@promptowl/contextnest-community 1.1.0 → 1.2.0

package/CONFIGURATION.md

@@ -49,6 +49,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `AUTH_MODE` | `key` | `key` or `open`. See above. |
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
+| `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `ENV_FILE_PATH` | `$cwd/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars). Override when your `.env` lives outside the working directory. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |

package/README.md

@@ -97,6 +97,10 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Per-nest sharing + collaborators | ✅ | ✅ |
 | Public read-only nests | ✅ | ✅ |
 | Custom logo / branding | ✅ | ✅ |
+| Admin password reset + user removal (in-platform) | ✅ | ✅ |
+| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace | ✅ | ✅ |
+| Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
 | SSO / SAML / SCIM | — | ✅ |
@@ -106,6 +110,19 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
+## What's new in 1.2.0
+
+- **Admin user management (no email server needed)** — `POST /auth/admin/reset-password/:userId` sets a user's password or returns a one-time temp password; `DELETE /auth/users/:userId` removes a user and revokes their API keys, sessions, and role rows. New self-service **Change password** in the user menu blocks reusing the current password.
+- **`PROMPTOWL_SIGN_IN_GATE`** — `open` / `admin-only` / `disabled` restricts "Sign in with PromptOwl" (admin reaches it via `?admin=1`). See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Plain-text agent view** — `?format=markdown` on a node returns frontmatter + body as `text/markdown` for LLM-friendly consumption.
+- **Steward version revert** — `POST .../revert` restores an earlier version as a new one; pending-review docs are now editable (saving withdraws the review).
+- **Editor — always-editable surface** — Notion-style buttery headline, selection bubble toolbar (format-on-highlight), turn-into block conversion, Cmd+F find & replace, rich blocks (tables, callouts, toggles, syntax-highlighted code, columns), and wiki/code-safety fixes.
+- **Wiki usability** — backlinks panel ("Linked from N documents"), outline/TOC for 3+-heading docs, hover-preview on `[[wiki links]]`, multi-tag AND filtering with clickable chips, per-doc copy link, rename-safety warning for title-form links, link-health report (broken links + orphans), recently-edited strip.
+- **Sharing clarity** — share button reads "Share nest"; dialog clarifies nest-wide scope; deep links open documents directly.
+- **Security** — hardened scanner gate (PolinRider + Shai-Hulud preflight) in `bin/`.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
 ## What's new in 1.1.0
 
 - **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.

package/dist/{chunk-WCOUCBDJ.js → chunk-5MT4ZBVF.js}

@@ -2,7 +2,7 @@ import {
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-G62P54ET.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -136,6 +136,12 @@ var ConflictError = class extends AppError {
     this.name = "ConflictError";
   }
 };
+var LockedError = class extends AppError {
+  constructor(message = "Locked") {
+    super(423, message);
+    this.name = "LockedError";
+  }
+};
 
 // src/nodes/engine.ts
 import {
@@ -1352,6 +1358,7 @@ export {
   ForbiddenError,
   ValidationError,
   ConflictError,
+  LockedError,
   trackEvent,
   startTelemetryLoop,
   getCurrentLicense,

package/dist/{chunk-S2EWN2VA.js → chunk-E7E3JMQR.js}

@@ -1,16 +1,16 @@
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-7UTMBL6Z.js";
+} from "./chunk-LO54V4AU.js";
 import {
   buildTitleMap,
   canUserApprove,
   engineCache,
   resolveStewardsForNode
-} from "./chunk-WCOUCBDJ.js";
+} from "./chunk-5MT4ZBVF.js";
 import {
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-G62P54ET.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-TDAX3JOT.js → chunk-G62P54ET.js}

@@ -38,6 +38,20 @@ var config = {
   get PROMPTOWL_KEY() {
     return process.env.PROMPTOWL_KEY || "";
   },
+  /**
+   * Restrict "Sign in with PromptOwl":
+   *   "open"       — anyone may sign in with PromptOwl (default)
+   *   "admin-only" — only the license owner (admin) may; everyone else
+   *                  uses email/password. Admin reaches it via the login
+   *                  page's admin route (?admin=1).
+   *   "disabled"   — nobody may sign in with PromptOwl.
+   * Enforced server-side at the device entry points (POST /auth/device,
+   * GET /auth/device/poll) and the identity point (POST /auth/promptowl).
+   */
+  get PROMPTOWL_SIGN_IN_GATE() {
+    const v = (process.env.PROMPTOWL_SIGN_IN_GATE || "open").trim().toLowerCase();
+    return v === "admin-only" || v === "disabled" ? v : "open";
+  },
   /**
    * Path to the .env file the server reads its config from. Used by
    * the license install flow to persist PROMPTOWL_KEY alongside any

package/dist/{chunk-7UTMBL6Z.js → chunk-LO54V4AU.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-G62P54ET.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-S2EWN2VA.js";
+} from "./chunk-E7E3JMQR.js";
 import {
   checkConflict,
   createVersion,
@@ -25,11 +25,12 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-7UTMBL6Z.js";
+} from "./chunk-LO54V4AU.js";
 import {
   AppError,
   ConflictError,
   ForbiddenError,
+  LockedError,
   NotFoundError,
   ValidationError,
   canCreateInNest,
@@ -78,13 +79,13 @@ import {
   trackEvent,
   updateSteward,
   validateLicense
-} from "./chunk-WCOUCBDJ.js";
+} from "./chunk-5MT4ZBVF.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-G62P54ET.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -272,6 +273,15 @@ function resolveCallerUserId(c) {
   }
   return null;
 }
+function deviceGateBlocked(c) {
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate === "open") return null;
+  const error = "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.";
+  if (gate === "disabled") return { error, gate };
+  const callerId = resolveCallerUserId(c);
+  if (callerId && !isLicenseAdminUserId(callerId)) return { error, gate };
+  return null;
+}
 function setSessionCookie(c, sessionId) {
   c.header(
     "Set-Cookie",
@@ -455,6 +465,8 @@ authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
   }
@@ -476,6 +488,8 @@ authRoutes.post("/device", async (c) => {
   return c.json(data);
 });
 authRoutes.get("/device/poll", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   const code = c.req.query("code");
   const clientSecret = c.req.query("client_secret");
   if (!code || !clientSecret) {
@@ -511,6 +525,18 @@ authRoutes.post("/promptowl", async (c) => {
       401
     );
   }
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate !== "open") {
+    if (gate === "disabled" || !isLicenseAdminEmail(me.email)) {
+      return c.json(
+        {
+          error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
+          gate
+        },
+        403
+      );
+    }
+  }
   const db = getDb();
   let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
   if (!user) {
@@ -592,9 +618,17 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   const db = getDb();
   const userId = c.get("userId");
   const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
-  if (!user) return c.json({ error: "User not found" }, 404);
+  if (!user) throw new ValidationError("User not found");
   const check = await verifyPassword(body.current, user.password_hash);
-  if (!check.ok) return c.json({ error: "Invalid current password" }, 401);
+  if (!check.ok) {
+    throw new ValidationError("Current password is incorrect");
+  }
+  const sameAsCurrent = await verifyPassword(body.next, user.password_hash);
+  if (sameAsCurrent.ok) {
+    throw new ValidationError(
+      "new password must be different from the current password"
+    );
+  }
   const newHash = await hashPassword(body.next);
   db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
     newHash,
@@ -604,6 +638,92 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
+authRoutes.post("/admin/reset-password/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can reset passwords." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  let supplied;
+  try {
+    supplied = (await c.req.json()).password;
+  } catch {
+    supplied = void 0;
+  }
+  if (supplied && supplied.length < 8) {
+    throw new ValidationError("password must be at least 8 characters");
+  }
+  const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
+  const newPassword = supplied ?? generated;
+  const newHash = await hashPassword(newPassword);
+  db.transaction(() => {
+    db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+      newHash,
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
+  return c.json({
+    ok: true,
+    email: target.email,
+    keys_revoked: true,
+    // Plaintext returned ONCE, only when the server generated it.
+    temporary_password: generated ?? void 0
+  });
+});
+authRoutes.delete("/users/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can remove users." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  if (targetId === callerId) {
+    return c.json({ error: "You can't remove your own admin account." }, 400);
+  }
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  const ownedNests = db.prepare("SELECT COUNT(*) AS c FROM nests WHERE user_id = ?").get(target.id).c;
+  if (ownedNests > 0) {
+    return c.json(
+      {
+        error: `This user owns ${ownedNests} nest${ownedNests === 1 ? "" : "s"}. Transfer or delete them before removing the user.`,
+        owned_nests: ownedNests
+      },
+      409
+    );
+  }
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)"
+    ).run(target.id, target.email);
+    db.prepare("DELETE FROM nest_collaborators WHERE user_id = ?").run(
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+    db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.remove_user", { adminId: callerId, userId: target.id });
+  return c.json({ ok: true, email: target.email });
+});
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
@@ -949,7 +1069,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1251,8 +1371,10 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   }
   const hasStewards = isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  if (getPendingReview(nestId, nodeId)) {
-    cancelReview({ nestId, nodeId, cancelledBy: userEmail });
+  if (hasStewards && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
+    );
   }
   let responseVersion;
   if (hasStewards) {
@@ -1589,7 +1711,38 @@ sharingRoutes.patch("/visibility", async (c) => {
 
 // src/nodes/routes.ts
 import { Hono as Hono4 } from "hono";
+
+// src/nodes/markdown-export.ts
+function nodeToMarkdown(node) {
+  const tags = node.tags ?? [];
+  return [
+    "---",
+    `title: ${JSON.stringify(node.title ?? "")}`,
+    `tags: [${tags.map((t) => JSON.stringify(t)).join(", ")}]`,
+    `status: ${JSON.stringify(node.status ?? "")}`,
+    `id: ${JSON.stringify(node.id)}`,
+    "---",
+    ""
+  ].join("\n") + (node.body ?? "");
+}
+function nodesToMarkdown(nodes) {
+  return nodes.map(nodeToMarkdown).join("\n\n---\n\n");
+}
+function isMarkdownFormat(c) {
+  return c.req.query("format") === "markdown";
+}
+
+// src/nodes/routes.ts
 var nodeRoutes = new Hono4();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
+  });
+}
 nodeRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1628,7 +1781,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-3XGX7QIN.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VOD5HY3I.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1649,7 +1802,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1680,10 +1833,45 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-3OJIPYNV.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GYX3AW6E.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
+  try {
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+  } catch {
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
+  }
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -1740,6 +1928,11 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       }
       response.version = approved;
       response.status = "published";
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
+      }
       return c.json({ node: response });
     }
   }
@@ -1748,6 +1941,11 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     const pending = getPendingReview(nestId, nodeId);
     response.pendingReviewBy = pending?.requestedBy ?? null;
   }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
   return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
@@ -1792,6 +1990,11 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const { storage } = engineCache.get(nestId);
+  if (isStewardshipEnabled(nestId) && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
+    );
+  }
   try {
     await storage.deleteDocument(nodeId);
   } catch {
@@ -2017,6 +2220,32 @@ function compilePrompt(prompt, nestId, titles) {
   };
 }
 
+// src/nodes/readable-body.ts
+async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
+  if (!isPublicReader(nestId, userId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return "";
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return "";
+  }
+}
+async function resolveExportBody(nestId, nodeId, workingBody) {
+  if (!isStewardshipEnabled(nestId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return null;
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return null;
+  }
+}
+
 // src/nodes/query-routes.ts
 var queryRoutes = new Hono5();
 function approxTokens(text) {
@@ -2087,9 +2316,15 @@ queryRoutes.post("/context", async (c) => {
   const beforePermission = documents.length;
   const accessible = filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
+  const readable = await Promise.all(
+    accessible.map(async (doc) => ({
+      ...doc,
+      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || "")
+    }))
+  );
   const included = [];
   let tokenCount = 0;
-  for (const doc of accessible) {
+  for (const doc of readable) {
     const block = formatContextBlock(doc);
     const blockTokens = approxTokens(block);
     if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
@@ -2220,6 +2455,64 @@ queryRoutes.get("/context", async (c) => {
   const content = await storage.readContextMd();
   return c.json({ content: content || "" });
 });
+queryRoutes.get("/export", async (c) => {
+  if (!isMarkdownFormat(c)) {
+    throw new ValidationError("format=markdown is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage, query: queryEngine } = engineCache.get(nestId);
+  const selector = c.req.query("selector")?.trim() || null;
+  let documents;
+  if (selector) {
+    const result = await queryEngine.query(selector, { hops: 2, full: true });
+    documents = result.documents;
+  } else {
+    documents = await storage.discoverDocuments();
+  }
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const governed = isStewardshipEnabled(nestId);
+  const resolved = await Promise.all(
+    accessible.map(async (n) => {
+      const body = await resolveExportBody(nestId, n.id, n.body || "");
+      if (body == null) return null;
+      return {
+        id: n.id,
+        title: n.frontmatter.title,
+        tags: n.frontmatter.tags || [],
+        status: governed ? "published" : n.frontmatter.status,
+        body
+      };
+    })
+  );
+  const fields = resolved.filter(
+    (f) => f != null
+  );
+  const maxParam = parseInt(c.req.query("max_tokens") ?? "", 10);
+  const maxTokens = Number.isFinite(maxParam) && maxParam > 0 ? maxParam : null;
+  let included = fields;
+  if (maxTokens) {
+    const kept = [];
+    let tokens = 0;
+    for (const f of fields) {
+      const t = approxTokens(nodeToMarkdown(f));
+      if (tokens + t > maxTokens && kept.length > 0) break;
+      kept.push(f);
+      tokens += t;
+    }
+    included = kept;
+  }
+  trackEvent("nest.export", {
+    nestId,
+    count: included.length,
+    selector,
+    truncated_by_budget: fields.length - included.length
+  });
+  return c.body(nodesToMarkdown(included), 200, {
+    "Content-Type": "text/markdown; charset=utf-8"
+  });
+});
 queryRoutes.post("/publish", async (c) => {
   const body = await c.req.json();
   if (!body.documents?.length && !body.context_md) {
@@ -3174,8 +3467,19 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nodeId = c.req.param("nodeId");
   const allVersions = getVersions(nestId, nodeId);
   const approved = getApprovedVersion(nestId, nodeId);
+  const { versions: versionManager } = engineCache.get(nestId);
+  const withContent = await Promise.all(
+    allVersions.map(async (v) => {
+      try {
+        const raw = await versionManager.reconstructVersion(nodeId, v.version);
+        return { ...v, content: bodyOnly(nodeId, raw) };
+      } catch {
+        return v;
+      }
+    })
+  );
   return c.json({
-    versions: allVersions,
+    versions: withContent,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
@@ -3473,6 +3777,7 @@ function createApp() {
       version: "0.1.0",
       auth_mode: config.AUTH_MODE,
       logo_url: config.LOGO_URL,
+      promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
@@ -3636,11 +3941,13 @@ function createApp() {
     } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
+    const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
     let stewardEditorBypass = false;
     if (required === "write" && permission === "read" && parts[1] === "nodes") {
       const userEmail = resolveCallerEmail(userId);
-      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE")) {
-        const rawNodeId = parts.slice(2).join("/");
+      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
+        const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
+        const rawNodeId = idParts.join("/");
         let nodeId = rawNodeId;
         try {
           nodeId = decodeURIComponent(rawNodeId);

package/dist/{review-service-3OJIPYNV.js → review-service-GYX3AW6E.js}

@@ -6,12 +6,12 @@ import {
   getReviewQueue,
   reject,
   submitForReview
-} from "./chunk-S2EWN2VA.js";
-import "./chunk-7UTMBL6Z.js";
+} from "./chunk-E7E3JMQR.js";
+import "./chunk-LO54V4AU.js";
 import {
   canUserApprove
-} from "./chunk-WCOUCBDJ.js";
-import "./chunk-TDAX3JOT.js";
+} from "./chunk-5MT4ZBVF.js";
+import "./chunk-G62P54ET.js";
 export {
   approve,
   canUserApprove,

package/dist/{stewardship-service-3XGX7QIN.js → stewardship-service-VOD5HY3I.js}

@@ -20,8 +20,8 @@ import {
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-WCOUCBDJ.js";
-import "./chunk-TDAX3JOT.js";
+} from "./chunk-5MT4ZBVF.js";
+import "./chunk-G62P54ET.js";
 export {
   assignSteward,
   canCreateInNest,

package/dist/{version-service-UODXLAOJ.js → version-service-OCZUV2QP.js}

@@ -11,8 +11,8 @@ import {
   hashContent,
   setApprovedVersion,
   systemAuthor
-} from "./chunk-7UTMBL6Z.js";
-import "./chunk-TDAX3JOT.js";
+} from "./chunk-LO54V4AU.js";
+import "./chunk-G62P54ET.js";
 export {
   SYSTEM_AUTHOR_PREFIX,
   checkConflict,