@promptowl/contextnest-community 1.1.0 → 1.3.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-S2EWN2VA.js";
+} from "./chunk-EDJRDWPL.js";
 import {
   checkConflict,
   createVersion,
@@ -25,11 +25,12 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-7UTMBL6Z.js";
+} from "./chunk-6AXBB65N.js";
 import {
   AppError,
   ConflictError,
   ForbiddenError,
+  LockedError,
   NotFoundError,
   ValidationError,
   canCreateInNest,
@@ -66,6 +67,7 @@ import {
   nestAllowsSelfApprove,
   permissionLevel,
   removeSteward,
+  renameNest,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
@@ -76,15 +78,16 @@ import {
   startTelemetryLoop,
   syncFromConfig,
   trackEvent,
+  uniqueNestName,
   updateSteward,
   validateLicense
-} from "./chunk-WCOUCBDJ.js";
+} from "./chunk-SO74PQWI.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-TDAX3JOT.js";
+} from "./chunk-UEHFNBNR.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -209,6 +212,11 @@ var authMiddleware = createMiddleware(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
+// src/shared/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function liveBucket(key, cutoff) {
@@ -272,6 +280,15 @@ function resolveCallerUserId(c) {
   }
   return null;
 }
+function deviceGateBlocked(c) {
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate === "open") return null;
+  const error = "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.";
+  if (gate === "disabled") return { error, gate };
+  const callerId = resolveCallerUserId(c);
+  if (callerId && !isLicenseAdminUserId(callerId)) return { error, gate };
+  return null;
+}
 function setSessionCookie(c, sessionId) {
   c.header(
     "Set-Cookie",
@@ -290,12 +307,13 @@ authRoutes.post("/register", async (c) => {
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  const email = normalizeEmail(body.email);
   const ip = clientIp(c);
   if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id, is_invited FROM users WHERE email = ?").get(body.email);
+  const existing = db.prepare("SELECT id, is_invited FROM users WHERE LOWER(email) = ?").get(email);
   let userId;
   const passwordHash = await hashPassword(body.password);
   if (existing && existing.is_invited === 1) {
@@ -303,15 +321,15 @@ authRoutes.post("/register", async (c) => {
     db.prepare(
       "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
     ).run(passwordHash, body.name || null, userId);
-    trackEvent("user.register", { userId, email: body.email, claimed: true });
+    trackEvent("user.register", { userId, email, claimed: true });
   } else if (existing) {
     throw new ValidationError("Email already registered");
   } else {
     userId = uuid();
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, body.email, body.name || null, passwordHash);
-    trackEvent("user.register", { userId, email: body.email });
+    ).run(userId, email, body.name || null, passwordHash);
+    trackEvent("user.register", { userId, email });
   }
   const sessionId = createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
@@ -319,9 +337,9 @@ authRoutes.post("/register", async (c) => {
     {
       user: {
         id: userId,
-        email: body.email,
+        email,
         name: body.name || null,
-        is_admin: isLicenseAdminEmail(body.email)
+        is_admin: isLicenseAdminEmail(email)
       }
     },
     201
@@ -342,8 +360,8 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = db.prepare(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE email = ?"
-  ).get(body.email);
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?"
+  ).get(emailLower);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
     if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
@@ -455,6 +473,8 @@ authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
   }
@@ -476,6 +496,8 @@ authRoutes.post("/device", async (c) => {
   return c.json(data);
 });
 authRoutes.get("/device/poll", async (c) => {
+  const blocked = deviceGateBlocked(c);
+  if (blocked) return c.json(blocked, 403);
   const code = c.req.query("code");
   const clientSecret = c.req.query("client_secret");
   if (!code || !clientSecret) {
@@ -511,15 +533,28 @@ authRoutes.post("/promptowl", async (c) => {
       401
     );
   }
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate !== "open") {
+    if (gate === "disabled" || !isLicenseAdminEmail(me.email)) {
+      return c.json(
+        {
+          error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
+          gate
+        },
+        403
+      );
+    }
+  }
   const db = getDb();
-  let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
+  const meEmail = normalizeEmail(me.email);
+  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, me.email, me.name || null, placeholderHash);
-    user = { id: userId, email: me.email, name: me.name || null };
+    ).run(userId, meEmail, me.name || null, placeholderHash);
+    user = { id: userId, email: meEmail, name: me.name || null };
     trackEvent("user.register", {
       userId,
       email: me.email,
@@ -592,9 +627,17 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   const db = getDb();
   const userId = c.get("userId");
   const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
-  if (!user) return c.json({ error: "User not found" }, 404);
+  if (!user) throw new ValidationError("User not found");
   const check = await verifyPassword(body.current, user.password_hash);
-  if (!check.ok) return c.json({ error: "Invalid current password" }, 401);
+  if (!check.ok) {
+    throw new ValidationError("Current password is incorrect");
+  }
+  const sameAsCurrent = await verifyPassword(body.next, user.password_hash);
+  if (sameAsCurrent.ok) {
+    throw new ValidationError(
+      "new password must be different from the current password"
+    );
+  }
   const newHash = await hashPassword(body.next);
   db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
     newHash,
@@ -604,9 +647,96 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
+authRoutes.post("/admin/reset-password/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can reset passwords." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  let supplied;
+  try {
+    supplied = (await c.req.json()).password;
+  } catch {
+    supplied = void 0;
+  }
+  if (supplied && supplied.length < 8) {
+    throw new ValidationError("password must be at least 8 characters");
+  }
+  const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
+  const newPassword = supplied ?? generated;
+  const newHash = await hashPassword(newPassword);
+  db.transaction(() => {
+    db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+      newHash,
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
+  return c.json({
+    ok: true,
+    email: target.email,
+    keys_revoked: true,
+    // Plaintext returned ONCE, only when the server generated it.
+    temporary_password: generated ?? void 0
+  });
+});
+authRoutes.delete("/users/:userId", async (c) => {
+  const callerId = resolveCallerUserId(c);
+  if (!callerId) {
+    return c.json({ error: "Authentication required." }, 401);
+  }
+  if (!isLicenseAdminUserId(callerId)) {
+    return c.json(
+      { error: "Only the license-admin user can remove users." },
+      403
+    );
+  }
+  const targetId = c.req.param("userId");
+  if (targetId === callerId) {
+    return c.json({ error: "You can't remove your own admin account." }, 400);
+  }
+  const db = getDb();
+  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  if (!target) return c.json({ error: "User not found" }, 404);
+  const ownedNests = db.prepare("SELECT COUNT(*) AS c FROM nests WHERE user_id = ?").get(target.id).c;
+  if (ownedNests > 0) {
+    return c.json(
+      {
+        error: `This user owns ${ownedNests} nest${ownedNests === 1 ? "" : "s"}. Transfer or delete them before removing the user.`,
+        owned_nests: ownedNests
+      },
+      409
+    );
+  }
+  db.transaction(() => {
+    db.prepare(
+      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)"
+    ).run(target.id, target.email);
+    db.prepare("DELETE FROM nest_collaborators WHERE user_id = ?").run(
+      target.id
+    );
+    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
+    db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
+  })();
+  deleteAllSessionsForUser(target.id);
+  trackEvent("admin.remove_user", { adminId: callerId, userId: target.id });
+  return c.json({ ok: true, email: target.email });
+});
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
+  const email = normalizeEmail(body.email);
   const callerId = resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
@@ -625,14 +755,14 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
+  let user = db.prepare("SELECT id, email FROM users WHERE LOWER(email) = ?").get(email);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-    ).run(userId, body.email, null, placeholderHash);
-    user = { id: userId, email: body.email };
+    ).run(userId, email, null, placeholderHash);
+    user = { id: userId, email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
@@ -949,7 +1079,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-624QTR5K.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1251,8 +1381,10 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   }
   const hasStewards = isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  if (getPendingReview(nestId, nodeId)) {
-    cancelReview({ nestId, nodeId, cancelledBy: userEmail });
+  if (hasStewards && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
+    );
   }
   let responseVersion;
   if (hasStewards) {
@@ -1327,6 +1459,185 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   return { node, version: responseVersion };
 }
 
+// src/nests/unsynced-service.ts
+import { readdirSync, readFileSync, rmSync, statSync } from "fs";
+import { join as join2, relative } from "path";
+var RESERVED = /* @__PURE__ */ new Set(["nests"]);
+function scanMarkdown(dir) {
+  let count = 0;
+  let size = 0;
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return { count, size };
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      const sub = scanMarkdown(full);
+      count += sub.count;
+      size += sub.size;
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        size += statSync(full).size;
+        count++;
+      } catch {
+      }
+    }
+  }
+  return { count, size };
+}
+function hasDirectMarkdown(dir) {
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  return entries.some(
+    (e) => e.isFile() && e.name.toLowerCase().endsWith(".md")
+  );
+}
+function collectLeafFolders(rel, abs) {
+  if (hasDirectMarkdown(abs)) {
+    const { count, size } = scanMarkdown(abs);
+    const segments = rel.split("/").filter(Boolean);
+    return [
+      {
+        name: rel,
+        label: segments[segments.length - 1] || rel,
+        mdCount: count,
+        sizeBytes: size
+      }
+    ];
+  }
+  let entries = [];
+  try {
+    entries = readdirSync(abs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    out.push(
+      ...collectLeafFolders(`${rel}/${e.name}`, join2(abs, e.name))
+    );
+  }
+  return out;
+}
+function listUnsyncedFolders() {
+  const root = config.DATA_ROOT;
+  let entries = [];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".")) continue;
+    if (RESERVED.has(e.name)) continue;
+    out.push(...collectLeafFolders(e.name, join2(root, e.name)));
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name));
+  console.log(
+    `[unsynced] discovered ${out.length} candidate folder(s) under ${root}`
+  );
+  return out;
+}
+function assertSafeFolderName(name) {
+  if (!name || name.includes("\\")) {
+    throw new ValidationError("Invalid folder name");
+  }
+  const segments = name.split("/").filter(Boolean);
+  if (segments.length === 0) {
+    throw new ValidationError("Invalid folder name");
+  }
+  if (RESERVED.has(segments[0])) {
+    throw new ValidationError("Folder is not eligible for sync");
+  }
+  for (const seg of segments) {
+    if (seg === ".." || seg.startsWith(".") || seg === "node_modules") {
+      throw new ValidationError("Folder is not eligible for sync");
+    }
+  }
+}
+function collectMarkdownFiles(dir, root) {
+  const out = [];
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...collectMarkdownFiles(full, root));
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        const rel = relative(root, full);
+        out.push({ path: rel, content: readFileSync(full, "utf-8") });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+async function syncUnsyncedFolder(userId, folderName, callerEmail) {
+  console.log(
+    `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
+  );
+  assertSafeFolderName(folderName);
+  const src = join2(config.DATA_ROOT, folderName);
+  let stat;
+  try {
+    stat = statSync(src);
+  } catch {
+    console.warn(`[unsynced] source missing: ${src}`);
+    throw new NotFoundError(`Folder not found: ${folderName}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new ValidationError(`Not a directory: ${folderName}`);
+  }
+  const files = collectMarkdownFiles(src, src);
+  console.log(
+    `[unsynced] collected ${files.length} markdown file(s) from ${src}`
+  );
+  if (files.length === 0) {
+    throw new ValidationError(`Folder has no markdown to sync: ${folderName}`);
+  }
+  const segments = folderName.split("/").filter(Boolean);
+  const baseName = segments[segments.length - 1] || folderName;
+  const nestName = uniqueNestName(userId, baseName);
+  if (nestName !== baseName) {
+    console.log(
+      `[unsynced] name "${baseName}" already in use, using "${nestName}" instead`
+    );
+  }
+  const nest = await importNest(userId, nestName, files);
+  console.log(
+    `[unsynced] nest created id=${nest.id} name="${nest.name}" from folder="${folderName}"`
+  );
+  const documents = await registerImportedDocuments(nest.id, callerEmail);
+  console.log(
+    `[unsynced] registered ${documents} document(s) for nest ${nest.id}`
+  );
+  try {
+    rmSync(src, { recursive: true, force: true });
+    console.log(`[unsynced] removed source folder ${src}`);
+  } catch (err) {
+    console.error("[unsynced] failed to remove source folder", src, err);
+  }
+  return { nest, documents };
+}
+
 // src/nests/routes.ts
 function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
@@ -1389,6 +1700,29 @@ nestRoutes.post("/import", async (c) => {
   );
   return c.json({ nest, documents }, 201);
 });
+nestRoutes.get("/unsynced", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can list unsynced folders");
+  }
+  return c.json({ folders: listUnsyncedFolders() });
+});
+nestRoutes.post("/unsynced/sync", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can sync folders");
+  }
+  const body = await c.req.json();
+  if (!body?.name) {
+    throw new ValidationError("name is required");
+  }
+  const result = await syncUnsyncedFolder(
+    userId,
+    body.name,
+    resolveCallerEmail(userId)
+  );
+  return c.json(result, 201);
+});
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1405,6 +1739,25 @@ nestRoutes.get("/:nestId", async (c) => {
   const nest = getNest(nestId);
   return c.json({ nest, permission, roles, myStewards });
 });
+nestRoutes.patch("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const permission = effectivePermission(nestId, userId);
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  if (permission !== "owner" && permission !== "admin") {
+    throw new ForbiddenError(
+      "Only the nest owner or an admin can rename a nest."
+    );
+  }
+  const body = await c.req.json();
+  const nest = renameNest(nestId, {
+    name: body.name,
+    description: body.description
+  });
+  return c.json({ nest });
+});
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1480,7 +1833,8 @@ async function addCollaborator(params) {
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
-    const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(params.email);
+    const email = normalizeEmail(params.email);
+    const existing = db.prepare("SELECT id FROM users WHERE LOWER(email) = ?").get(email);
     if (existing) {
       userId = existing.id;
     } else {
@@ -1488,7 +1842,7 @@ async function addCollaborator(params) {
       userId = uuid2();
       db.prepare(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, params.email, null, await hashPassword2(uuid2()));
+      ).run(userId, email, null, await hashPassword2(uuid2()));
     }
   }
   if (!userId) {
@@ -1589,7 +1943,38 @@ sharingRoutes.patch("/visibility", async (c) => {
 
 // src/nodes/routes.ts
 import { Hono as Hono4 } from "hono";
+
+// src/nodes/markdown-export.ts
+function nodeToMarkdown(node) {
+  const tags = node.tags ?? [];
+  return [
+    "---",
+    `title: ${JSON.stringify(node.title ?? "")}`,
+    `tags: [${tags.map((t) => JSON.stringify(t)).join(", ")}]`,
+    `status: ${JSON.stringify(node.status ?? "")}`,
+    `id: ${JSON.stringify(node.id)}`,
+    "---",
+    ""
+  ].join("\n") + (node.body ?? "");
+}
+function nodesToMarkdown(nodes) {
+  return nodes.map(nodeToMarkdown).join("\n\n---\n\n");
+}
+function isMarkdownFormat(c) {
+  return c.req.query("format") === "markdown";
+}
+
+// src/nodes/routes.ts
 var nodeRoutes = new Hono4();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
+  });
+}
 nodeRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1628,7 +2013,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-3XGX7QIN.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZUSHJCNR.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1649,7 +2034,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-UODXLAOJ.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-624QTR5K.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1680,10 +2065,45 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-3OJIPYNV.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-QU7Q7XX2.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
+  try {
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+  } catch {
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
+  }
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -1740,6 +2160,11 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       }
       response.version = approved;
       response.status = "published";
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
+      }
       return c.json({ node: response });
     }
   }
@@ -1748,6 +2173,11 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     const pending = getPendingReview(nestId, nodeId);
     response.pendingReviewBy = pending?.requestedBy ?? null;
   }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
   return c.json({ node: response });
 });
 nodeRoutes.patch("/:nodeId{.+}", async (c) => {
@@ -1792,6 +2222,11 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const { storage } = engineCache.get(nestId);
+  if (isStewardshipEnabled(nestId) && getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
+    );
+  }
   try {
     await storage.deleteDocument(nodeId);
   } catch {
@@ -2017,6 +2452,32 @@ function compilePrompt(prompt, nestId, titles) {
   };
 }
 
+// src/nodes/readable-body.ts
+async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
+  if (!isPublicReader(nestId, userId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return "";
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return "";
+  }
+}
+async function resolveExportBody(nestId, nodeId, workingBody) {
+  if (!isStewardshipEnabled(nestId)) return workingBody;
+  const approved = getApprovedVersion(nestId, nodeId);
+  if (approved == null) return null;
+  try {
+    const { versions } = engineCache.get(nestId);
+    const raw = await versions.reconstructVersion(nodeId, approved);
+    return bodyOnly(nodeId, raw);
+  } catch {
+    return null;
+  }
+}
+
 // src/nodes/query-routes.ts
 var queryRoutes = new Hono5();
 function approxTokens(text) {
@@ -2087,9 +2548,15 @@ queryRoutes.post("/context", async (c) => {
   const beforePermission = documents.length;
   const accessible = filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
+  const readable = await Promise.all(
+    accessible.map(async (doc) => ({
+      ...doc,
+      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || "")
+    }))
+  );
   const included = [];
   let tokenCount = 0;
-  for (const doc of accessible) {
+  for (const doc of readable) {
     const block = formatContextBlock(doc);
     const blockTokens = approxTokens(block);
     if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
@@ -2220,6 +2687,64 @@ queryRoutes.get("/context", async (c) => {
   const content = await storage.readContextMd();
   return c.json({ content: content || "" });
 });
+queryRoutes.get("/export", async (c) => {
+  if (!isMarkdownFormat(c)) {
+    throw new ValidationError("format=markdown is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { storage, query: queryEngine } = engineCache.get(nestId);
+  const selector = c.req.query("selector")?.trim() || null;
+  let documents;
+  if (selector) {
+    const result = await queryEngine.query(selector, { hops: 2, full: true });
+    documents = result.documents;
+  } else {
+    documents = await storage.discoverDocuments();
+  }
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const governed = isStewardshipEnabled(nestId);
+  const resolved = await Promise.all(
+    accessible.map(async (n) => {
+      const body = await resolveExportBody(nestId, n.id, n.body || "");
+      if (body == null) return null;
+      return {
+        id: n.id,
+        title: n.frontmatter.title,
+        tags: n.frontmatter.tags || [],
+        status: governed ? "published" : n.frontmatter.status,
+        body
+      };
+    })
+  );
+  const fields = resolved.filter(
+    (f) => f != null
+  );
+  const maxParam = parseInt(c.req.query("max_tokens") ?? "", 10);
+  const maxTokens = Number.isFinite(maxParam) && maxParam > 0 ? maxParam : null;
+  let included = fields;
+  if (maxTokens) {
+    const kept = [];
+    let tokens = 0;
+    for (const f of fields) {
+      const t = approxTokens(nodeToMarkdown(f));
+      if (tokens + t > maxTokens && kept.length > 0) break;
+      kept.push(f);
+      tokens += t;
+    }
+    included = kept;
+  }
+  trackEvent("nest.export", {
+    nestId,
+    count: included.length,
+    selector,
+    truncated_by_budget: fields.length - included.length
+  });
+  return c.body(nodesToMarkdown(included), 200, {
+    "Content-Type": "text/markdown; charset=utf-8"
+  });
+});
 queryRoutes.post("/publish", async (c) => {
   const body = await c.req.json();
   if (!body.documents?.length && !body.context_md) {
@@ -2505,6 +3030,26 @@ var TOOL_DEFINITIONS = [
       },
       required: ["email"]
     }
+  },
+  // ─── Unsynced Folder Tools ─────────────────────────────────────────
+  {
+    name: "context_unsynced_list",
+    description: "List folders under the data root that are sync candidates \u2014 dropped in by the starter CLI or copied in manually, not yet converted into a nest. Server-admin only in non-open mode.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_sync_folder",
+    description: "Convert a sibling folder under the data root into a real nest. Imports its markdown, seeds governance, and removes the source folder. Use context_unsynced_list to discover folder names. Server-admin only in non-open mode.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Folder path relative to the data root (e.g. 'nodes/architecture'), as returned by context_unsynced_list."
+        }
+      },
+      required: ["name"]
+    }
   }
 ];
 async function resolveLlmBody(ctx, node) {
@@ -2519,7 +3064,7 @@ async function resolveLlmBody(ctx, node) {
   }
 }
 async function handleToolCall(toolName, args, ctx) {
-  const { storage, queryEngine, versionManager, nestId, userEmail } = ctx;
+  const { storage, queryEngine, versionManager, nestId, userId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
       const content = await storage.readContextMd();
@@ -2881,6 +3426,34 @@ ${list}`;
         return `Failed to share nest: ${err.message}`;
       }
     }
+    case "context_unsynced_list": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to list unsynced folders. Server admin only.";
+      }
+      const folders = listUnsyncedFolders();
+      if (!folders.length) return "No unsynced folders found.";
+      const list = folders.map(
+        (f, i) => `${i + 1}. **${f.label}** \`${f.name}\` \u2014 ${f.mdCount} md file(s), ${f.sizeBytes} bytes`
+      ).join("\n");
+      return `# Unsynced Folders (${folders.length})
+
+${list}`;
+    }
+    case "context_sync_folder": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to sync folders. Server admin only.";
+      }
+      try {
+        const { nest, documents } = await syncUnsyncedFolder(
+          userId,
+          args.name,
+          userEmail
+        );
+        return `Synced folder "${args.name}" \u2192 nest **${nest.name}** (${nest.id}) with ${documents} document(s).`;
+      } catch (err) {
+        return `Failed to sync folder: ${err.message}`;
+      }
+    }
     default:
       return `Unknown tool: ${toolName}`;
   }
@@ -2894,7 +3467,7 @@ function getUserEmail2(userId) {
   const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
   return user?.email || "anonymous@localhost";
 }
-function createMcpServerForNest(nestId, userEmail) {
+function createMcpServerForNest(nestId, userId, userEmail) {
   const server = new McpServer(
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
@@ -2919,6 +3492,7 @@ function createMcpServerForNest(nestId, userEmail) {
         queryEngine: engine.query,
         versionManager: engine.versions,
         nestId,
+        userId,
         userEmail
       });
       return { content: [{ type: "text", text }] };
@@ -2930,7 +3504,7 @@ mcpRoutes.all("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
   const userEmail = getUserEmail2(userId);
-  const server = createMcpServerForNest(nestId, userEmail);
+  const server = createMcpServerForNest(nestId, userId, userEmail);
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
     enableJsonResponse: true
@@ -2949,8 +3523,8 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync, existsSync } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { join as join3 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -3015,15 +3589,15 @@ function parseEntry(str) {
 }
 function loadStewardsConfig(nestId) {
   const dataRoot = config.DATA_ROOT;
-  const nestPath = join2(dataRoot, "nests", nestId);
+  const nestPath = join3(dataRoot, "nests", nestId);
   const candidates = [
-    join2(nestPath, "stewards.yaml"),
-    join2(nestPath, "stewards.yml"),
-    join2(nestPath, ".context", "stewards.yaml")
+    join3(nestPath, "stewards.yaml"),
+    join3(nestPath, "stewards.yml"),
+    join3(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
-      const content = readFileSync(candidatePath, "utf-8");
+      const content = readFileSync2(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -3174,8 +3748,19 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nodeId = c.req.param("nodeId");
   const allVersions = getVersions(nestId, nodeId);
   const approved = getApprovedVersion(nestId, nodeId);
+  const { versions: versionManager } = engineCache.get(nestId);
+  const withContent = await Promise.all(
+    allVersions.map(async (v) => {
+      try {
+        const raw = await versionManager.reconstructVersion(nodeId, v.version);
+        return { ...v, content: bodyOnly(nodeId, raw) };
+      } catch {
+        return v;
+      }
+    })
+  );
   return c.json({
-    versions: allVersions,
+    versions: withContent,
     approvedVersion: approved,
     currentVersion: allVersions[0]?.version || 0
   });
@@ -3403,15 +3988,15 @@ function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join3, relative } from "path";
+import { dirname, join as join4, relative as relative2 } from "path";
 import { existsSync as existsSync2 } from "fs";
 var HERE = dirname(fileURLToPath(import.meta.url));
 var UI_DIR_CANDIDATES = [
-  join3(HERE, "web3"),
-  join3(process.cwd(), "dist", "web3")
+  join4(HERE, "web3"),
+  join4(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
-var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
+var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
   c.set("userId", anonId);
@@ -3473,6 +4058,7 @@ function createApp() {
       version: "0.1.0",
       auth_mode: config.AUTH_MODE,
       logo_url: config.LOGO_URL,
+      promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
@@ -3542,7 +4128,14 @@ function createApp() {
         valid: true,
         tier: info.tier,
         org: info.org,
-        limits: info.limits
+        limits: info.limits,
+        // The key validated and is live now, but if it couldn't be written to
+        // disk it'll be lost on restart — surface that instead of pretending
+        // the setup is durable (the old behavior silently swallowed this).
+        persisted: info.persisted,
+        ...info.persisted ? {} : {
+          warning: `License validated, but it could not be saved to disk (${info.persistError || "unknown error"}). It will be LOST on the next restart. Set ENV_FILE_PATH to a writable, persisted path (e.g. under DATA_ROOT) or provide PROMPTOWL_KEY via the container environment.`
+        }
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to install key";
@@ -3577,6 +4170,7 @@ function createApp() {
     const localPath = c.req.path.replace(/^\/nests\//, "");
     const parts = localPath.split("/").filter(Boolean);
     if (parts.length < 2) return next();
+    if (parts[0] === "unsynced") return next();
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
@@ -3636,11 +4230,13 @@ function createApp() {
     } else if (c.req.method !== "GET" && !isStewardActionPath) {
       required = "write";
     }
+    const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
     let stewardEditorBypass = false;
     if (required === "write" && permission === "read" && parts[1] === "nodes") {
       const userEmail = resolveCallerEmail(userId);
-      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE")) {
-        const rawNodeId = parts.slice(2).join("/");
+      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
+        const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
+        const rawNodeId = idParts.join("/");
         let nodeId = rawNodeId;
         try {
           nodeId = decodeURIComponent(rawNodeId);
@@ -3758,7 +4354,7 @@ function createApp() {
 
 // src/db/backfill.ts
 import { NestStorage } from "@promptowl/contextnest-engine";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
   const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
@@ -3779,7 +4375,7 @@ async function backfillNodeVersionsFromHistory(db) {
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath = join4(config.DATA_ROOT, "nests", nestId);
+    const nestPath = join5(config.DATA_ROOT, "nests", nestId);
     const storage = new NestStorage(nestPath);
     let docs;
     try {