestId)) return nodes;
   return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
 }
 
-// src/nodes/routes.ts
-import { Hono as Hono4 } from "hono";
-import { serializeDocument } from "@promptowl/contextnest-engine";
-
-// src/governance/tag-index-service.ts
-function normalizeTag(raw) {
-  return raw.trim().replace(/^#+/, "").toLowerCase();
-}
-function syncNodeTags(nestId, nodeId, tags) {
-  const db = getDb();
-  const normalized = Array.from(
-    new Set(
-      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
-    )
-  );
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    const insert = db.prepare(
-      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
-    );
-    for (const tag of normalized) {
-      insert.run(nestId, nodeId, tag);
-    }
-  })();
-}
-function removeNodeFromTagIndex(nestId, nodeId) {
-  const db = getDb();
-  db.prepare(
-    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-  ).run(nestId, nodeId);
-}
-
 // src/governance/external-edit-service.ts
 import { readFile } from "fs/promises";
-import { join as join2 } from "path";
+import { join } from "path";
 import {
   detectDrift,
   stageSuggestion,
@@ -1450,7 +896,10 @@ import {
   rejectSuggestion,
   listSuggestions,
   readSuggestion,
-  VersionManager
+  parseDocument,
+  VersionManager,
+  computeContentHash,
+  getChecksumContent
 } from "@promptowl/contextnest-engine";
 var communityRbac = {
   isCzar: () => false,
@@ -1458,7 +907,7 @@ var communityRbac = {
   isDocOwner: () => true
 };
 function docPath(nestId, documentId) {
-  return join2(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
+  return join(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
 }
 async function readRaw(nestId, documentId) {
   try {
@@ -1481,6 +930,18 @@ async function loadChainHead(storage, documentId) {
     return null;
   }
 }
+async function loadLatestApprovedNode(nestId, documentId) {
+  const { storage } = engineCache.get(nestId);
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return null;
+  return parseDocument(docPath(nestId, documentId), head.content, documentId);
+}
+async function bodyMatchesLatestVersion(storage, documentId, liveBodyHash) {
+  const head = await loadChainHead(storage, documentId);
+  if (!head) return false;
+  const headBodyHash = computeContentHash(getChecksumContent(head.content));
+  return headBodyHash === liveBodyHash;
+}
 async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
   const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
   return res?.meta ?? null;
@@ -1493,6 +954,9 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (raw == null) return null;
   const drift = detectDrift(raw, node.frontmatter.checksum);
   if (!drift.drifted) return null;
+  if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
+    return null;
+  }
   const approved = await loadChainHead(storage, documentId);
   if (!approved) return null;
   const existing = await listSuggestions(storage, documentId);
@@ -1521,20 +985,35 @@ async function scanNestForDrift(nestId, actor = "system:scanner") {
 async function getPendingChange(nestId, documentId) {
   const { storage } = engineCache.get(nestId);
   const list = await listSuggestions(storage, documentId);
-  if (list.length === 0) return null;
-  const latest = list[list.length - 1];
-  return {
-    suggestion_id: latest.suggestion_id,
-    detected_at: latest.detected_at,
-    source: latest.source,
-    proposed_hash: latest.proposed_hash
-  };
+  for (let i = list.length - 1; i >= 0; i--) {
+    const meta = list[i];
+    if (await bodyMatchesLatestVersion(storage, documentId, meta.proposed_hash)) {
+      continue;
+    }
+    return {
+      suggestion_id: meta.suggestion_id,
+      detected_at: meta.detected_at,
+      source: meta.source,
+      proposed_hash: meta.proposed_hash
+    };
+  }
+  return null;
 }
 async function listNestExternalEdits(nestId) {
   const { storage } = engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
   const lists = await Promise.all(
-    docs.map((doc) => listSuggestions(storage, doc.id))
+    docs.map(async (doc) => {
+      const metas = await listSuggestions(storage, doc.id);
+      const fresh = [];
+      for (const meta of metas) {
+        if (await bodyMatchesLatestVersion(storage, doc.id, meta.proposed_hash)) {
+          continue;
+        }
+        fresh.push(meta);
+      }
+      return fresh;
+    })
   );
   const entries = lists.flat().map((meta) => ({
     suggestion_id: meta.suggestion_id,
@@ -1590,7 +1069,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1656,48 +1135,79 @@ function startDriftScanner(intervalMs = 3e4) {
   scannerTimer.unref?.();
 }
 
-// src/nodes/routes.ts
-var nodeRoutes = new Hono4();
+// src/nodes/service.ts
+function userIdFromEmail(email) {
+  const db = getDb();
+  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  return row?.id ?? ANON_USER_ID;
+}
+var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
+var stripUndefined = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+function bodyOnly(nodeId, raw) {
+  try {
+    return parseDocument2(`${nodeId}.md`, raw, nodeId).body ?? "";
+  } catch {
+    return raw;
+  }
+}
 function toNodeResponse(node) {
+  const fm = node.frontmatter;
+  const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
+  const tags = Array.isArray(fm.tags) ? fm.tags.map((t) => String(t)) : [];
   return {
     id: node.id,
-    title: node.frontmatter.title,
-    type: node.frontmatter.type || "document",
-    tags: node.frontmatter.tags || [],
-    // Widen to string so callers can layer review-workflow states like
-    // "pending_review" / "rejected" on top of the on-disk frontmatter
-    // status. The engine's Status enum only knows draft/approved.
-    status: node.frontmatter.status || "draft",
-    version: node.frontmatter.version || 1,
-    author: node.frontmatter.author,
-    description: node.frontmatter.description,
-    created_at: node.frontmatter.created_at,
-    updated_at: node.frontmatter.updated_at,
-    content: node.body,
+    title,
+    type: fm.type || "document",
+    tags,
+    status: fm.status || "draft",
+    version: fm.version || 1,
+    author: fm.author,
+    description: fm.description,
+    created_at: fm.created_at,
+    updated_at: fm.updated_at,
+    content: node.body || "",
     pendingChange: node.pendingChange ?? void 0
   };
 }
-nodeRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
-  const documents = await storage.discoverDocuments();
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, documents);
-  const pendingByDoc = /* @__PURE__ */ new Map();
-  await Promise.all(
+async function listNodesForCaller(nestId, userId, filters = {}) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  let documents = await storage.discoverDocuments();
+  if (filters.type) {
+    documents = documents.filter((n) => n.frontmatter.type === filters.type);
+  }
+  if (filters.tag) {
+    const tag = normalizeTag2(filters.tag);
+    documents = documents.filter(
+      (n) => (n.frontmatter.tags || []).includes(tag)
+    );
+  }
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const publicReader = isPublicReader(nestId, userId);
+  const enriched = await Promise.all(
     accessible.map(async (doc) => {
+      const r = toNodeResponse(doc);
+      if (publicReader) {
+        const approved = getApprovedVersion(nestId, doc.id);
+        if (approved != null) {
+          try {
+            const raw = await versionManager.reconstructVersion(doc.id, approved);
+            r.content = bodyOnly(doc.id, raw);
+          } catch (err) {
+            console.error("reconstructVersion failed (list)", doc.id, approved, err);
+            r.content = "";
+          }
+          r.version = approved;
+          r.status = "published";
+        }
+        return r;
+      }
+      let pending = null;
       try {
-        pendingByDoc.set(doc.id, await getPendingChange(nestId, doc.id));
+        pending = await getPendingChange(nestId, doc.id);
       } catch {
-        pendingByDoc.set(doc.id, null);
+        pending = null;
       }
-    })
-  );
-  return c.json({
-    count: accessible.length,
-    nodes: accessible.map((doc) => {
-      const r = toNodeResponse(doc);
-      const pending = pendingByDoc.get(doc.id);
       if (pending) {
         r.pendingChange = pending;
         r.status = "external_edit_pending";
@@ -1706,48 +1216,43 @@ nodeRoutes.get("/", async (c) => {
       }
       return r;
     })
-  });
-});
-nodeRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.title || !body.content) {
-    throw new ValidationError("title and content are required");
-  }
-  const nestId = c.req.param("nestId");
+  );
+  return filters.limit ? enriched.slice(0, filters.limit) : enriched;
+}
+async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
+  return listNodesForCaller(nestId, userIdFromEmail(userEmail), filters);
+}
+async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = engineCache.get(nestId);
-  const slug = body.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   const id = `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const tags = body.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
+  const tags = (input.tags || []).map(normalizeTag2);
   const hasStewards = isStewardshipEnabled(nestId);
-  const initialStatus = hasStewards ? "draft" : "approved";
+  const initialStatus = hasStewards ? "draft" : "published";
   const initialVersion = hasStewards ? 1 : 0;
   let node = {
     id,
     filePath: "",
     frontmatter: {
-      title: body.title,
-      type: body.type || "document",
+      title: input.title,
+      type: input.type || "document",
       tags,
-      status: body.status || initialStatus,
+      status: input.status || initialStatus,
       version: initialVersion,
       created_at: now,
       updated_at: now,
-      metadata: {
-        owners: ["*"],
-        scope: body.scope || "team"
-      }
+      metadata: { owners: ["*"], scope: input.scope || "team" }
     },
-    body: body.content,
+    body: input.content,
     rawContent: ""
   };
-  const serialized = serializeDocument(node);
-  await storage.writeDocument(id, serialized);
+  await storage.writeDocument(id, serializeDocument(node));
   syncNodeTags(nestId, id, tags);
-  const authorEmail = getUserEmail(c);
+  let savedVersion = 1;
   if (hasStewards) {
     try {
-      await versionManager.createVersion(node, authorEmail);
+      await versionManager.createVersion(node, userEmail);
     } catch (err) {
       console.error("VersionManager.createVersion failed (node create)", err);
     }
@@ -1755,28 +1260,28 @@ nodeRoutes.post("/", async (c) => {
       nestId,
       nodeId: id,
       version: 1,
-      content: body.content,
-      author: authorEmail,
+      content: input.content,
+      author: userEmail,
       status: "draft",
       tags
     });
   } else {
     try {
       const result = await safePublishDocument(storage, id, {
-        editedBy: authorEmail,
+        editedBy: userEmail,
         note: "Auto-published on create (no stewards configured)"
       });
-      const publishedVersion = result.node.frontmatter.version || 2;
+      savedVersion = result.node.frontmatter.version || 1;
       createVersion({
         nestId,
         nodeId: id,
-        version: publishedVersion,
+        version: savedVersion,
         content: result.node.body || "",
-        author: authorEmail,
+        author: userEmail,
         status: "published",
         tags
       });
-      setApprovedVersion(nestId, id, publishedVersion, authorEmail);
+      setApprovedVersion(nestId, id, savedVersion, userEmail);
       node = result.node;
     } catch (err) {
       console.error("publishDocument failed (node create auto-publish)", err);
@@ -1784,15 +1289,486 @@ nodeRoutes.post("/", async (c) => {
         nestId,
         nodeId: id,
         version: 1,
-        content: body.content,
-        author: authorEmail,
+        content: input.content,
+        author: userEmail,
         status: "draft",
         tags
       });
     }
   }
   trackEvent("node.create", { nestId, nodeId: id });
-  const resolved = resolveStewardsForNode(nestId, id);
+  return { node, version: savedVersion };
+}
+async function registerImportedDocuments(nestId, userEmail) {
+  const { storage } = engineCache.get(nestId);
+  let docs;
+  try {
+    docs = await storage.discoverDocuments();
+  } catch (err) {
+    console.error("registerImportedDocuments: discovery failed", nestId, err);
+    return 0;
+  }
+  let registered = 0;
+  for (const doc of docs) {
+    const nodeId = doc.id;
+    if (getCurrentVersion(nestId, nodeId) > 0) continue;
+    const rawTags = Array.isArray(doc.frontmatter?.tags) ? doc.frontmatter.tags : [];
+    const tags = rawTags.map((t) => normalizeTag2(String(t)));
+    const fmVersion = Number(doc.frontmatter?.version);
+    let version = Number.isFinite(fmVersion) && fmVersion > 0 ? fmVersion : 1;
+    let content = doc.body || "";
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: userEmail,
+        note: "Imported from existing folder"
+      });
+      version = result.node.frontmatter.version || version;
+      content = result.node.body || content;
+    } catch (err) {
+      console.error("safePublishDocument failed (import register)", nodeId, err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version,
+      content,
+      author: userEmail,
+      status: "published",
+      changeNote: "Imported from existing folder",
+      tags
+    });
+    setApprovedVersion(nestId, nodeId, version, userEmail);
+    syncNodeTags(nestId, nodeId, tags);
+    registered++;
+  }
+  trackEvent("nest.import.documents", { nestId, registered });
+  return registered;
+}
+async function updateNode(nestId, nodeId, patch, userEmail) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  let node;
+  try {
+    node = await storage.readDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  if (patch.content !== void 0) {
+    node = { ...node, body: patch.content };
+  }
+  if (patch.append) {
+    node = { ...node, body: (node.body || "") + "\n\n" + patch.append };
+  }
+  if (patch.tags) {
+    const newTags = patch.tags.map(normalizeTag2);
+    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
+    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
+  }
+  if (patch.status) {
+    node = { ...node, frontmatter: { ...node.frontmatter, status: patch.status } };
+  }
+  if (patch.title) {
+    node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
+  }
+  const hasStewards = isStewardshipEnabled(nestId);
+  const currentTags = node.frontmatter.tags || [];
+  if (hasStewards && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
+    );
+  }
+  let responseVersion;
+  if (hasStewards) {
+    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const newVersion = currentVersion + 1;
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        version: newVersion,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        // Drop stale published-state checksum so the next verified read
+        // doesn't flag this write as external drift.
+        checksum: void 0
+      }
+    };
+    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    try {
+      await versionManager.createVersion(node, userEmail, { note: patch.changeNote });
+    } catch (err) {
+      console.error("VersionManager.createVersion failed (node patch)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: newVersion,
+      content: node.body || "",
+      author: userEmail,
+      status: "draft",
+      tags: currentTags,
+      changeNote: patch.changeNote
+    });
+    responseVersion = newVersion;
+  } else {
+    node = {
+      ...node,
+      frontmatter: {
+        ...node.frontmatter,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+        checksum: void 0
+      }
+    };
+    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+    await storage.writeDocument(nodeId, serializeDocument(node));
+    syncNodeTags(nestId, nodeId, currentTags);
+    let publishedVersion = (node.frontmatter.version || 0) + 1;
+    try {
+      const result = await safePublishDocument(storage, nodeId, {
+        editedBy: userEmail,
+        note: patch.changeNote || "Auto-published on edit (no stewards)"
+      });
+      publishedVersion = result.node.frontmatter.version || publishedVersion;
+      node = result.node;
+    } catch (err) {
+      console.error("publishDocument failed (node patch auto-publish)", err);
+    }
+    createVersion({
+      nestId,
+      nodeId,
+      version: publishedVersion,
+      content: node.body || "",
+      author: userEmail,
+      status: "published",
+      tags: currentTags,
+      changeNote: patch.changeNote
+    });
+    setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
+    responseVersion = publishedVersion;
+  }
+  return { node, version: responseVersion };
+}
+
+// src/nests/routes.ts
+function effectivePermission(nestId, userId) {
+  if (config.AUTH_MODE === "open") {
+    const db = getDb();
+    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+    if (nest && nest.user_id === ANON_USER_ID) return "owner";
+  }
+  return resolveNestPermission(nestId, userId);
+}
+var nestRoutes = new Hono2();
+nestRoutes.get("/", async (c) => {
+  const userId = c.get("userId");
+  const owned = listNests(userId);
+  const shared = listSharedNests(userId);
+  const publicExtras = listPublicNests(userId);
+  const db = getDb();
+  const ownerEmailStmt = db.prepare(
+    "SELECT email FROM users WHERE id = ?"
+  );
+  const callerEmail = resolveCallerEmail(userId);
+  const annotate = (n) => {
+    const permission = effectivePermission(n.id, userId);
+    const is_owner = permission === "owner";
+    let owner_email = null;
+    const roles = is_owner ? ["owner"] : resolveUserRoles(n.id, callerEmail);
+    if (!is_owner && n.user_id !== ANON_USER_ID) {
+      const row = ownerEmailStmt.get(n.user_id);
+      owner_email = row?.email ?? null;
+    }
+    return { ...n, permission, is_owner, owner_email, roles };
+  };
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (seen.has(n.id)) continue;
+    seen.add(n.id);
+    out.push(annotate(n));
+  }
+  return c.json({ nests: out });
+});
+nestRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.name) {
+    throw new ValidationError("name is required");
+  }
+  const nest = await createNest(c.get("userId"), body.name, body.description);
+  return c.json({ nest }, 201);
+});
+nestRoutes.post("/import", async (c) => {
+  const body = await c.req.json();
+  if (!body.name) {
+    throw new ValidationError("name is required");
+  }
+  const files = Array.isArray(body.files) ? body.files : [];
+  const userId = c.get("userId");
+  const nest = await importNest(userId, body.name, files);
+  const documents = await registerImportedDocuments(
+    nest.id,
+    resolveCallerEmail(userId)
+  );
+  return c.json({ nest, documents }, 201);
+});
+nestRoutes.get("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const permission = effectivePermission(nestId, userId);
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  const email = resolveCallerEmail(userId);
+  let roles = resolveUserRoles(nestId, email);
+  if (permission === "owner" && !roles.includes("owner")) {
+    roles = ["owner", ...roles];
+  }
+  const myStewards = getStewardsForUser(nestId, email);
+  const nest = getNest(nestId);
+  return c.json({ nest, permission, roles, myStewards });
+});
+nestRoutes.delete("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nest = getNest(nestId);
+  if (!nest) {
+    throw new NotFoundError("Nest not found");
+  }
+  const permission = effectivePermission(nestId, userId);
+  const isAnonOwned = nest.user_id === ANON_USER_ID;
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  if (permission !== "owner" && !adminCaretaker) {
+    throw new ForbiddenError(
+      "You don't have permission to delete this nest. Only the nest owner can delete it."
+    );
+  }
+  await deleteNest(nestId);
+  return c.json({ deleted: true });
+});
+nestRoutes.get("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const permission = effectivePermission(nestId, c.get("userId"));
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  return c.json({
+    stewardship_enabled: isStewardshipEnabled(nestId),
+    allow_self_approve: nestAllowsSelfApprove(nestId)
+  });
+});
+nestRoutes.patch("/:nestId/settings", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const isServerAdmin = isLicenseAdminUserId(userId);
+  const permission = effectivePermission(nestId, userId);
+  if (!isServerAdmin && permission !== "owner") {
+    return c.json(
+      {
+        error: "Only the nest owner or the server license-admin can update nest settings."
+      },
+      403
+    );
+  }
+  const body = await c.req.json();
+  let wiped = null;
+  if (typeof body.stewardship_enabled === "boolean") {
+    if (body.stewardship_enabled) {
+      setStewardshipEnabled(nestId, true);
+    } else {
+      wiped = disableStewardshipAndWipeGovernance(nestId);
+    }
+  }
+  if (typeof body.allow_self_approve === "boolean") {
+    setAllowSelfApprove(nestId, body.allow_self_approve);
+  }
+  return c.json({
+    stewardship_enabled: isStewardshipEnabled(nestId),
+    allow_self_approve: nestAllowsSelfApprove(nestId),
+    wiped
+  });
+});
+
+// src/nests/sharing-routes.ts
+import { Hono as Hono3 } from "hono";
+
+// src/nests/sharing-service.ts
+import { v4 as uuid2 } from "uuid";
+var VALID_PERMISSIONS = ["read", "write", "admin"];
+async function addCollaborator(params) {
+  const { nestId } = params;
+  if (!params.permission || !VALID_PERMISSIONS.includes(params.permission)) {
+    throw new ValidationError("permission must be read, write, or admin");
+  }
+  const db = getDb();
+  let userId = params.userId;
+  if (!userId && params.email) {
+    const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(params.email);
+    if (existing) {
+      userId = existing.id;
+    } else {
+      const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
+      userId = uuid2();
+      db.prepare(
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
+      ).run(userId, params.email, null, await hashPassword2(uuid2()));
+    }
+  }
+  if (!userId) {
+    throw new ValidationError("user_id or email is required");
+  }
+  const ownerRow = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+  if (!ownerRow) {
+    throw new ValidationError("Nest not found");
+  }
+  if (ownerRow.user_id === userId) {
+    throw new ValidationError(
+      "The nest owner already has full access and can't be added as a collaborator."
+    );
+  }
+  const selfByEmail = !!params.email && !!params.grantedByEmail && params.email.trim().toLowerCase() === params.grantedByEmail.trim().toLowerCase();
+  const selfById = !!params.grantedByUserId && params.grantedByUserId === userId;
+  if (selfByEmail || selfById) {
+    throw new ValidationError("You can't add yourself as a collaborator.");
+  }
+  const dupe = db.prepare("SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?").get(nestId, userId);
+  if (dupe) {
+    throw new ConflictError(
+      `${params.email || "This user"} already has access to this nest. Change their permission instead of adding them again.`
+    );
+  }
+  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(params.grantedByEmail)?.id : void 0;
+  const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
+  const collabId = uuid2();
+  db.prepare(
+    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
+  ).run(collabId, nestId, userId, params.permission, granterId);
+  return db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+}
+
+// src/nests/sharing-routes.ts
+var sharingRoutes = new Hono3();
+sharingRoutes.get("/collaborators", async (c) => {
+  const db = getDb();
+  const nestId = c.req.param("nestId");
+  const collabs = db.prepare(
+    `SELECT nc.*, u.email FROM nest_collaborators nc
+       LEFT JOIN users u ON nc.user_id = u.id
+       WHERE nc.nest_id = ?
+       ORDER BY nc.granted_at`
+  ).all(nestId);
+  const enriched = collabs.map((collab) => {
+    if (!collab.email) return { ...collab, stewardRoles: [], roles: [] };
+    return {
+      ...collab,
+      stewardRoles: getStewardRolesForUser(nestId, collab.email),
+      roles: resolveUserRoles(nestId, collab.email)
+    };
+  });
+  return c.json({ collaborators: enriched });
+});
+sharingRoutes.post("/collaborators", async (c) => {
+  const body = await c.req.json();
+  const collab = await addCollaborator({
+    nestId: c.req.param("nestId"),
+    email: body.email,
+    userId: body.user_id,
+    permission: body.permission ?? "",
+    grantedByUserId: c.get("userId")
+  });
+  return c.json({ collaborator: collab }, 201);
+});
+sharingRoutes.patch("/collaborators/:collabId", async (c) => {
+  const body = await c.req.json();
+  if (!body.permission || !["read", "write", "admin"].includes(body.permission)) {
+    throw new ValidationError("permission must be read, write, or admin");
+  }
+  const db = getDb();
+  db.prepare("UPDATE nest_collaborators SET permission = ? WHERE id = ?").run(
+    body.permission,
+    c.req.param("collabId")
+  );
+  return c.json({ updated: true });
+});
+sharingRoutes.delete("/collaborators/:collabId", async (c) => {
+  const db = getDb();
+  db.prepare("DELETE FROM nest_collaborators WHERE id = ?").run(
+    c.req.param("collabId")
+  );
+  return c.json({ removed: true });
+});
+sharingRoutes.patch("/visibility", async (c) => {
+  const body = await c.req.json();
+  if (!body.visibility || !["private", "public"].includes(body.visibility)) {
+    throw new ValidationError("visibility must be private or public");
+  }
+  const db = getDb();
+  db.prepare("UPDATE nests SET visibility = ? WHERE id = ?").run(
+    body.visibility,
+    c.req.param("nestId")
+  );
+  return c.json({ visibility: body.visibility });
+});
+
+// src/nodes/routes.ts
+import { Hono as Hono4 } from "hono";
+
+// src/nodes/markdown-export.ts
+function nodeToMarkdown(node) {
+  const tags = node.tags ?? [];
+  return [
+    "---",
+    `title: ${JSON.stringify(node.title ?? "")}`,
+    `tags: [${tags.map((t) => JSON.stringify(t)).join(", ")}]`,
+    `status: ${JSON.stringify(node.status ?? "")}`,
+    `id: ${JSON.stringify(node.id)}`,
+    "---",
+    ""
+  ].join("\n") + (node.body ?? "");
+}
+function nodesToMarkdown(nodes) {
+  return nodes.map(nodeToMarkdown).join("\n\n---\n\n");
+}
+function isMarkdownFormat(c) {
+  return c.req.query("format") === "markdown";
+}
+
+// src/nodes/routes.ts
+var nodeRoutes = new Hono4();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
+  });
+}
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nodes = await listNodesForCaller(nestId, userId);
+  return c.json({ count: nodes.length, nodes });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
+  }
+  const nestId = c.req.param("nestId");
+  const authorEmail = getUserEmail(c);
+  const { node } = await createNode(
+    nestId,
+    {
+      title: body.title,
+      content: body.content,
+      type: body.type,
+      tags: body.tags,
+      scope: body.scope,
+      status: body.status
+    },
+    authorEmail
+  );
+  const resolved = resolveStewardsForNode(nestId, node.id);
   return c.json({
     node: toNodeResponse(node),
     stewards: resolved.length > 0 ? resolved.map((r) => ({
@@ -1805,7 +1781,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-C5D2O7ZE.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VOD5HY3I.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1826,7 +1802,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-TFEYNPH7.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1857,16 +1833,52 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-4WS3XL6K.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GYX3AW6E.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
+  try {
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+  } catch {
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
+  }
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  if (!canReadNode(nestId, nodeId, userEmail)) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json(
       { error: "Access denied \u2014 no steward assignment for this node" },
       403
@@ -1886,15 +1898,59 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     } catch (err) {
       console.error("[external-edit] stage-on-read failed:", err);
     }
+    try {
+      const latest = await loadLatestApprovedNode(nestId, nodeId);
+      if (latest) {
+        node = { ...latest, pendingChange: node.pendingChange };
+      }
+    } catch (err) {
+      console.error("[external-edit] reconstruct-latest failed:", err);
+    }
   }
   const response = toNodeResponse(node);
+  if (isPublicReader(nestId, userId)) {
+    const approved = getApprovedVersion(nestId, nodeId);
+    if (approved != null) {
+      try {
+        const raw = await versionManager.reconstructVersion(
+          nodeId,
+          approved
+        );
+        response.content = bodyOnly(nodeId, raw);
+      } catch (err) {
+        console.error(
+          "reconstructVersion failed (public single)",
+          nodeId,
+          approved,
+          err
+        );
+        response.content = "";
+      }
+      response.version = approved;
+      response.status = "published";
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
+      }
+      return c.json({ node: response });
+    }
+  }
   response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
+  if (response.status === "pending_review") {
+    const pending = getPendingReview(nestId, nodeId);
+    response.pendingReviewBy = pending?.requestedBy ?? null;
+  }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
   return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = engineCache.get(nestId);
   const body = await c.req.json();
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
@@ -1914,133 +1970,31 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       );
     }
   }
-  let node;
-  try {
-    node = await storage.readDocument(nodeId);
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  if (body.content !== void 0) {
-    node = { ...node, body: body.content };
-  }
-  if (body.append) {
-    node = { ...node, body: (node.body || "") + "\n\n" + body.append };
-  }
-  if (body.tags) {
-    const newTags = body.tags.map((t) => t.startsWith("#") ? t : `#${t}`);
-    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
-    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
-  }
-  if (body.status) {
-    node = {
-      ...node,
-      frontmatter: { ...node.frontmatter, status: body.status }
-    };
-  }
-  if (body.title) {
-    node = {
-      ...node,
-      frontmatter: { ...node.frontmatter, title: body.title }
-    };
-  }
   const authorEmail = getUserEmail(c);
-  const hasStewards = isStewardshipEnabled(nestId);
-  const currentTags = node.frontmatter.tags || [];
-  const { cancelReview: cancelReview2, getPendingReview: getPendingReview2 } = await import("./review-service-4WS3XL6K.js");
-  if (getPendingReview2(nestId, nodeId)) {
-    cancelReview2({ nestId, nodeId, cancelledBy: authorEmail });
-  }
-  let responseVersion;
-  if (hasStewards) {
-    const currentVersion = getCurrentVersion(nestId, nodeId);
-    const newVersion = currentVersion + 1;
-    node = {
-      ...node,
-      frontmatter: {
-        ...node.frontmatter,
-        version: newVersion,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        // Strip the stale published-state checksum — the body just
-        // changed, so leaving the old hash would make the next GET (with
-        // verifyChecksum: true) flag the file as an external edit even
-        // though *this* app wrote it. Engine treats absent checksum as
-        // "no baseline" and skips drift detection until publish runs.
-        checksum: void 0
-      }
-    };
-    const fm = Object.fromEntries(
-      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
-    );
-    node = { ...node, frontmatter: fm };
-    await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
-    try {
-      await versionManager.createVersion(node, authorEmail, {
-        note: body.changeNote
-      });
-    } catch (err) {
-      console.error("VersionManager.createVersion failed (node patch)", err);
-    }
-    createVersion({
-      nestId,
-      nodeId,
-      version: newVersion,
-      content: node.body || "",
-      author: authorEmail,
-      status: "draft",
-      tags: currentTags,
-      changeNote: body.changeNote
-    });
-    responseVersion = newVersion;
-  } else {
-    node = {
-      ...node,
-      frontmatter: {
-        ...node.frontmatter,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        // Drop the prior published-state checksum before the interim
-        // write — publish recomputes it from the new body, but if
-        // publish errors out the file would otherwise be left with new
-        // body + stale checksum and drift on next read.
-        checksum: void 0
-      }
-    };
-    const fm = Object.fromEntries(
-      Object.entries(node.frontmatter).filter(([, v]) => v !== void 0)
-    );
-    node = { ...node, frontmatter: fm };
-    await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
-    let publishedVersion = (node.frontmatter.version || 0) + 1;
-    try {
-      const result = await safePublishDocument(storage, nodeId, {
-        editedBy: authorEmail,
-        note: body.changeNote || "Auto-published on edit (no stewards)"
-      });
-      publishedVersion = result.node.frontmatter.version || publishedVersion;
-      node = result.node;
-    } catch (err) {
-      console.error("publishDocument failed (node patch auto-publish)", err);
-    }
-    createVersion({
-      nestId,
-      nodeId,
-      version: publishedVersion,
-      content: node.body || "",
-      author: authorEmail,
-      status: "published",
-      tags: currentTags,
+  const { node, version: responseVersion } = await updateNode(
+    nestId,
+    nodeId,
+    {
+      content: body.content,
+      append: body.append,
+      tags: body.tags,
+      title: body.title,
+      status: body.status,
       changeNote: body.changeNote
-    });
-    setApprovedVersion(nestId, nodeId, publishedVersion, authorEmail);
-    responseVersion = publishedVersion;
-  }
+    },
+    authorEmail
+  );
   return c.json({ node: toNodeResponse(node), version: responseVersion });
 });
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const { storage } = engineCache.get(nestId);
+  if (isStewardshipEnabled(nestId) && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
+    );
+  }
   try {
     await storage.deleteDocument(nodeId);
   } catch {
@@ -2058,6 +2012,10 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
     db.prepare(
       "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
     ).run(nestId, nodeId);
+    db.prepare(
+      `DELETE FROM stewards
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`
+    ).run(nestId, nodeId);
   })();
   trackEvent("node.delete", { nestId, nodeId });
   return c.json({ deleted: true });
@@ -2262,6 +2220,32 @@ function compilePrompt(prompt, nestId, titles) {
   };
 }
 
+// src/nodes/readable-body.ts
+async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
+  if (!isPublicReader(nestId, userId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return "";
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return "";
+  }
+}
+async function resolveExportBody(nestId, nodeId, workingBody) {
+  if (!isStewardshipEnabled(nestId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return null;
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return null;
+  }
+}
+
 // src/nodes/query-routes.ts
 var queryRoutes = new Hono5();
 function approxTokens(text) {
@@ -2327,13 +2311,20 @@ queryRoutes.post("/context", async (c) => {
       }
     }
   }
-  const userEmail = resolveCallerEmail(c.get("userId"));
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
   const beforePermission = documents.length;
-  const accessible = filterAccessible(nestId, userEmail, documents);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
+  const readable = await Promise.all(
+    accessible.map(async (doc) => ({
+      ...doc,
+      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || "")
+    }))
+  );
   const included = [];
   let tokenCount = 0;
-  for (const doc of accessible) {
+  for (const doc of readable) {
     const block = formatContextBlock(doc);
     const blockTokens = approxTokens(block);
     if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
@@ -2386,8 +2377,9 @@ queryRoutes.post("/query", async (c) => {
   const result = await queryEngine.query(body.query, {
     hops: body.hops ?? 2
   });
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, result.documents);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, result.documents);
   return c.json({
     query: body.query,
     count: accessible.length,
@@ -2418,8 +2410,9 @@ queryRoutes.get("/search", async (c) => {
     ].join(" ").toLowerCase();
     return terms.every((term) => haystack.includes(term));
   });
-  const userEmail = resolveCallerEmail(c.get("userId"));
-  const accessible = filterAccessible(nestId, userEmail, matches);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
@@ -2462,6 +2455,64 @@ queryRoutes.get("/context", async (c) => {
   const content = await storage.readContextMd();
   return c.json({ content: content || "" });
 });
+queryRoutes.get("/export", async (c) => {
+  if (!isMarkdownFormat(c)) {
+    throw new ValidationError("format=markdown is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage, query: queryEngine } = engineCache.get(nestId);
+  const selector = c.req.query("selector")?.trim() || null;
+  let documents;
+  if (selector) {
+    const result = await queryEngine.query(selector, { hops: 2, full: true });
+    documents = result.documents;
+  } else {
+    documents = await storage.discoverDocuments();
+  }
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const governed = isStewardshipEnabled(nestId);
+  const resolved = await Promise.all(
+    accessible.map(async (n) => {
+      const body = await resolveExportBody(nestId, n.id, n.body || "");
+      if (body == null) return null;
+      return {
+        id: n.id,
+        title: n.frontmatter.title,
+        tags: n.frontmatter.tags || [],
+        status: governed ? "published" : n.frontmatter.status,
+        body
+      };
+    })
+  );
+  const fields = resolved.filter(
+    (f) => f != null
+  );
+  const maxParam = parseInt(c.req.query("max_tokens") ?? "", 10);
+  const maxTokens = Number.isFinite(maxParam) && maxParam > 0 ? maxParam : null;
+  let included = fields;
+  if (maxTokens) {
+    const kept = [];
+    let tokens = 0;
+    for (const f of fields) {
+      const t = approxTokens(nodeToMarkdown(f));
+      if (tokens + t > maxTokens && kept.length > 0) break;
+      kept.push(f);
+      tokens += t;
+    }
+    included = kept;
+  }
+  trackEvent("nest.export", {
+    nestId,
+    count: included.length,
+    selector,
+    truncated_by_budget: fields.length - included.length
+  });
+  return c.body(nodesToMarkdown(included), 200, {
+    "Content-Type": "text/markdown; charset=utf-8"
+  });
+});
 queryRoutes.post("/publish", async (c) => {
   const body = await c.req.json();
   if (!body.documents?.length && !body.context_md) {
@@ -2520,7 +2571,6 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 // src/mcp/tools.ts
-import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
 var TOOL_DEFINITIONS = [
   {
     name: "context_init",
@@ -2733,6 +2783,21 @@ var TOOL_DEFINITIONS = [
       },
       required: ["email", "scope"]
     }
+  },
+  {
+    name: "context_share_nest",
+    description: "Share this nest with another person by granting them access. This is plain access sharing (not a steward role): viewer = read, editor = read+edit, admin = full access except deleting the nest.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        email: { type: "string", description: "Email of the person to share with" },
+        permission: {
+          type: "string",
+          description: "Access level: read (viewer, default), write (editor), or admin"
+        }
+      },
+      required: ["email"]
+    }
   }
 ];
 async function resolveLlmBody(ctx, node) {
@@ -2848,24 +2913,14 @@ ${list}`;
 ${body || "(no content)"}`;
     }
     case "context_list": {
-      let docs = await storage.discoverDocuments();
-      if (args.type)
-        docs = docs.filter((n) => n.frontmatter.type === args.type);
-      if (args.tag) {
-        const tag = args.tag.startsWith("#") ? args.tag : `#${args.tag}`;
-        docs = docs.filter((n) => n.frontmatter.tags?.includes(tag));
-      }
-      if (isStewardshipEnabled(nestId)) {
-        docs = docs.filter(
-          (n) => getApprovedVersion(nestId, n.id) != null
-        );
-      }
-      docs = docs.slice(0, args.limit || 50);
-      if (!docs.length) return "No nodes found with the given filters.";
-      const list = docs.map(
-        (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}]`
-      ).join("\n");
-      return `${docs.length} node(s):
+      const nodes = await listNodesForCallerByEmail(nestId, userEmail, {
+        type: args.type,
+        tag: args.tag,
+        limit: args.limit || 50
+      });
+      if (!nodes.length) return "No nodes found with the given filters.";
+      const list = nodes.map((n, i) => `${i + 1}. **${n.title}** [${n.type}]`).join("\n");
+      return `${nodes.length} node(s):
 
 ${list}`;
     }
@@ -2886,50 +2941,21 @@ ${n.body || ""}`;
       return resolved.join("\n\n---\n\n") || "No nodes resolved.";
     }
     case "context_create": {
-      const slug = args.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-      const id = `nodes/${slug}`;
-      const now = (/* @__PURE__ */ new Date()).toISOString();
-      const tags = (args.tags || []).map(
-        (t) => t.startsWith("#") ? t : `#${t}`
-      );
-      const hasStewards = isStewardshipEnabled(nestId);
-      const initialStatus = hasStewards ? "draft" : "approved";
-      const node = {
-        id,
-        filePath: "",
-        frontmatter: {
-          title: args.title,
-          type: args.type || "document",
-          tags,
-          status: initialStatus,
-          version: 1,
-          created_at: now,
-          updated_at: now,
-          metadata: { owners: ["*"], scope: args.scope || "team" }
-        },
-        body: args.content,
-        rawContent: ""
-      };
-      await storage.writeDocument(id, serializeDocument3(node));
-      syncNodeTags(nestId, id, tags);
-      try {
-        await versionManager.createVersion(node, userEmail);
-      } catch (err) {
-        console.error("VersionManager.createVersion failed (mcp create)", err);
+      if (!canCreateInNest(nestId, userEmail)) {
+        return "You don't have permission to create documents in this nest.";
       }
-      createVersion({
+      const { node } = await createNode(
         nestId,
-        nodeId: id,
-        version: 1,
-        content: args.content,
-        author: userEmail,
-        status: initialStatus,
-        tags
-      });
-      if (initialStatus === "approved") {
-        setApprovedVersion(nestId, id, 1, userEmail);
-      }
-      return `Created node: **${args.title}** (${id}) \u2014 status: ${initialStatus}`;
+        {
+          title: args.title,
+          content: args.content,
+          type: args.type,
+          tags: args.tags,
+          scope: args.scope
+        },
+        userEmail
+      );
+      return `Created node: **${args.title}** (${node.id}) \u2014 status: ${node.frontmatter.status}`;
     }
     case "context_update": {
       const docs = await storage.discoverDocuments();
@@ -2937,56 +2963,21 @@ ${n.body || ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      let body = node.body || "";
-      if (args.content !== void 0) body = args.content;
-      if (args.append) body = body + "\n\n" + args.append;
-      let tags = node.frontmatter.tags || [];
-      if (args.tags) {
-        const newTags = args.tags.map(
-          (t) => t.startsWith("#") ? t : `#${t}`
-        );
-        tags = [.../* @__PURE__ */ new Set([...tags, ...newTags])];
-      }
-      const prevVersion = getCurrentVersion(nestId, node.id);
-      const newVersion = prevVersion + 1;
-      const hasStewards = isStewardshipEnabled(nestId);
-      const updated = {
-        ...node,
-        body,
-        frontmatter: {
-          ...node.frontmatter,
-          tags,
-          version: newVersion,
-          updated_at: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      };
-      await storage.writeDocument(node.id, serializeDocument3(updated));
-      try {
-        await versionManager.createVersion(updated, userEmail);
-      } catch (err) {
-        console.error("VersionManager.createVersion failed (mcp update)", err);
+      const editCheck = canUserEdit(nestId, node.id, userEmail);
+      if (!editCheck.allowed) {
+        return `You don't have permission to edit "${args.title}": ${editCheck.reason}`;
       }
-      syncNodeTags(nestId, node.id, tags);
-      createVersion({
+      const { node: updated } = await updateNode(
         nestId,
-        nodeId: node.id,
-        version: newVersion,
-        content: body,
-        author: userEmail,
-        status: hasStewards ? "draft" : "approved",
-        tags
-      });
-      if (getPendingReview(nestId, node.id)) {
-        cancelReview({
-          nestId,
-          nodeId: node.id,
-          cancelledBy: userEmail
-        });
-      }
-      if (!hasStewards) {
-        setApprovedVersion(nestId, node.id, newVersion, userEmail);
-      }
-      return `Updated node: **${node.frontmatter.title}**`;
+        node.id,
+        {
+          content: args.content,
+          append: args.append,
+          tags: args.tags
+        },
+        userEmail
+      );
+      return `Updated node: **${updated.frontmatter.title}**`;
     }
     // ─── Governance Tool Handlers ──────────────────────────────────────
     case "context_stewards": {
@@ -3007,13 +2998,16 @@ ${n.body || ""}`;
 
 ${list}`;
       }
-      const allStewards = getStewardsForNest(ctx.nestId);
+      if (!canManageStewards(ctx.userEmail)) {
+        return "You don't have permission to list stewards. Only the super admin can do this.";
+      }
+      const allStewards = await getStewardsForNest(ctx.nestId);
       if (allStewards.length === 0) {
         return "No stewards configured. All changes are auto-approved.\n\nTo configure stewards, add a `stewards.yaml` file to the vault root, or use `context_assign_steward`.";
       }
       const byScope = {};
       for (const s of allStewards) {
-        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodePattern}`;
+        const key = s.scope === "nest" ? "Nest-level" : s.scope === "tag" ? `Tag: ${s.tagName}` : `Document: ${s.nodeTitle || s.nodePattern}`;
         (byScope[key] = byScope[key] || []).push(s);
       }
       const sections = Object.entries(byScope).map(
@@ -3026,7 +3020,7 @@ ${sections}`;
     }
     case "context_review_queue": {
       const status = args.status || "pending";
-      const result = getReviewQueue({
+      const result = await getReviewQueue({
         nestId: ctx.nestId,
         status
       });
@@ -3034,7 +3028,7 @@ ${sections}`;
         return status === "pending" ? "No documents pending review. All caught up!" : `No reviews with status "${status}".`;
       }
       const list = result.requests.map(
-        (r, i) => `${i + 1}. **${r.nodeId}** v${r.version} \u2014 ${r.priority} priority
+        (r, i) => `${i + 1}. **${r.title || r.nodeId}** v${r.version} \u2014 ${r.priority} priority
    Submitted by: ${r.requestedBy} at ${r.requestedAt}${r.requestNote ? `
    Note: "${r.requestNote}"` : ""}`
       ).join("\n\n");
@@ -3049,6 +3043,10 @@ ${list}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
+      const submitCheck = canUserEdit(ctx.nestId, node.id, userEmail);
+      if (!submitCheck.allowed) {
+        return `You don't have permission to submit "${args.title}" for review: ${submitCheck.reason}`;
+      }
       const currentVersion = getCurrentVersion(ctx.nestId, node.id);
       if (currentVersion === 0) return `No versions found for "${args.title}"`;
       try {
@@ -3139,17 +3137,17 @@ ${list}`;
       if (!["nest", "tag", "document"].includes(scope)) {
         return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
       }
+      if (!canManageStewards(ctx.userEmail)) {
+        return "You don't have permission to manage stewards. Only the super admin can do this.";
+      }
       try {
-        assignSteward({
+        await createStewardRecord({
           nestId: ctx.nestId,
           scope,
-          nodePattern: scope === "document" ? args.target : void 0,
+          documentId: scope === "document" ? args.target : void 0,
           tagName: scope === "tag" ? args.target : void 0,
-          userEmail: args.email,
-          role: args.role || "reviewer",
-          assignedBy: ctx.userEmail,
-          assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          isActive: true
+          users: [{ email: args.email, role: args.role || "reviewer" }],
+          assignedBy: ctx.userEmail
         });
         const targetDesc = scope === "nest" ? "all documents" : `${scope}: ${args.target}`;
         return `Assigned **${args.email}** as ${args.role || "reviewer"} for ${targetDesc}.`;
@@ -3157,6 +3155,25 @@ ${list}`;
         return `Failed to assign steward: ${err.message}`;
       }
     }
+    case "context_share_nest": {
+      const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
+      if (!canManageWith(roles)) {
+        return "You don't have permission to share this nest. Only the nest owner or an admin can add people.";
+      }
+      const permission = args.permission || "read";
+      try {
+        await addCollaborator({
+          nestId: ctx.nestId,
+          email: args.email,
+          permission,
+          grantedByEmail: ctx.userEmail
+        });
+        const label = permission === "admin" ? "admin" : permission === "write" ? "editor" : "viewer";
+        return `Shared this nest with **${args.email}** as ${label}.`;
+      } catch (err) {
+        return `Failed to share nest: ${err.message}`;
+      }
+    }
     default:
       return `Unknown tool: ${toolName}`;
   }
@@ -3225,8 +3242,8 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync, existsSync } from "fs";
+import { join as join2 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -3291,15 +3308,15 @@ function parseEntry(str) {
 }
 function loadStewardsConfig(nestId) {
   const dataRoot = config.DATA_ROOT;
-  const nestPath2 = join3(dataRoot, "nests", nestId);
+  const nestPath = join2(dataRoot, "nests", nestId);
   const candidates = [
-    join3(nestPath2, "stewards.yaml"),
-    join3(nestPath2, "stewards.yml"),
-    join3(nestPath2, ".context", "stewards.yaml")
+    join2(nestPath, "stewards.yaml"),
+    join2(nestPath, "stewards.yml"),
+    join2(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
-    if (existsSync2(candidatePath)) {
-      const content = readFileSync2(candidatePath, "utf-8");
+    if (existsSync(candidatePath)) {
+      const content = readFileSync(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -3312,12 +3329,25 @@ governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
   const search = c.req.query("search");
-  const stewards = listStewards({
+  const stewards = await listStewards({
     nestId,
     scope: scope || void 0,
     search: search || void 0
   });
-  return c.json({ stewards });
+  const cache = /* @__PURE__ */ new Map();
+  const enriched = stewards.map((s) => {
+    const key = s.userEmail.toLowerCase();
+    let merged = cache.get(key);
+    if (!merged) {
+      merged = {
+        collaboratorRole: getCollaboratorRole(nestId, s.userEmail),
+        roles: resolveUserRoles(nestId, s.userEmail)
+      };
+      cache.set(key, merged);
+    }
+    return { ...s, ...merged };
+  });
+  return c.json({ stewards: enriched });
 });
 governanceRoutes.post("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3358,6 +3388,20 @@ governanceRoutes.post("/stewards", async (c) => {
   });
   return c.json({ steward: created[0] }, 201);
 });
+governanceRoutes.patch("/stewards/:stewardId", async (c) => {
+  const stewardId = c.req.param("stewardId");
+  const body = await c.req.json();
+  if (!body.role && !body.scope) {
+    throw new ValidationError("role or scope is required");
+  }
+  const steward = updateSteward(stewardId, {
+    role: body.role,
+    scope: body.scope,
+    documentId: body.nodePattern,
+    tagName: body.tagName
+  });
+  return c.json({ steward });
+});
 governanceRoutes.delete("/stewards/:stewardId", async (c) => {
   const stewardId = c.req.param("stewardId");
   removeSteward(stewardId);
@@ -3377,7 +3421,7 @@ governanceRoutes.get("/review-queue", async (c) => {
   const status = c.req.query("status") || "pending";
   const limit = parseInt(c.req.query("limit") || "50", 10);
   const offset = parseInt(c.req.query("offset") || "0", 10);
-  const result = getReviewQueue({
+  const result = await getReviewQueue({
     nestId,
     status,
     limit,
@@ -3423,8 +3467,19 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nodeId = c.req.param("nodeId");
   const allVersions = getVersions(nestId, nodeId);
   const approved = getApprovedVersion(nestId, nodeId);
+  const { versions: versionManager } = engineCache.get(nestId);
+  const withContent = await Promise.all(
+    allVersions.map(async (v) => {
+      try {
+        const raw = await versionManager.reconstructVersion(nodeId, v.version);
+        return { ...v, content: bodyOnly(nodeId, raw) };
+      } catch {
+        return v;
+      }
+    })
+  );
   return c.json({
-    versions: allVersions,
+    versions: withContent,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
@@ -3652,14 +3707,14 @@ function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join4, relative } from "path";
-import { existsSync as existsSync3 } from "fs";
+import { dirname, join as join3, relative } from "path";
+import { existsSync as existsSync2 } from "fs";
 var HERE = dirname(fileURLToPath(import.meta.url));
 var UI_DIR_CANDIDATES = [
-  join4(HERE, "web3"),
-  join4(process.cwd(), "dist", "web3")
+  join3(HERE, "web3"),
+  join3(process.cwd(), "dist", "web3")
 ];
-var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync3(p)) || UI_DIR_CANDIDATES[0];
+var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
@@ -3667,6 +3722,11 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
   c.set("nestScope", null);
   await next();
 });
+function isPublicReadEligiblePath(method, path) {
+  if (method !== "GET") return false;
+  if (!/^\/nests\/[^/]+(\/.*)?$/.test(path)) return false;
+  return !/\/(collaborators|visibility|settings|mcp)/.test(path);
+}
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
   const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
@@ -3679,6 +3739,12 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     c.set("nestScope", null);
     return next();
   }
+  if (isPublicReadEligiblePath(c.req.method, c.req.path)) {
+    const anonId = ensureAnonymousUser();
+    c.set("userId", anonId);
+    c.set("nestScope", null);
+    return next();
+  }
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
@@ -3710,6 +3776,8 @@ function createApp() {
       service: "contextnest-community",
       version: "0.1.0",
       auth_mode: config.AUTH_MODE,
+      logo_url: config.LOGO_URL,
+      promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
@@ -3797,7 +3865,7 @@ function createApp() {
       try {
         const { storage } = engineCache.get(nest.id);
         const docs = await storage.discoverDocuments();
-        documents += filterAccessible(nest.id, userEmail, docs).length;
+        documents += filterAccessible(nest.id, userId, userEmail, docs).length;
       } catch {
       }
     }
@@ -3859,12 +3927,44 @@ function createApp() {
     let required = "read";
     const path = c.req.path;
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
+    const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
+    if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
+      return c.json(
+        {
+          error: "You don't have permission to manage stewards. Only the super admin can do this."
+        },
+        403
+      );
+    }
     if (path.includes("/collaborators") || path.includes("/visibility")) {
       required = "admin";
     } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
-    if (permissionLevel(permission) < permissionLevel(required)) {
+    const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
+    let stewardEditorBypass = false;
+    if (required === "write" && permission === "read" && parts[1] === "nodes") {
+      const userEmail = resolveCallerEmail(userId);
+      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
+        const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
+        const rawNodeId = idParts.join("/");
+        let nodeId = rawNodeId;
+        try {
+          nodeId = decodeURIComponent(rawNodeId);
+        } catch {
+        }
+        const resolved = resolveStewardsForNode(nestId, nodeId);
+        stewardEditorBypass = resolved.some(
+          (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor"
+        );
+      } else if (parts.length === 2 && c.req.method === "POST") {
+        const resolved = resolveStewardsForNode(nestId, "");
+        stewardEditorBypass = resolved.some(
+          (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && r.steward.scope === "nest"
+        );
+      }
+    }
+    if (!stewardEditorBypass && permissionLevel(permission) < permissionLevel(required)) {
       return c.json(
         {
           error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
@@ -3964,8 +4064,8 @@ function createApp() {
 }
 
 // src/db/backfill.ts
-import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
-import { join as join5 } from "path";
+import { NestStorage } from "@promptowl/contextnest-engine";
+import { join as join4 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
   const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
@@ -3986,8 +4086,8 @@ async function backfillNodeVersionsFromHistory(db) {
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath2 = join5(config.DATA_ROOT, "nests", nestId);
-    const storage = new NestStorage2(nestPath2);
+    const nestPath = join4(config.DATA_ROOT, "nests", nestId);
+    const storage = new NestStorage(nestPath);
     let docs;
     try {
       docs = await storage.discoverDocuments();
@@ -4085,7 +4185,6 @@ async function main() {
 `);
   }
   const app = createApp();
-  startLicenseWatcher();
   startLicenseSafetyPoll();
   const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
   if (driftScanIntervalMs > 0) {