@promptowl/contextnest-community 1.11.0 → 1.13.0

package/dist/{chunk-ZMSU7BCC.js → chunk-ZQS5W45U.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{client-YUOEVUFU.js → client-AAMF22YJ.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 import "./chunk-SLTQACJW.js";
 export {
   getDb,

package/dist/{grants-service-PS5RMMEA.js → grants-service-FZD6QM6V.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZMSU7BCC.js";
+} from "./chunk-ZQS5W45U.js";
 import "./chunk-GUNJTORH.js";
-import "./chunk-3M7677XW.js";
+import "./chunk-5QQ7WKAI.js";
 import "./chunk-SLTQACJW.js";
 export {
   createGrant,

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   seedDefaultEdgeTypes,
   submitForReview,
   verifySmtp
-} from "./chunk-XB7T3THE.js";
+} from "./chunk-PAIP5KHB.js";
 import {
   createGrant,
   deleteGrant,
@@ -37,7 +37,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZMSU7BCC.js";
+} from "./chunk-ZQS5W45U.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -53,8 +53,9 @@ import {
   getCurrentVersion,
   getDisplayStatus,
   getVersions,
-  setApprovedVersion
-} from "./chunk-JHIU6RZU.js";
+  setApprovedVersion,
+  upsertVersion
+} from "./chunk-EG77SQHO.js";
 import {
   addMember,
   buildTitleMap,
@@ -63,7 +64,6 @@ import {
   canUserAccess,
   canUserApprove,
   canUserEdit,
-  collabPermToRole,
   createNest,
   createStewardRecord,
   createTeam,
@@ -98,6 +98,7 @@ import {
   listSharedNests,
   listStewards,
   listTeamsForUser,
+  listVisibleNests,
   loadAccessConfig,
   loadGrantedSuperAdmins,
   loadServerSettings,
@@ -111,12 +112,12 @@ import {
   renameNest,
   renameTeam,
   replaceTeamRoster,
+  resolveGrantRoles,
   resolveMemberIdentity,
   resolveNestPath,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
-  resolveTeamRolesForUser,
   resolveUserRoles,
   setAllowSelfApprove,
   setStewardshipEnabled,
@@ -130,7 +131,7 @@ import {
   updateMemberRole,
   updateSteward,
   validateLicense
-} from "./chunk-F7EKYNXG.js";
+} from "./chunk-Q5NRCDD4.js";
 import {
   AppError,
   ConflictError,
@@ -153,7 +154,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
@@ -194,6 +195,12 @@ async function createSession(userId, userAgent) {
      VALUES (?, ?, ?, ?)`,
     [id, userId, expiryIso(), userAgent || null]
   );
+  try {
+    await db.run("UPDATE users SET is_invited = 0 WHERE id = ? AND is_invited = 1", [
+      userId
+    ]);
+  } catch {
+  }
   return id;
 }
 async function resolveSession(id) {
@@ -895,6 +902,9 @@ authRoutes.post("/register", async (c) => {
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  if (!isEmailish(body.email)) {
+    throw new ValidationError("Enter a valid email address.");
+  }
   assertValidPassword(body.password);
   const email = normalizeEmail(body.email);
   const ip = clientIp(c);
@@ -974,12 +984,6 @@ authRoutes.post("/login", async (c) => {
   console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
   if (hasIp) clear(ipKey);
   clear(emailKey);
-  if (user.is_invited === 1) {
-    try {
-      await db.run("UPDATE users SET is_invited = 0 WHERE id = ?", [user.id]);
-    } catch {
-    }
-  }
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -1051,9 +1055,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
-  const body = await c.req.json().catch(
-    () => ({})
-  );
+  const body = await c.req.json().catch(() => ({}));
   const db = getDb();
   const userId = c.get("userId");
   const apiKey = generateApiKey();
@@ -1062,6 +1064,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
     "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
     [userId]
   );
+  const nestScope = "nest_id" in body ? body.nest_id || null : prior?.nest_id ?? null;
   await db.transaction(async (tx) => {
     await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
     await tx.run(
@@ -1071,7 +1074,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
         userId,
         hashApiKey(apiKey),
         getKeyPrefix(apiKey),
-        body.nest_id ?? prior?.nest_id ?? null,
+        nestScope,
         body.label ?? prior?.label ?? null
       ]
     );
@@ -1422,6 +1425,9 @@ authRoutes.delete("/users/:userId", async (c) => {
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
+  if (!isEmailish(body.email)) {
+    throw new ValidationError("Enter a valid email address.");
+  }
   const email = normalizeEmail(body.email);
   const callerId = await resolveCallerUserId(c);
   if (!callerId) {
@@ -1759,7 +1765,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-L52F4WVZ.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -2051,6 +2057,11 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
   return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
 }
+async function actorAutoPublishes(nestId, userEmail) {
+  if (!await nestAllowsSelfApprove(nestId)) return false;
+  const roles = await resolveUserRoles(nestId, userEmail);
+  return roles.includes("owner") || roles.includes("admin");
+}
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
   const slug = slugify(input.title);
@@ -2085,8 +2096,9 @@ async function createNode(nestId, input, userEmail) {
     tags.push(deptTag);
   }
   const hasStewards = await isStewardshipEnabled(nestId);
-  const initialStatus = hasStewards ? "draft" : "published";
-  const initialVersion = hasStewards ? 1 : 0;
+  const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
+  const initialStatus = autoPublish ? "published" : "draft";
+  const initialVersion = autoPublish ? 0 : 1;
   let node = {
     id,
     filePath: "",
@@ -2110,7 +2122,7 @@ async function createNode(nestId, input, userEmail) {
   await storage.writeDocument(id, serializeDocument(node));
   await syncNodeTags(nestId, id, tags);
   let savedVersion = 1;
-  if (hasStewards) {
+  if (!autoPublish) {
     try {
       await versionManager.createVersion(node, userEmail);
     } catch (err) {
@@ -2129,7 +2141,7 @@ async function createNode(nestId, input, userEmail) {
     try {
       const result = await safePublishDocument(storage, id, {
         editedBy: userEmail,
-        note: "Auto-published on create (no stewards configured)"
+        note: hasStewards ? "Auto-published on create (owner/admin self-approve)" : "Auto-published on create (no stewards configured)"
       });
       savedVersion = result.node.frontmatter.version || 1;
       await createVersion({
@@ -2338,6 +2350,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
       }
       const hasStewards = await isStewardshipEnabled(nestId);
+      const autoPublish = !hasStewards || await actorAutoPublishes(nestId, userEmail);
       const currentTags = node.frontmatter.tags || [];
       if (hasStewards && await getPendingReview(nestId, nodeId)) {
         throw new LockedError(
@@ -2345,7 +2358,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         );
       }
       let responseVersion;
-      if (hasStewards) {
+      if (!autoPublish) {
         const currentVersion = await getCurrentVersion(nestId, nodeId);
         const newVersion = currentVersion + 1;
         node = {
@@ -2400,7 +2413,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         try {
           const result = await safePublishDocument(storage, nodeId, {
             editedBy: userEmail,
-            note: patch.changeNote || "Auto-published on edit (no stewards)"
+            note: patch.changeNote || (hasStewards ? "Auto-published on edit (owner/admin self-approve)" : "Auto-published on edit (no stewards)")
           });
           publishedVersion = result.node.frontmatter.version || publishedVersion;
           node = result.node;
@@ -2411,7 +2424,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
           );
           throw err;
         }
-        await createVersion({
+        await upsertVersion({
           nestId,
           nodeId,
           version: publishedVersion,
@@ -2735,6 +2748,25 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   }
   return { nest, documents };
 }
+function deleteUnsyncedFolder(folderName) {
+  console.log(`[unsynced] delete requested folder="${folderName}"`);
+  assertSafeFolderName(folderName);
+  const src = join3(config.DATA_ROOT, folderName);
+  if (isNestStorageRoot(src)) {
+    throw new ValidationError("Folder is not eligible for delete");
+  }
+  let stat;
+  try {
+    stat = statSync(src);
+  } catch {
+    throw new NotFoundError(`Folder not found: ${folderName}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new ValidationError(`Not a directory: ${folderName}`);
+  }
+  rmSync(src, { recursive: true, force: true });
+  console.log(`[unsynced] deleted folder ${src}`);
+}
 
 // src/nests/routes.ts
 async function effectivePermission(nestId, userId) {
@@ -2760,54 +2792,42 @@ nestRoutes.get("/", async (c) => {
   const annotate = async (n) => {
     const permission = await effectivePermission(n.id, userId);
     const is_owner = permission === "owner";
-    let owner_email = null;
-    let roles;
-    if (is_owner) {
-      roles = ["owner"];
-    } else {
-      const grantRole = collabPermToRole(
-        await getCollaboratorRole(n.id, callerEmail)
-      );
-      const stewardRoles = await getStewardRolesForUser(n.id, callerEmail);
-      const teamRoles = await resolveTeamRolesForUser(n.id, userId);
-      roles = [
-        ...new Set(
-          [grantRole, ...stewardRoles, ...teamRoles].filter(Boolean)
-        )
-      ];
-    }
-    if (!is_owner && n.user_id !== ANON_USER_ID) {
-      const row = await db.get(ownerEmailSql, [n.user_id]);
-      owner_email = row?.email ?? null;
-    }
+    const needOwnerEmail = !is_owner && n.user_id !== ANON_USER_ID;
+    const [roles, owner_email] = await Promise.all([
+      is_owner ? Promise.resolve(["owner"]) : resolveGrantRoles(n.id, callerEmail, userId),
+      needOwnerEmail ? db.get(ownerEmailSql, [n.user_id]).then(
+        (row) => row?.email ?? null
+      ) : Promise.resolve(null)
+    ]);
     return {
       ...n,
       permission,
       is_owner,
       owner_email,
       roles,
-      stewardship_enabled: await isStewardshipEnabled(n.id)
+      stewardship_enabled: !!n.stewardship_enabled
     };
   };
   const seen = /* @__PURE__ */ new Set();
-  const out = [];
+  const deduped = [];
   for (const n of [...owned, ...shared, ...publicExtras]) {
     if (seen.has(n.id)) continue;
     seen.add(n.id);
-    out.push(await annotate(n));
+    deduped.push(n);
   }
+  const out = await Promise.all(deduped.map(annotate));
   const docRows = await db.all(
     "SELECT nest_id, COUNT(DISTINCT node_id) AS c FROM node_versions GROUP BY nest_id"
   );
-  const docByNest = new Map(docRows.map((r) => [r.nest_id, r.c]));
+  const docByNest = new Map(docRows.map((r) => [r.nest_id, Number(r.c)]));
   const collabRows = await db.all(
     "SELECT nest_id, COUNT(*) AS c FROM nest_collaborators GROUP BY nest_id"
   );
-  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, r.c]));
+  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, Number(r.c)]));
   const stewardRows = await db.all(
     "SELECT nest_id, COUNT(DISTINCT user_email) AS c FROM stewards WHERE is_active = 1 GROUP BY nest_id"
   );
-  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, r.c]));
+  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, Number(r.c)]));
   const stewardEmailRows = await db.all(
     `SELECT nest_id, user_email FROM stewards WHERE is_active = 1
       GROUP BY nest_id, user_email ORDER BY MIN(assigned_at)`
@@ -2914,6 +2934,21 @@ nestRoutes.post("/:nestId/sync", async (c) => {
   );
   return c.json(result, 201);
 });
+nestRoutes.delete("/:nestId/sync", async (c) => {
+  if (c.req.param("nestId") !== "unsynced") {
+    throw new NotFoundError("Not found");
+  }
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can delete folders");
+  }
+  const body = await c.req.json().catch(() => ({}));
+  if (!body?.name) {
+    throw new ValidationError("name is required");
+  }
+  deleteUnsyncedFolder(body.name);
+  return c.json({ ok: true });
+});
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   if (nestId === "unsynced") return handleUnsyncedList(c);
@@ -3038,6 +3073,9 @@ async function addCollaborator(params) {
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
+    if (!isEmailish(params.email)) {
+      throw new ValidationError("Enter a valid email address.");
+    }
     const email = normalizeEmail(params.email);
     const existing = await db.get(
       "SELECT id FROM users WHERE LOWER(email) = ?",
@@ -4012,7 +4050,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-7BHI2YXB.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-B6L7UACX.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4033,7 +4071,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-L52F4WVZ.js");
   const allVersions = await getVersions2(nestId, nodeId);
   const approved = await getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -4065,7 +4103,7 @@ nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-DPN26C47.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-Q3NDK5TX.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -7472,8 +7510,8 @@ ${list}`;
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-PS5RMMEA.js");
-        const db = (await import("./client-YUOEVUFU.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-FZD6QM6V.js");
+        const db = (await import("./client-AAMF22YJ.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
@@ -8573,7 +8611,7 @@ var CONTENT_TYPES = {
 };
 var VIDEO_EXTS = /* @__PURE__ */ new Set(["mp4", "webm"]);
 var IMAGE_MAX_BYTES = 10 * 1024 * 1024;
-var VIDEO_MAX_BYTES = 100 * 1024 * 1024;
+var VIDEO_MAX_BYTES = config.VIDEO_MAX_BYTES;
 var ASSET_MAX_REQUEST_BYTES = VIDEO_MAX_BYTES + 1024 * 1024;
 var SAFE_NAME = /^[0-9a-f-]{36}\.(png|jpe?g|gif|webp|mp4|webm)$/;
 assetRoutes.post("/", async (c) => {
@@ -10017,6 +10055,22 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   }
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
+var APPROVE_CACHE_TTL_MS = 3e4;
+var approveCache = /* @__PURE__ */ new Map();
+async function canApproveInNest(nestId, email) {
+  const key = `${nestId} ${email.toLowerCase()}`;
+  const now = Date.now();
+  const hit = approveCache.get(key);
+  if (hit && hit.exp > now) return hit.ok;
+  const roles = await resolveUserRoles(nestId, email);
+  let ok = roles.includes("admin") || roles.includes("reviewer");
+  if (!ok && roles.includes("owner")) ok = await nestAllowsSelfApprove(nestId);
+  if (approveCache.size > 500) {
+    for (const [k, v] of approveCache) if (v.exp <= now) approveCache.delete(k);
+  }
+  approveCache.set(key, { ok, exp: now + APPROVE_CACHE_TTL_MS });
+  return ok;
+}
 function createApp() {
   const app = new Hono21({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
@@ -10634,12 +10688,16 @@ function createApp() {
     const userId = c.get("userId");
     const me = await resolveCallerEmail(userId);
     const nestName2 = /* @__PURE__ */ new Map();
-    for (const n of [
-      ...await listNests(userId),
-      ...await listSharedNests(userId)
-    ])
+    for (const n of await listVisibleNests(userId))
       nestName2.set(n.id, n.name ?? n.id);
-    const { requests } = await getReviewQueue({ status: "pending", limit: 200 });
+    const limit = Math.min(Math.max(Number(c.req.query("limit")) || 50, 1), 100);
+    const offset = Math.max(Number(c.req.query("offset")) || 0, 0);
+    const { requests, total } = await getReviewQueue({
+      status: "pending",
+      nestIds: [...nestName2.keys()],
+      limit,
+      offset
+    });
     const toItem = (r) => ({
       type: "review",
       nest_id: r.nestId,
@@ -10650,12 +10708,29 @@ function createApp() {
       requested_at: r.requestedAt,
       priority: r.priority
     });
-    const mine = requests.filter((r) => nestName2.has(r.nestId));
     const byNewest = (a, b) => a.requested_at < b.requested_at ? 1 : -1;
-    const items = mine.filter((r) => r.requestedBy !== me).map(toItem).sort(byNewest);
-    const waiting = mine.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
+    const others = requests.filter((r) => r.requestedBy !== me);
+    const nestApprove = new Map(
+      await Promise.all(
+        [...new Set(others.map((r) => r.nestId))].map(
+          async (nestId) => [
+            nestId,
+            await canApproveInNest(nestId, me)
+          ]
+        )
+      )
+    );
+    const items = others.filter((r) => nestApprove.get(r.nestId)).map(toItem).sort(byNewest);
+    const waiting = requests.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
-    return c.json({ items, waiting, notifications });
+    return c.json({
+      items,
+      waiting,
+      notifications,
+      // total = all pending across visible nests (both buckets); has_more drives
+      // the "Load more" control on the client.
+      pagination: { total, limit, offset, has_more: offset + requests.length < total }
+    });
   });
   app.get("/me/notifications", async (c) => {
     const me = await resolveCallerEmail(c.get("userId"));
@@ -10673,9 +10748,7 @@ function createApp() {
     const db = getDb();
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
-    const owned = await listNests(userId);
-    const sharedNests = await listSharedNests(userId);
-    const visibleNests = [...owned, ...sharedNests];
+    const visibleNests = await listVisibleNests(userId);
     let documents = 0;
     for (const nest of visibleNests) {
       try {
@@ -10712,18 +10785,31 @@ function createApp() {
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
+    const isMcpTransport = parts.length === 2 && parts[1] === "mcp";
+    const deny = async (status, error, extra) => {
+      if (!isMcpTransport) return c.json({ error, ...extra }, status);
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      const message = typeof extra?.reason === "string" ? `${error} \u2014 ${extra.reason}` : error;
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message } },
+        status
+      );
+    };
     if (nestScope && nestScope !== nestId) {
-      return c.json({ error: "API key not authorized for this nest" }, 403);
+      return deny(
+        403,
+        `API key not authorized for this nest \u2014 this key is scoped to nest "${nestScope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`
+      );
     }
     if (isSuspended() && c.req.method !== "GET") {
-      return c.json(
-        {
-          error: "Server suspended by PromptOwl",
-          reason: getSuspensionReason(),
-          contact: "support@promptowl.ai"
-        },
-        503
-      );
+      return deny(503, "Server suspended by PromptOwl", {
+        reason: getSuspensionReason(),
+        contact: "support@promptowl.ai"
+      });
     }
     {
       const path2 = c.req.path;
@@ -10735,14 +10821,10 @@ function createApp() {
       if (needsLicense) {
         const lic = getCurrentLicense();
         if (!lic?.valid) {
-          return c.json(
-            {
-              error: "License required",
-              reason: "Install a PromptOwl license key via the setup screen or POST /license/install.",
-              setup_url: "/setup"
-            },
-            503
-          );
+          return deny(503, "License required", {
+            reason: "This server has no valid PromptOwl license installed. Ask the server admin to install one via the setup screen or POST /license/install.",
+            setup_url: "/setup"
+          });
         }
       }
     }
@@ -10770,7 +10852,9 @@ function createApp() {
         grantNestVisible = await hasAnyGrant(nestId, userId);
       }
       if (!grantRole && !grantNestVisible) {
-        return c.json({ error: "Nest not found" }, 404);
+        return deny(404, "Nest not found", {
+          reason: "The nest id may be wrong, or these credentials have no access to it. Ask the nest owner to share the nest with you, then reconnect."
+        });
       }
     }
     let required = "read";
@@ -10796,7 +10880,7 @@ function createApp() {
       required = c.req.method === "GET" ? "write" : "admin";
     } else if (parts[1] === "hooks") {
       required = "write";
-    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery) {
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery && !isMcpTransport) {
       required = "write";
     }
     const isNodeAction = c.req.method === "POST" && parts.length >= 4 && (parts[parts.length - 1] === "revert" || parts[parts.length - 1] === "move");
@@ -10825,13 +10909,13 @@ function createApp() {
     const grantLevel = grantRole ? permissionLevel(grantRole) : grantNestVisible ? permissionLevel("read") : 0;
     const effectiveLevel = Math.max(permissionLevel(permission), grantLevel);
     if (!stewardEditorBypass && effectiveLevel < permissionLevel(required)) {
-      return c.json(
+      return deny(
+        403,
+        `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
         {
-          error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
           required_permission: required,
           your_permission: permission
-        },
-        403
+        }
       );
     }
     c.set(

package/dist/{review-service-DPN26C47.js → review-service-Q3NDK5TX.js}

@@ -6,16 +6,16 @@ import {
   getReviewQueue,
   reject,
   submitForReview
-} from "./chunk-XB7T3THE.js";
-import "./chunk-ZMSU7BCC.js";
-import "./chunk-JHIU6RZU.js";
+} from "./chunk-PAIP5KHB.js";
+import "./chunk-ZQS5W45U.js";
+import "./chunk-EG77SQHO.js";
 import {
   canUserApprove
-} from "./chunk-F7EKYNXG.js";
+} from "./chunk-Q5NRCDD4.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-FRQJWGN3.js";
 import "./chunk-XQ46F76G.js";
-import "./chunk-3M7677XW.js";
+import "./chunk-5QQ7WKAI.js";
 import "./chunk-SLTQACJW.js";
 export {
   approve,

package/dist/{stewardship-service-7BHI2YXB.js → stewardship-service-B6L7UACX.js}

@@ -14,17 +14,18 @@ import {
   getStewardsForUser,
   listStewards,
   removeSteward,
+  resolveGrantRoles,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   resolveUserRoles,
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-F7EKYNXG.js";
+} from "./chunk-Q5NRCDD4.js";
 import "./chunk-GUNJTORH.js";
 import "./chunk-FRQJWGN3.js";
 import "./chunk-XQ46F76G.js";
-import "./chunk-3M7677XW.js";
+import "./chunk-5QQ7WKAI.js";
 import "./chunk-SLTQACJW.js";
 export {
   assignSteward,
@@ -42,6 +43,7 @@ export {
   getStewardsForUser,
   listStewards,
   removeSteward,
+  resolveGrantRoles,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   resolveUserRoles,