@promptowl/contextnest-community 1.12.0 → 1.14.0

package/dist/{chunk-F7EKYNXG.js → chunk-KPK656BH.js}

@@ -13,8 +13,9 @@ import {
 } from "./chunk-XQ46F76G.js";
 import {
   config,
-  getDb
-} from "./chunk-3M7677XW.js";
+  getDb,
+  isEmailish
+} from "./chunk-I5KYGMIT.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
@@ -138,28 +139,31 @@ import {
 } from "@promptowl/contextnest-engine";
 
 // src/nests/service.ts
-import { rmSync as rmSync2, mkdirSync as mkdirSync2 } from "fs";
-import { v4 as uuid } from "uuid";
+import { rmSync as rmSync2, mkdirSync } from "fs";
+import { v4 as uuid2 } from "uuid";
 import { NestStorage } from "@promptowl/contextnest-engine";
 
 // src/fs/vault-import.ts
-import { mkdirSync, writeFileSync, rmSync } from "fs";
+import { rmSync } from "fs";
+import { writeFile, mkdir } from "fs/promises";
 import { join as join2, dirname, isAbsolute } from "path";
 function isSkippedSegment(segment) {
   return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
 }
+var ALLOWED_DOT_DIRS = /* @__PURE__ */ new Set([".versions", ".context"]);
 function safeSegments(rel) {
   if (!rel || isAbsolute(rel)) return null;
   const segs = rel.split(/[\\/]/).filter(Boolean);
   if (!segs.length) return null;
   for (const s of segs) {
     if (s === "..") return null;
-    if (s !== ".versions" && isSkippedSegment(s)) return null;
+    if (!ALLOWED_DOT_DIRS.has(s) && isSkippedSegment(s)) return null;
   }
   return segs;
 }
-function writeImportedFiles(dest, files) {
-  let written = 0;
+var WRITE_CONCURRENCY = 32;
+async function writeImportedFiles(dest, files) {
+  const targets = [];
   const skipped = [];
   for (const f of files) {
     const segs = safeSegments(f?.path || "");
@@ -167,10 +171,19 @@ function writeImportedFiles(dest, files) {
       skipped.push(f?.path || "(empty)");
       continue;
     }
-    const full = join2(dest, ...segs);
-    mkdirSync(dirname(full), { recursive: true });
-    writeFileSync(full, f.content ?? "", "utf-8");
-    written++;
+    targets.push({ full: join2(dest, ...segs), content: f.content ?? "" });
+  }
+  const dirs = new Set(targets.map((t) => dirname(t.full)));
+  await Promise.all([...dirs].map((d) => mkdir(d, { recursive: true })));
+  let written = 0;
+  for (let i = 0; i < targets.length; i += WRITE_CONCURRENCY) {
+    const batch = targets.slice(i, i + WRITE_CONCURRENCY);
+    await Promise.all(
+      batch.map(async (t) => {
+        await writeFile(t.full, t.content, "utf-8");
+        written++;
+      })
+    );
   }
   console.log(
     `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
@@ -627,412 +640,645 @@ async function _validateLicenseImpl(forceFresh) {
   }
 }
 
-// src/nests/service.ts
-async function isImportedNest(nestId) {
-  const row = await getDb().get(
-    "SELECT is_imported FROM nests WHERE id = ?",
-    [nestId]
-  );
-  return !!row?.is_imported;
+// src/governance/teams-service.ts
+import { v4 as uuid } from "uuid";
+
+// src/notify/email-render.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var EVENT = {
+  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
+  ":x:": { icon: "\u274C", color: "#dc2626" },
+  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
+  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
+};
+var ALL_EMOJI = Object.fromEntries(
+  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
+);
+function renderText(message) {
+  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
+}
+var STATUS_META = {
+  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
+  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
+  pending_review: {
+    subjectWord: "awaiting review",
+    label: "Pending review",
+    color: "#d97706"
+  },
+  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" },
+  invited: { subjectWord: "invited you", label: "Invitation", color: "#2563eb" },
+  steward: { subjectWord: "steward", label: "Steward", color: "#7c3aed" }
+};
+var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+var detailRow = (label, valueHtml) => `<tr>
+      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
+      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
+    </tr>`;
+var plainRow = (label, value) => ({
+  label,
+  text: value,
+  html: escapeHtml(value)
+});
+var governanceRows = (x) => [
+  plainRow("Path", x.d.path),
+  { label: "Status", text: x.meta.label, html: x.statusBadge },
+  ...x.d.version != null ? [plainRow("Version", `v${x.d.version}`)] : []
+];
+var TEMPLATES = {
+  approved: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `${x.title}${x.vT} has been approved${x.byT}${x.noteT}.`,
+    lineH: (x) => `${x.doc}${x.vH} has been approved${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  rejected: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `${x.title}${x.vT} has been rejected${x.byT}${x.noteT}.`,
+    lineH: (x) => `${x.doc}${x.vH} has been rejected${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  pending_review: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `A review has been requested for ${x.title}${x.vT}${x.byT}${x.noteT}.`,
+    lineH: (x) => `A review has been requested for ${x.doc}${x.vH}${x.byH}${x.noteH}.`,
+    rows: governanceRows
+  },
+  shared: {
+    heading: (x) => `You've been added to ${x.title}`,
+    detailsHeader: "Details",
+    linkLabel: "Open nest",
+    lineT: (x) => `You've been given ${x.d.permission || "collaborator"} access to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open it below to start collaborating.`,
+    lineH: (x) => `You've been given <strong>${escapeHtml(x.d.permission || "collaborator")}</strong> access to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open it below to start collaborating.`,
+    rows: (x) => [
+      plainRow("Nest", x.d.path),
+      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : []
+    ]
+  },
+  invited: {
+    heading: (x) => `You've been invited to ${x.title}`,
+    detailsHeader: "Sign-in details",
+    linkLabel: "Sign in",
+    lineT: (x) => `You've been invited to ${x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Sign in with your email and the temporary password below, then choose your own password.`,
+    lineH: (x) => `You've been invited to ${x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Sign in with your email and the temporary password below, then choose your own password.`,
+    rows: (x) => [
+      plainRow("Email", x.d.actor || ""),
+      ...x.d.tempPassword ? [
+        {
+          label: "Temporary password",
+          text: x.d.tempPassword,
+          html: x.codeValue(x.d.tempPassword)
+        }
+      ] : []
+    ]
+  },
+  steward: {
+    heading: (x) => `You're now a steward of ${x.title}`,
+    detailsHeader: "Details",
+    linkLabel: "Open nest",
+    lineT: (x) => `You've been assigned as a ${x.d.permission || "reviewer"} steward of ${x.d.scopeLabel || x.title}${x.d.by ? ` by ${x.d.by}` : ""}. Open the nest below to start reviewing.`,
+    lineH: (x) => `You've been assigned as a <strong>${escapeHtml(x.d.permission || "reviewer")}</strong> steward of ${x.d.scopeLabel ? escapeHtml(x.d.scopeLabel) : x.doc}${x.d.by ? ` by ${escapeHtml(x.d.by)}` : ""}. Open the nest below to start reviewing.`,
+    rows: (x) => [
+      plainRow("Nest", x.d.path),
+      ...x.d.permission ? [plainRow("Role", cap(x.d.permission))] : [],
+      ...x.d.scopeLabel ? [plainRow("Scope", cap(x.d.scopeLabel))] : []
+    ]
+  }
+};
+function renderEmail(d) {
+  const meta = STATUS_META[d.status];
+  const t = TEMPLATES[d.status];
+  const title = d.docTitle.replace(/[\r\n]+/g, " ").trim();
+  const vLabel = d.version != null ? `v${d.version}` : "";
+  const ctx = {
+    d,
+    title,
+    doc: `<strong>${escapeHtml(title)}</strong>`,
+    byT: d.actor ? ` by ${d.actor}` : "",
+    byH: d.actor ? ` by ${escapeHtml(d.actor)}` : "",
+    noteT: d.note ? ` with the note: "${d.note}"` : "",
+    noteH: d.note ? ` with the note: &ldquo;${escapeHtml(d.note)}&rdquo;` : "",
+    vT: vLabel ? ` ${vLabel}` : "",
+    vH: vLabel ? ` ${vLabel}` : "",
+    meta,
+    statusBadge: `<span style="display:inline-block;padding:2px 9px;border-radius:9999px;background:#f3f4f6;color:${meta.color};font-size:12px;font-weight:600;">${meta.label}</span>`,
+    codeValue: (v) => `<span style="font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;font-weight:600;color:#111827;background:#f3f4f6;padding:2px 8px;border-radius:6px;">${escapeHtml(v)}</span>`
+  };
+  const heading = t.heading(ctx).replace(/[\r\n]+/g, " ").trim();
+  const subject = heading;
+  const detailsHeader = t.detailsHeader;
+  const linkLabel = t.linkLabel;
+  const lineH = t.lineH(ctx);
+  const rows = t.rows(ctx);
+  const detailLines = [
+    `${detailsHeader}:`,
+    ...rows.map((r) => `  ${r.label}: ${r.text}`),
+    ...d.link ? [`  ${linkLabel}: ${d.link}`] : []
+  ];
+  const text = ["Hi,", "", t.lineT(ctx), "", ...detailLines, "", "Regards,", "Community Nest"].join("\n");
+  const detailRows = rows.map((r) => detailRow(r.label, r.html)).join("");
+  const buttonRow = d.link ? `<tr><td style="padding:20px 24px 0;">
+        <table role="presentation" cellpadding="0" cellspacing="0" border="0"><tr>
+          <td bgcolor="${meta.color}" style="border-radius:6px;">
+            <a href="${escapeHtml(d.link)}" target="_blank" style="display:inline-block;padding:10px 20px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;">${linkLabel}</a>
+          </td>
+        </tr></table>
+      </td></tr>` : "";
+  const html = `<div style="margin:0;padding:24px;background:#f6f8fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#111827;">
+  <table role="presentation" width="480" cellpadding="0" cellspacing="0" border="0" align="center" style="width:100%;max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;">
+    <tr><td style="padding:20px 24px 0;">
+      <div style="font-size:12px;font-weight:700;color:#6b7280;letter-spacing:0.06em;text-transform:uppercase;">ContextNest</div>
+    </td></tr>
+    <tr><td style="padding:10px 24px 0;">
+      <h1 style="margin:0;font-size:19px;line-height:1.35;font-weight:700;color:#111827;">${escapeHtml(heading)}</h1>
+    </td></tr>
+    <tr><td style="padding:16px 24px 0;font-size:14px;line-height:1.6;color:#374151;">
+      Hi,<br><br>${lineH}
+    </td></tr>
+    <tr><td style="padding:20px 24px 0;">
+      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="border:1px solid #eef0f2;border-radius:8px;">
+        <tr><td style="padding:12px 16px;">
+          <div style="font-size:11px;font-weight:600;color:#9ca3af;letter-spacing:0.04em;text-transform:uppercase;padding-bottom:4px;">${detailsHeader}</div>
+          <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0">${detailRows}</table>
+        </td></tr>
+      </table>
+    </td></tr>
+    ${buttonRow}
+    <tr><td style="padding:22px 24px 24px;font-size:14px;line-height:1.6;color:#374151;">
+      Regards,<br>Community Nest
+    </td></tr>
+  </table>
+</div>`;
+  return { subject, text, html };
+}
+function renderHtml(message, nestName2) {
+  const lead = message.match(/^(:[a-z_]+:)\s*/);
+  const meta = lead && EVENT[lead[1]] || { icon: "\u{1F514}", color: "#475569" };
+  const rest = lead ? message.slice(lead[0].length) : message;
+  const body = escapeHtml(rest).replace(/\*([^*]+)\*/g, "<strong>$1</strong>").replace(/\n/g, "<br>");
+  const safeNest = escapeHtml(nestName2);
+  return `<div style="background:#f6f8fa;padding:24px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden;">
+    <tr><td style="padding:20px 24px 16px;border-bottom:1px solid #f0f0f0;">
+      <div style="font-size:15px;font-weight:700;color:#111827;letter-spacing:-0.01em;">ContextNest</div>
+      <div style="font-size:13px;color:#6b7280;margin-top:2px;">${safeNest}</div>
+    </td></tr>
+    <tr><td style="padding:24px;">
+      <table role="presentation" cellpadding="0" cellspacing="0"><tr>
+        <td valign="top" style="font-size:22px;line-height:1;padding-right:14px;">${meta.icon}</td>
+        <td valign="top" style="font-size:15px;line-height:1.55;color:#111827;border-left:3px solid ${meta.color};padding-left:14px;">${body}</td>
+      </tr></table>
+    </td></tr>
+  </table>
+</div>`;
 }
-function toSlug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+
+// src/notify/email.ts
+var transporterPromise = null;
+var configuredUrl = null;
+var warnedOnce = false;
+var SMTP_TIMEOUT_DEFAULTS = [
+  ["connectionTimeout", 5e3],
+  ["greetingTimeout", 5e3],
+  ["socketTimeout", 1e4]
+];
+function withTimeouts(url) {
+  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+  const missing = SMTP_TIMEOUT_DEFAULTS.filter(
+    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
+  ).map(([name, ms]) => `${name}=${ms}`);
+  if (missing.length === 0) return url;
+  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
+}
+var POOL_DEFAULTS = [
+  ["pool", "true"],
+  ["maxConnections", "1"],
+  ["rateDelta", "1000"],
+  ["rateLimit", "8"]
+  // messages per second
+];
+function withPool(url) {
+  const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+  const missing = POOL_DEFAULTS.filter(
+    ([name]) => !new RegExp(`(^|&)${name}=`, "i").test(query)
+  ).map(([name, val]) => `${name}=${val}`);
+  if (missing.length === 0) return url;
+  return url + (url.includes("?") ? "&" : "?") + missing.join("&");
+}
+async function verifySmtp(url) {
+  let transporter = null;
+  try {
+    const nodemailer = await import("nodemailer");
+    transporter = nodemailer.default.createTransport(withTimeouts(url), {
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+    await transporter.verify();
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    try {
+      transporter?.close?.();
+    } catch {
+    }
+  }
 }
-async function uniqueNestName(userId, baseName) {
-  const db = getDb();
-  let candidate = baseName;
-  let n = 0;
-  while (n < 1e3) {
-    const slug = toSlug(candidate);
-    const hit = await db.get(
-      "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
-      [userId, slug]
+async function getTransporter() {
+  const url = config.SMTP_URL;
+  if (!url) return null;
+  if (!transporterPromise || configuredUrl !== url) {
+    configuredUrl = url;
+    transporterPromise = import("nodemailer").then(
+      (nodemailer) => (
+        // withPool → connection pool + per-second rate limit, so a burst queues
+        // instead of tripping the provider's "too many emails" 550.
+        nodemailer.default.createTransport(withPool(withTimeouts(url)), {
+          // Per-message defaults (belt-and-braces; also set on each sendMail).
+          disableFileAccess: true,
+          disableUrlAccess: true
+        })
+      )
     );
-    if (!hit) return candidate;
-    n++;
-    candidate = `${baseName} (${n})`;
+    transporterPromise.catch(() => {
+      transporterPromise = null;
+      configuredUrl = null;
+    });
   }
-  return candidate;
-}
-async function isStewardshipEnabled(nestId) {
-  const db = getDb();
-  const row = await db.get(
-    "SELECT stewardship_enabled FROM nests WHERE id = ?",
-    [nestId]
-  );
-  return !!row?.stewardship_enabled;
-}
-async function setStewardshipEnabled(nestId, enabled) {
-  const db = getDb();
-  await db.run("UPDATE nests SET stewardship_enabled = ? WHERE id = ?", [
-    enabled ? 1 : 0,
-    nestId
-  ]);
+  return transporterPromise;
 }
-async function nestAllowsSelfApprove(nestId) {
-  const db = getDb();
-  const row = await db.get(
-    "SELECT allow_self_approve FROM nests WHERE id = ?",
-    [nestId]
-  );
-  return !!row?.allow_self_approve;
+async function notifyEmailForNest(nestId, message, details) {
+  const from = config.NOTIFY_EMAIL_FROM;
+  const to = config.NOTIFY_EMAIL_TO;
+  if (!config.SMTP_URL || !from || !to) return;
+  try {
+    const transporter = await getTransporter();
+    if (!transporter) return;
+    let subject;
+    let text;
+    let html;
+    if (details) {
+      ({ subject, text, html } = renderEmail(details));
+    } else {
+      let name = nestId;
+      try {
+        const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+          nestId
+        ]);
+        if (row?.name) name = row.name;
+      } catch {
+      }
+      const safeName = name.replace(/[\r\n]+/g, " ").trim();
+      subject = `ContextNest \xB7 ${safeName}`;
+      text = renderText(message);
+      html = renderHtml(message, safeName);
+    }
+    await transporter.sendMail({
+      from,
+      to,
+      subject,
+      text,
+      html,
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+  } catch (err) {
+    if (!warnedOnce) {
+      warnedOnce = true;
+      console.warn(
+        "[email] notification failed (suppressing further warnings):",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
 }
-async function setAllowSelfApprove(nestId, allow) {
-  const db = getDb();
-  await db.run("UPDATE nests SET allow_self_approve = ? WHERE id = ?", [
-    allow ? 1 : 0,
-    nestId
-  ]);
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function recipientEnvelope(to, from) {
+  const recipients = Array.isArray(to) ? to : [to];
+  return recipients.length > 1 ? { to: from, bcc: recipients } : { to: recipients[0] };
 }
-async function disableStewardshipAndWipeGovernance(nestId) {
-  const db = getDb();
-  return db.transaction(async (tx) => {
-    const id = nestId;
-    const stewards = (await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id])).changes;
-    const pendingReviews = (await tx.run(
-      "DELETE FROM review_requests WHERE nest_id = ? AND status = 'pending'",
-      [id]
-    )).changes;
-    await tx.run("UPDATE nests SET stewardship_enabled = 0 WHERE id = ?", [id]);
-    return { stewards, pendingReviews };
-  });
+function isRateLimited(err) {
+  const msg = String(err?.message ?? err);
+  const code = Number(err?.responseCode);
+  return /too many|rate limit|throttl|try again|4\.7\.\d|too many emails/i.test(msg) || code === 421 || code === 429 || code === 450 || code === 451 || code === 550 && /too many|rate/i.test(msg);
 }
-async function renameNest(nestId, patch) {
-  const db = getDb();
-  const existing = await db.get("SELECT * FROM nests WHERE id = ?", [
-    nestId
-  ]);
-  if (!existing) {
-    throw new ValidationError("Nest not found");
+async function sendMailWithRetry(transporter, msg, attempts = 5) {
+  for (let i = 0; ; i++) {
+    try {
+      return await transporter.sendMail(msg);
+    } catch (err) {
+      if (i >= attempts - 1 || !isRateLimited(err)) throw err;
+      const wait = 1e3 * 2 ** i;
+      await sleep(wait);
+    }
   }
-  const updates = [];
-  const params = [];
-  if (patch.name !== void 0) {
-    const trimmed = patch.name.trim();
-    if (!trimmed) throw new ValidationError("Name cannot be empty");
-    const slug = toSlug(trimmed);
-    if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
-    const conflict = await db.get(
-      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
-      [existing.user_id, slug, nestId]
-    );
-    if (conflict) {
-      throw new ValidationError(
-        `Another nest already uses this name. Pick a different one.`
+}
+async function sendEmailToRecipient(to, details) {
+  const from = config.NOTIFY_EMAIL_FROM;
+  const hasRecipient = Array.isArray(to) ? to.length > 0 : !!to;
+  if (!config.SMTP_URL || !from || !hasRecipient) return;
+  try {
+    const transporter = await getTransporter();
+    if (!transporter) return;
+    const { subject, text, html } = renderEmail(details);
+    await sendMailWithRetry(transporter, {
+      from,
+      ...recipientEnvelope(to, from),
+      subject,
+      text,
+      html,
+      disableFileAccess: true,
+      disableUrlAccess: true
+    });
+  } catch (err) {
+    if (!warnedOnce) {
+      warnedOnce = true;
+      console.warn(
+        "[email] notification failed (suppressing further warnings):",
+        err instanceof Error ? err.message : err
       );
     }
-    updates.push("name = ?", "slug = ?");
-    params.push(trimmed, slug);
-  }
-  if (patch.description !== void 0) {
-    updates.push("description = ?");
-    params.push(patch.description || null);
-  }
-  if (updates.length === 0) {
-    return existing;
   }
-  params.push(nestId);
-  await db.run(
-    `UPDATE nests SET ${updates.join(", ")} WHERE id = ?`,
-    params
-  );
-  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]);
-}
-async function createNest(userId, name, description) {
-  const id = uuid();
-  const slug = toSlug(name);
-  const db = getDb();
-  const visibility = userId === ANON_USER_ID ? "public" : "private";
-  await db.run(
-    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
-    [id, userId, name, slug, description || null, visibility]
-  );
-  const path = resolveNestPath(id);
-  mkdirSync2(path, { recursive: true });
-  const storage = new NestStorage(path);
-  await storage.init(name);
-  trackEvent("nest.create", { nestId: id, userId });
-  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function importNest(userId, name, files) {
-  const nm = (name || "").trim();
-  if (!nm) {
-    throw new ValidationError("name is required");
-  }
-  if (!Array.isArray(files)) {
-    throw new ValidationError("files are required");
-  }
-  const db = getDb();
-  const id = uuid();
-  const slug = toSlug(nm);
-  const visibility = userId === ANON_USER_ID ? "public" : "private";
-  const dest = resolveNestPath(id);
-  mkdirSync2(dest, { recursive: true });
+
+// src/governance/teams-service.ts
+var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
+function parseMembers(json) {
+  if (!json) return [];
   try {
-    writeImportedFiles(dest, files);
-  } catch (err) {
-    console.error("[nests] import write failed", dest, err);
-    discardImportDir(dest);
-    throw new ValidationError("Failed to import folder");
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
   }
-  await db.run(
-    "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)",
-    [id, userId, nm, slug, null, visibility]
-  );
-  trackEvent("nest.import", { nestId: id, userId });
-  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function listNests(userId) {
+function rowToTeam(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    owner_id: row.owner_id,
+    members: parseMembers(row.members),
+    source: row.source ?? null,
+    external_id: row.external_id ?? null,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+async function enrichTeam(team) {
   const db = getDb();
-  if (userId === ANON_USER_ID) {
-    return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
-      [ANON_USER_ID]
+  const ids = team.members.map((m) => m.userId);
+  const invited = /* @__PURE__ */ new Map();
+  if (ids.length) {
+    const rows = await db.all(
+      `SELECT id, is_invited FROM users WHERE id IN (${ids.map(() => "?").join(",")})`,
+      ids
     );
+    for (const r of rows) invited.set(r.id, r.is_invited);
   }
-  const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
-  if (!includeAnon) {
-    return await db.all(
-      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
-      [userId]
+  const owner = await db.get("SELECT email FROM users WHERE id = ?", [
+    team.owner_id
+  ]);
+  return {
+    ...team,
+    owner_email: owner?.email,
+    // Unknown id (deleted user) → treat as not registered.
+    members: team.members.map((m) => ({
+      ...m,
+      registered: (invited.get(m.userId) ?? 1) === 0
+    }))
+  };
+}
+function assertValidRole(role) {
+  if (!VALID_TEAM_ROLES.includes(role)) {
+    throw new ValidationError(
+      "role must be admin, editor, or viewer"
     );
   }
-  return await db.all(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
-    [userId, ANON_USER_ID]
-  );
 }
-async function nestsSharedViaTeams(userId) {
+async function loadTeamRow(teamId) {
   const db = getDb();
-  const teams = await db.all(
-    "SELECT id, members FROM teams WHERE members LIKE ?",
-    [`%${userId}%`]
-  );
-  const myTeamIds = /* @__PURE__ */ new Set();
-  for (const t of teams) {
-    try {
-      const members = JSON.parse(t.members || "[]");
-      if (Array.isArray(members) && members.some((m) => m?.userId === userId)) {
-        myTeamIds.add(t.id);
-      }
-    } catch {
-    }
-  }
-  if (myTeamIds.size === 0) return [];
-  const ids = [...myTeamIds];
-  const candidates = await db.all(
-    `SELECT * FROM nests
-       WHERE user_id != ?
-         AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
-    [userId, ...ids.map((id) => `%${id}%`)]
-  );
-  return candidates.filter((n) => {
-    try {
-      const refs = JSON.parse(n.shared_teams || "[]");
-      return Array.isArray(refs) && refs.some((r) => myTeamIds.has(r?.teamId));
-    } catch {
-      return false;
-    }
-  });
+  const row = await db.get("SELECT * FROM teams WHERE id = ?", [
+    teamId
+  ]);
+  if (!row) throw new NotFoundError("Team not found");
+  return row;
 }
-async function listSharedNests(userId) {
+var ROLE_RANK = {
+  viewer: 1,
+  editor: 2,
+  admin: 3
+};
+var OWNER_RANK = 4;
+function managementRank(row, callerUserId, allowAdmin) {
+  if (row.owner_id === callerUserId || allowAdmin) return OWNER_RANK;
+  const m = parseMembers(row.members).find((x) => x.userId === callerUserId);
+  return m ? ROLE_RANK[m.role] ?? 0 : 0;
+}
+async function createTeam(params) {
+  const name = params.name?.trim();
+  if (!name) throw new ValidationError("Team name is required");
   const db = getDb();
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
-    userId
-  ]);
-  const isServerAdmin = await isLicenseAdminUserId(userId) || (caller?.email ? isSuperAdmin(caller.email) : false);
-  if (isServerAdmin) {
-    return await db.all(
-      "SELECT * FROM nests WHERE user_id != ? ORDER BY created_at DESC",
-      [userId]
-    );
-  }
-  const direct = await db.all(
-    `SELECT DISTINCT n.* FROM nests n
-       LEFT JOIN nest_collaborators nc
-         ON nc.nest_id = n.id AND nc.user_id = ?
-       LEFT JOIN users u ON u.id = ?
-       LEFT JOIN stewards s
-         ON s.nest_id = n.id AND s.is_active = 1
-        AND LOWER(s.user_email) = LOWER(u.email)
-       WHERE n.user_id != ?
-         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
-       ORDER BY n.created_at DESC`,
-    [userId, userId, userId]
-  );
-  const seen = new Set(direct.map((n) => n.id));
-  for (const n of await nestsSharedViaTeams(userId)) {
-    if (!seen.has(n.id)) {
-      direct.push(n);
-      seen.add(n.id);
-    }
-  }
-  direct.sort(
-    (a, b) => a.created_at === b.created_at ? 0 : a.created_at < b.created_at ? 1 : -1
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = uuid();
+  await db.run(
+    "INSERT INTO teams (id, name, owner_id, members, source, external_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+    [
+      id,
+      name,
+      params.ownerId,
+      "[]",
+      params.source ?? null,
+      params.externalId ?? null,
+      now,
+      now
+    ]
   );
-  return direct;
+  return enrichTeam(rowToTeam(await loadTeamRow(id)));
 }
-async function listPublicNests(userId) {
+async function findTeamByExternalId(params) {
   const db = getDb();
-  return await db.all(
-    `SELECT n.* FROM nests n
-       WHERE n.visibility = 'public'
-         AND n.user_id != ?
-         AND NOT EXISTS (
-           SELECT 1 FROM nest_collaborators nc
-           WHERE nc.nest_id = n.id AND nc.user_id = ?
-         )
-       ORDER BY n.created_at DESC`,
-    [userId, userId]
+  const row = await db.get(
+    "SELECT * FROM teams WHERE owner_id = ? AND source = ? AND external_id = ?",
+    [params.ownerId, params.source, params.externalId]
   );
+  return row ? enrichTeam(rowToTeam(row)) : null;
 }
-async function getNest(nestId) {
+async function listTeamsForUser(userId) {
   const db = getDb();
-  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]) || null;
+  const rows = await db.all(
+    "SELECT * FROM teams WHERE owner_id = ? OR members LIKE ? ORDER BY created_at",
+    [userId, `%${userId}%`]
+  );
+  const mine = rows.filter(
+    (r) => r.owner_id === userId || parseMembers(r.members).some((m) => m.userId === userId)
+  );
+  return Promise.all(mine.map((r) => enrichTeam(rowToTeam(r))));
 }
-async function deleteNest(nestId) {
+async function getTeam(teamId) {
+  return enrichTeam(rowToTeam(await loadTeamRow(teamId)));
+}
+async function renameTeam(params) {
+  const name = params.name?.trim();
+  if (!name) throw new ValidationError("Team name is required");
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can rename this team.");
+  }
   const db = getDb();
   await db.transaction(async (tx) => {
-    const id = nestId;
-    await tx.run("DELETE FROM approved_versions WHERE nest_id = ?", [id]);
-    await tx.run("DELETE FROM node_versions WHERE nest_id = ?", [id]);
-    await tx.run("DELETE FROM review_requests WHERE nest_id = ?", [id]);
-    await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id]);
-    await tx.run("DELETE FROM nest_collaborators WHERE nest_id = ?", [id]);
-    try {
-      await tx.run("DELETE FROM node_tag_index WHERE nest_id = ?", [id]);
-    } catch {
-    }
-    await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
-    await tx.run("DELETE FROM nests WHERE id = ?", [id]);
+    await tx.run("UPDATE teams SET name = ?, updated_at = ? WHERE id = ?", [
+      name,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      params.teamId
+    ]);
+    await refreshTeamNameRefs(tx, params.teamId, name);
   });
-  const path = resolveNestPath(nestId);
-  try {
-    rmSync2(path, { recursive: true, force: true });
-  } catch (err) {
-    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
-  }
-  trackEvent("nest.delete", { nestId });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-
-// src/nodes/flat-storage.ts
-import { readdirSync } from "fs";
-import { join as join4, relative, sep } from "path";
-import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
-var META_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "QWEN.md"
-]);
-var FlatNestStorage = class extends NestStorage2 {
-  async discoverDocuments() {
-    const root = this.root;
-    let entries;
-    try {
-      entries = readdirSync(root, { recursive: true, withFileTypes: true });
-    } catch (err) {
-      console.error("[FlatNestStorage] cannot read folder", root, err);
-      return [];
-    }
-    const ids = [];
-    for (const e of entries) {
-      if (!e.isFile() || !e.name.endsWith(".md")) continue;
-      if (META_FILES.has(e.name)) continue;
-      const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
-      if (rel.split("/").some(isSkippedSegment)) continue;
-      ids.push(rel.replace(/\.md$/, ""));
-    }
-    const nodes = [];
-    for (const id of ids.sort()) {
-      try {
-        nodes.push(await this.readDocument(id));
-      } catch (err) {
-        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
-      }
-    }
-    return nodes;
+async function deleteTeam(params) {
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < OWNER_RANK) {
+    throw new ForbiddenError("Only the team owner can delete this team.");
   }
-};
-
-// src/nodes/engine.ts
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  async get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath = resolveNestPath(nestId);
-      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM teams WHERE id = ?", [params.teamId]);
+    await removeTeamRefs(tx, params.teamId);
+  });
+}
+async function addMember(params) {
+  assertValidRole(params.role);
+  const row = await loadTeamRow(params.teamId);
+  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
+  if (rank < ROLE_RANK.editor) {
+    throw new ForbiddenError(
+      "Only an editor or admin member (or the owner) can add people to this team."
+    );
   }
-  evict(nestId) {
-    this.cache.delete(nestId);
+  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
+    throw new ForbiddenError("You can't give a member a higher role than your own.");
   }
-};
-var engineCache = new NestEngineCache();
-
-// src/governance/title-resolver.ts
-async function buildTitleMap(nestId) {
-  try {
-    const { storage } = await engineCache.get(nestId);
-    const docs = await storage.discoverDocuments();
-    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
-  } catch {
-    return /* @__PURE__ */ new Map();
+  if (!params.userId && params.email && !isEmailish(params.email)) {
+    throw new ValidationError("Enter a valid email address.");
   }
+  const { userId: resolvedId, email: resolvedEmail } = await resolveMemberIdentity(params);
+  await mutateMembers(params.teamId, (members) => {
+    if (members.some((m) => m.userId === resolvedId)) {
+      throw new ConflictError(
+        `${resolvedEmail || "This user"} is already a member of this team. Change their role instead of adding them again.`
+      );
+    }
+    return [
+      ...members,
+      { userId: resolvedId, email: resolvedEmail, role: params.role }
+    ];
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-function folderForNode(nodeId) {
-  return nodeId.replace(/^nodes\//, "").split("/").slice(0, -1).join("/");
-}
-async function describeNode(nestId, nodeId) {
-  const titles = await buildTitleMap(nestId);
-  const title = titles.get(nodeId) || nodeId;
-  const folder = folderForNode(nodeId);
-  return folder ? `${title} (in ${folder})` : title;
-}
-async function nestName(nestId) {
-  try {
-    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-      nestId
+async function resolveMemberIdentity(params) {
+  const db = getDb();
+  if (params.userId) {
+    const u = await db.get("SELECT email FROM users WHERE id = ?", [
+      params.userId
     ]);
-    return row?.name || nestId;
-  } catch {
-    return nestId;
+    if (!u) throw new ValidationError("User not found");
+    return { userId: params.userId, email: normalizeEmail(u.email ?? "") };
   }
+  const requested = params.email ? normalizeEmail(params.email) : void 0;
+  if (!requested) {
+    throw new ValidationError("user_id or email is required");
+  }
+  const existing = await db.get(
+    "SELECT id, email FROM users WHERE LOWER(email) = ?",
+    [requested]
+  );
+  if (existing) {
+    return {
+      userId: existing.id,
+      email: normalizeEmail(existing.email ?? requested)
+    };
+  }
+  const { hashPassword } = await import("./keys-73STFJJB.js");
+  const userId = uuid();
+  await db.run(
+    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+    [userId, requested, null, await hashPassword(uuid())]
+  );
+  return { userId, email: requested };
 }
-function docLink(nestId, nodeId, baseUrl) {
-  const base = baseUrl || config.PUBLIC_BASE_URL;
-  if (!base) return "";
-  const q = new URLSearchParams({ nest: nestId });
-  if (nodeId) q.set("doc", nodeId);
-  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
+async function replaceTeamRoster(params) {
+  for (const m of params.members) assertValidRole(m.role);
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError(
+      "Only a team admin or the owner can replace this team's roster."
+    );
+  }
+  await mutateMembers(
+    params.teamId,
+    () => params.members.map((m) => ({
+      userId: m.userId,
+      email: m.email,
+      role: m.role
+    }))
+  );
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-async function buildDocContext(nestId, nodeId, baseUrl) {
-  const titles = await buildTitleMap(nestId);
-  const docTitle = titles.get(nodeId) || nodeId;
-  const folder = folderForNode(nodeId);
-  const name = await nestName(nestId);
-  return {
-    docTitle,
-    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
-    label: folder ? `${docTitle} (in ${folder})` : docTitle,
-    path: folder ? `${name} / ${folder}` : name,
-    link: docLink(nestId, nodeId, baseUrl)
-  };
+async function updateMemberRole(params) {
+  assertValidRole(params.role);
+  const row = await loadTeamRow(params.teamId);
+  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
+  if (rank < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can change roles.");
+  }
+  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
+    throw new ForbiddenError("You can't set a role higher than your own.");
+  }
+  await mutateMembers(params.teamId, (members) => {
+    const member = members.find((m) => m.userId === params.userId);
+    if (!member) throw new NotFoundError("Team member not found");
+    member.role = params.role;
+    return members;
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-
-// src/governance/teams-service.ts
-import { v4 as uuid2 } from "uuid";
-var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
-function parseMembers(json) {
+async function removeMember(params) {
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can remove members.");
+  }
+  await mutateMembers(params.teamId, (members) => {
+    const next = members.filter((m) => m.userId !== params.userId);
+    if (next.length === members.length) {
+      throw new NotFoundError("Team member not found");
+    }
+    return next;
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function mutateMembers(teamId, mutate) {
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    const row = await tx.get("SELECT members FROM teams WHERE id = ?", [
+      teamId
+    ]);
+    if (!row) throw new NotFoundError("Team not found");
+    const next = mutate(parseMembers(row.members));
+    await tx.run("UPDATE teams SET members = ?, updated_at = ? WHERE id = ?", [
+      JSON.stringify(next),
+      (/* @__PURE__ */ new Date()).toISOString(),
+      teamId
+    ]);
+  });
+}
+function parseSharedTeams(json) {
   if (!json) return [];
   try {
     const parsed = JSON.parse(json);
@@ -1041,512 +1287,727 @@ function parseMembers(json) {
     return [];
   }
 }
-function rowToTeam(row) {
-  return {
-    id: row.id,
-    name: row.name,
-    owner_id: row.owner_id,
-    members: parseMembers(row.members),
-    source: row.source ?? null,
-    external_id: row.external_id ?? null,
-    created_at: row.created_at,
-    updated_at: row.updated_at
-  };
+async function listNestTeams(nestId) {
+  const db = getDb();
+  const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
+    nestId
+  ]);
+  if (!row) throw new NotFoundError("Nest not found");
+  return parseSharedTeams(row.shared_teams);
 }
-async function enrichTeam(team) {
+async function shareTeamWithNest(params) {
   const db = getDb();
-  const ids = team.members.map((m) => m.userId);
-  const invited = /* @__PURE__ */ new Map();
-  if (ids.length) {
-    const rows = await db.all(
-      `SELECT id, is_invited FROM users WHERE id IN (${ids.map(() => "?").join(",")})`,
-      ids
+  let sharedMembers = [];
+  const refs = await db.transaction(async (tx) => {
+    const team = await tx.get(
+      "SELECT id, name, owner_id, members FROM teams WHERE id = ?",
+      [params.teamId]
     );
-    for (const r of rows) invited.set(r.id, r.is_invited);
+    if (!team) throw new NotFoundError("Team not found");
+    if (managementRank(team, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.editor) {
+      throw new ForbiddenError(
+        "You need to be an editor, admin, or owner of a team to share it. View-only members can't."
+      );
+    }
+    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
+      params.nestId
+    ]);
+    if (!nest) throw new NotFoundError("Nest not found");
+    const refs2 = parseSharedTeams(nest.shared_teams);
+    if (refs2.some((r) => r.teamId === params.teamId)) {
+      throw new ConflictError("This team is already shared with the nest.");
+    }
+    refs2.push({ teamId: team.id, teamName: team.name });
+    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+      JSON.stringify(refs2),
+      params.nestId
+    ]);
+    const members = parseMembers(team.members);
+    sharedMembers = members;
+    const hasGovernanceRole = members.some(
+      (m) => m.role === "viewer" || m.role === "editor"
+    );
+    if (hasGovernanceRole) {
+      await tx.run("UPDATE nests SET stewardship_enabled = 1 WHERE id = ?", [
+        params.nestId
+      ]);
+    }
+    return refs2;
+  });
+  try {
+    const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+      params.callerUserId
+    ]);
+    const callerEmail = caller?.email?.toLowerCase();
+    const shareNestName = await nestName(params.nestId);
+    const link = docLink(params.nestId, void 0, params.baseUrl);
+    const byRole = /* @__PURE__ */ new Map();
+    for (const m of sharedMembers) {
+      if (!m.email || m.email.toLowerCase() === callerEmail) continue;
+      const arr = byRole.get(m.role) ?? [];
+      arr.push(m.email);
+      byRole.set(m.role, arr);
+    }
+    for (const [role, emails] of byRole) {
+      if (emails.length === 0) continue;
+      void sendEmailToRecipient(emails, {
+        status: "shared",
+        docTitle: shareNestName,
+        path: shareNestName,
+        link,
+        permission: role,
+        by: caller?.email || void 0
+      });
+    }
+  } catch (err) {
+    console.error("[notify] team-share email fan-out failed", params.nestId, err);
   }
-  const owner = await db.get("SELECT email FROM users WHERE id = ?", [
-    team.owner_id
-  ]);
-  return {
-    ...team,
-    owner_email: owner?.email,
-    // Unknown id (deleted user) → treat as not registered.
-    members: team.members.map((m) => ({
-      ...m,
-      registered: (invited.get(m.userId) ?? 1) === 0
-    }))
-  };
+  return refs;
 }
-function assertValidRole(role) {
-  if (!VALID_TEAM_ROLES.includes(role)) {
-    throw new ValidationError(
-      "role must be admin, editor, or viewer"
+async function unshareTeamFromNest(params) {
+  const db = getDb();
+  return db.transaction(async (tx) => {
+    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
+      params.nestId
+    ]);
+    if (!nest) throw new NotFoundError("Nest not found");
+    const refs = parseSharedTeams(nest.shared_teams);
+    const next = refs.filter((r) => r.teamId !== params.teamId);
+    if (next.length === refs.length) {
+      throw new NotFoundError("Team is not shared with this nest.");
+    }
+    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+      JSON.stringify(next),
+      params.nestId
+    ]);
+    return next;
+  });
+}
+async function refreshTeamNameRefs(tx, teamId, newName) {
+  const nests = await tx.all(
+    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
+    [`%${teamId}%`]
+  );
+  for (const n of nests) {
+    const refs = parseSharedTeams(n.shared_teams);
+    let changed = false;
+    for (const r of refs) {
+      if (r.teamId === teamId && r.teamName !== newName) {
+        r.teamName = newName;
+        changed = true;
+      }
+    }
+    if (changed) {
+      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+        JSON.stringify(refs),
+        n.id
+      ]);
+    }
+  }
+}
+async function removeTeamRefs(tx, teamId) {
+  const nests = await tx.all(
+    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
+    [`%${teamId}%`]
+  );
+  for (const n of nests) {
+    const refs = parseSharedTeams(n.shared_teams);
+    const next = refs.filter((r) => r.teamId !== teamId);
+    if (next.length !== refs.length) {
+      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+        JSON.stringify(next),
+        n.id
+      ]);
+    }
+  }
+}
+async function resolveTeamRolesForUser(nestId, userId) {
+  const refs = await listNestTeams(nestId).catch(() => []);
+  if (refs.length === 0) return [];
+  const db = getDb();
+  const roles = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
+      ref.teamId
+    ]);
+    if (!row) continue;
+    const member = parseMembers(row.members).find((m) => m.userId === userId);
+    if (member) roles.add(member.role);
+  }
+  return [...roles];
+}
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+function teamRoleToPermission(role) {
+  switch (role) {
+    case "admin":
+      return "admin";
+    case "editor":
+      return "write";
+    case "viewer":
+      return "read";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+
+// src/shared/access.ts
+async function isServerAdminUserId(userId) {
+  if (await isLicenseAdminUserId(userId)) return true;
+  const row = await getDb().get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
+  return !!row?.email && isSuperAdmin(row.email);
+}
+var PERMISSION_LEVELS = {
+  none: 0,
+  read: 1,
+  write: 2,
+  admin: 3,
+  owner: 4
+};
+async function resolveNestPermission(nestId, userId) {
+  const db = getDb();
+  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
+  if (!nest) return "none";
+  if (nest.user_id === userId) return "owner";
+  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
+    return "owner";
+  }
+  if (await isLicenseAdminUserId(userId)) return "admin";
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  if (caller?.email && isSuperAdmin(caller.email)) {
+    return "admin";
+  }
+  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
+  let best = "none";
+  const directGrant = await db.get(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
+  if (directGrant) best = higher(best, directGrant.permission);
+  if (best === "admin") return best;
+  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
+    best = higher(best, teamRoleToPermission(role));
+  }
+  if (best === "admin") return best;
+  const stewardGrant = await db.get(
+    `SELECT 1 FROM stewards s
+         JOIN users u ON u.id = ?
+        WHERE s.nest_id = ? AND s.is_active = 1
+          AND LOWER(s.user_email) = LOWER(u.email)
+        LIMIT 1`,
+    [userId, nestId]
+  );
+  if (stewardGrant) best = higher(best, "read");
+  if (nest.visibility === "public") best = higher(best, "read");
+  return best;
+}
+function permissionLevel(p) {
+  return PERMISSION_LEVELS[p] ?? 0;
+}
+async function isPublicReader(nestId, userId) {
+  const db = getDb();
+  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
+  if (!nest) return false;
+  if (nest.visibility !== "public") return false;
+  if (nest.user_id === userId) return false;
+  const directGrant = await db.get(
+    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
+  if (directGrant) return false;
+  if (await isLicenseAdminUserId(userId)) return false;
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  if (caller?.email && isSuperAdmin(caller.email)) return false;
+  const stewardGrant = await db.get(
+    `SELECT 1 FROM stewards s
+         JOIN users u ON u.id = ?
+        WHERE s.nest_id = ? AND s.is_active = 1
+          AND LOWER(s.user_email) = LOWER(u.email)
+        LIMIT 1`,
+    [userId, nestId]
+  );
+  if (stewardGrant) return false;
+  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
+  return true;
+}
+
+// src/nests/service.ts
+async function isImportedNest(nestId) {
+  const row = await getDb().get(
+    "SELECT is_imported FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.is_imported;
+}
+function toSlug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+async function uniqueNestName(userId, baseName) {
+  const db = getDb();
+  let candidate = baseName;
+  let n = 0;
+  while (n < 1e3) {
+    const slug = toSlug(candidate);
+    const hit = await db.get(
+      "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+      [userId, slug]
     );
+    if (!hit) return candidate;
+    n++;
+    candidate = `${baseName} (${n})`;
   }
+  return candidate;
 }
-async function loadTeamRow(teamId) {
+async function isStewardshipEnabled(nestId) {
   const db = getDb();
-  const row = await db.get("SELECT * FROM teams WHERE id = ?", [
-    teamId
-  ]);
-  if (!row) throw new NotFoundError("Team not found");
-  return row;
-}
-var ROLE_RANK = {
-  viewer: 1,
-  editor: 2,
-  admin: 3
-};
-var OWNER_RANK = 4;
-function managementRank(row, callerUserId, allowAdmin) {
-  if (row.owner_id === callerUserId || allowAdmin) return OWNER_RANK;
-  const m = parseMembers(row.members).find((x) => x.userId === callerUserId);
-  return m ? ROLE_RANK[m.role] ?? 0 : 0;
+  const row = await db.get(
+    "SELECT stewardship_enabled FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.stewardship_enabled;
 }
-async function createTeam(params) {
-  const name = params.name?.trim();
-  if (!name) throw new ValidationError("Team name is required");
+async function setStewardshipEnabled(nestId, enabled) {
   const db = getDb();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid2();
-  await db.run(
-    "INSERT INTO teams (id, name, owner_id, members, source, external_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-    [
-      id,
-      name,
-      params.ownerId,
-      "[]",
-      params.source ?? null,
-      params.externalId ?? null,
-      now,
-      now
-    ]
-  );
-  return enrichTeam(rowToTeam(await loadTeamRow(id)));
+  await db.run("UPDATE nests SET stewardship_enabled = ? WHERE id = ?", [
+    enabled ? 1 : 0,
+    nestId
+  ]);
 }
-async function findTeamByExternalId(params) {
+async function nestAllowsSelfApprove(nestId) {
   const db = getDb();
   const row = await db.get(
-    "SELECT * FROM teams WHERE owner_id = ? AND source = ? AND external_id = ?",
-    [params.ownerId, params.source, params.externalId]
+    "SELECT allow_self_approve FROM nests WHERE id = ?",
+    [nestId]
   );
-  return row ? enrichTeam(rowToTeam(row)) : null;
+  return !!row?.allow_self_approve;
 }
-async function listTeamsForUser(userId) {
+async function setAllowSelfApprove(nestId, allow) {
   const db = getDb();
-  const rows = await db.all(
-    "SELECT * FROM teams WHERE owner_id = ? OR members LIKE ? ORDER BY created_at",
-    [userId, `%${userId}%`]
-  );
-  const mine = rows.filter(
-    (r) => r.owner_id === userId || parseMembers(r.members).some((m) => m.userId === userId)
-  );
-  return Promise.all(mine.map((r) => enrichTeam(rowToTeam(r))));
-}
-async function getTeam(teamId) {
-  return enrichTeam(rowToTeam(await loadTeamRow(teamId)));
+  await db.run("UPDATE nests SET allow_self_approve = ? WHERE id = ?", [
+    allow ? 1 : 0,
+    nestId
+  ]);
 }
-async function renameTeam(params) {
-  const name = params.name?.trim();
-  if (!name) throw new ValidationError("Team name is required");
-  const row = await loadTeamRow(params.teamId);
-  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
-    throw new ForbiddenError("Only a team admin or the owner can rename this team.");
-  }
+async function disableStewardshipAndWipeGovernance(nestId) {
   const db = getDb();
-  await db.transaction(async (tx) => {
-    await tx.run("UPDATE teams SET name = ?, updated_at = ? WHERE id = ?", [
-      name,
-      (/* @__PURE__ */ new Date()).toISOString(),
-      params.teamId
-    ]);
-    await refreshTeamNameRefs(tx, params.teamId, name);
+  return db.transaction(async (tx) => {
+    const id = nestId;
+    const stewards = (await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id])).changes;
+    const pendingReviews = (await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [id]
+    )).changes;
+    await tx.run("UPDATE nests SET stewardship_enabled = 0 WHERE id = ?", [id]);
+    return { stewards, pendingReviews };
   });
-  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-async function deleteTeam(params) {
-  const row = await loadTeamRow(params.teamId);
-  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < OWNER_RANK) {
-    throw new ForbiddenError("Only the team owner can delete this team.");
-  }
+async function renameNest(nestId, patch) {
   const db = getDb();
-  await db.transaction(async (tx) => {
-    await tx.run("DELETE FROM teams WHERE id = ?", [params.teamId]);
-    await removeTeamRefs(tx, params.teamId);
-  });
-}
-async function addMember(params) {
-  assertValidRole(params.role);
-  const row = await loadTeamRow(params.teamId);
-  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
-  if (rank < ROLE_RANK.editor) {
-    throw new ForbiddenError(
-      "Only an editor or admin member (or the owner) can add people to this team."
-    );
-  }
-  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
-    throw new ForbiddenError("You can't give a member a higher role than your own.");
+  const existing = await db.get("SELECT * FROM nests WHERE id = ?", [
+    nestId
+  ]);
+  if (!existing) {
+    throw new ValidationError("Nest not found");
   }
-  const { userId: resolvedId, email: resolvedEmail } = await resolveMemberIdentity(params);
-  await mutateMembers(params.teamId, (members) => {
-    if (members.some((m) => m.userId === resolvedId)) {
-      throw new ConflictError(
-        `${resolvedEmail || "This user"} is already a member of this team. Change their role instead of adding them again.`
+  const updates = [];
+  const params = [];
+  if (patch.name !== void 0) {
+    const trimmed = patch.name.trim();
+    if (!trimmed) throw new ValidationError("Name cannot be empty");
+    const slug = toSlug(trimmed);
+    if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
+    const conflict = await db.get(
+      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
+      [existing.user_id, slug, nestId]
+    );
+    if (conflict) {
+      throw new ValidationError(
+        `Another nest already uses this name. Pick a different one.`
       );
     }
-    return [
-      ...members,
-      { userId: resolvedId, email: resolvedEmail, role: params.role }
-    ];
-  });
-  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+    updates.push("name = ?", "slug = ?");
+    params.push(trimmed, slug);
+  }
+  if (patch.description !== void 0) {
+    updates.push("description = ?");
+    params.push(patch.description || null);
+  }
+  if (updates.length === 0) {
+    return existing;
+  }
+  params.push(nestId);
+  await db.run(
+    `UPDATE nests SET ${updates.join(", ")} WHERE id = ?`,
+    params
+  );
+  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]);
 }
-async function resolveMemberIdentity(params) {
+async function createNest(userId, name, description) {
+  const id = uuid2();
   const db = getDb();
-  if (params.userId) {
-    const u = await db.get("SELECT email FROM users WHERE id = ?", [
-      params.userId
-    ]);
-    if (!u) throw new ValidationError("User not found");
-    return { userId: params.userId, email: normalizeEmail(u.email ?? "") };
-  }
-  const requested = params.email ? normalizeEmail(params.email) : void 0;
-  if (!requested) {
-    throw new ValidationError("user_id or email is required");
+  const trimmed = name.trim();
+  if (!trimmed) throw new ValidationError("Name cannot be empty");
+  const slug = toSlug(trimmed);
+  if (!slug) {
+    throw new ValidationError(
+      "Name must contain at least one alphanumeric character"
+    );
   }
-  const existing = await db.get(
-    "SELECT id, email FROM users WHERE LOWER(email) = ?",
-    [requested]
+  const conflict = await db.get(
+    "SELECT id FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+    [userId, slug]
   );
-  if (existing) {
-    return {
-      userId: existing.id,
-      email: normalizeEmail(existing.email ?? requested)
-    };
+  if (conflict) {
+    throw new ValidationError(
+      "You already have a nest with this name. Pick a different one."
+    );
   }
-  const { hashPassword } = await import("./keys-73STFJJB.js");
-  const userId = uuid2();
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
   await db.run(
-    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [userId, requested, null, await hashPassword(uuid2())]
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
+    [id, userId, trimmed, slug, description || null, visibility]
   );
-  return { userId, email: requested };
+  const path = resolveNestPath(id);
+  mkdirSync(path, { recursive: true });
+  const storage = new NestStorage(path);
+  await storage.init(trimmed);
+  trackEvent("nest.create", { nestId: id, userId });
+  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function replaceTeamRoster(params) {
-  for (const m of params.members) assertValidRole(m.role);
-  const row = await loadTeamRow(params.teamId);
-  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
-    throw new ForbiddenError(
-      "Only a team admin or the owner can replace this team's roster."
-    );
+async function importNest(userId, name, files) {
+  const nm = (name || "").trim();
+  if (!nm) {
+    throw new ValidationError("name is required");
   }
-  await mutateMembers(
-    params.teamId,
-    () => params.members.map((m) => ({
-      userId: m.userId,
-      email: m.email,
-      role: m.role
-    }))
+  if (!Array.isArray(files)) {
+    throw new ValidationError("files are required");
+  }
+  const db = getDb();
+  const id = uuid2();
+  const slug = toSlug(nm);
+  const visibility = userId === ANON_USER_ID ? "public" : "private";
+  const dest = resolveNestPath(id);
+  mkdirSync(dest, { recursive: true });
+  try {
+    await writeImportedFiles(dest, files);
+  } catch (err) {
+    console.error("[nests] import write failed", dest, err);
+    discardImportDir(dest);
+    throw new ValidationError("Failed to import folder");
+  }
+  await db.run(
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)",
+    [id, userId, nm, slug, null, visibility]
   );
-  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+  trackEvent("nest.import", { nestId: id, userId });
+  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-async function updateMemberRole(params) {
-  assertValidRole(params.role);
-  const row = await loadTeamRow(params.teamId);
-  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
-  if (rank < ROLE_RANK.admin) {
-    throw new ForbiddenError("Only a team admin or the owner can change roles.");
+async function listNests(userId) {
+  const db = getDb();
+  if (userId === ANON_USER_ID) {
+    return await db.all(
+      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      [ANON_USER_ID]
+    );
   }
-  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
-    throw new ForbiddenError("You can't set a role higher than your own.");
+  const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
+  if (!includeAnon) {
+    return await db.all(
+      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      [userId]
+    );
   }
-  await mutateMembers(params.teamId, (members) => {
-    const member = members.find((m) => m.userId === params.userId);
-    if (!member) throw new NotFoundError("Team member not found");
-    member.role = params.role;
-    return members;
-  });
-  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+  return await db.all(
+    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
+    [userId, ANON_USER_ID]
+  );
 }
-async function removeMember(params) {
-  const row = await loadTeamRow(params.teamId);
-  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
-    throw new ForbiddenError("Only a team admin or the owner can remove members.");
+async function nestsSharedViaTeams(userId) {
+  const db = getDb();
+  const teams = await db.all(
+    "SELECT id, members FROM teams WHERE members LIKE ?",
+    [`%${userId}%`]
+  );
+  const myTeamIds = /* @__PURE__ */ new Set();
+  for (const t of teams) {
+    try {
+      const members = JSON.parse(t.members || "[]");
+      if (Array.isArray(members) && members.some((m) => m?.userId === userId)) {
+        myTeamIds.add(t.id);
+      }
+    } catch {
+    }
   }
-  await mutateMembers(params.teamId, (members) => {
-    const next = members.filter((m) => m.userId !== params.userId);
-    if (next.length === members.length) {
-      throw new NotFoundError("Team member not found");
+  if (myTeamIds.size === 0) return [];
+  const ids = [...myTeamIds];
+  const candidates = await db.all(
+    `SELECT * FROM nests
+       WHERE user_id != ?
+         AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
+    [userId, ...ids.map((id) => `%${id}%`)]
+  );
+  return candidates.filter((n) => {
+    try {
+      const refs = JSON.parse(n.shared_teams || "[]");
+      return Array.isArray(refs) && refs.some((r) => myTeamIds.has(r?.teamId));
+    } catch {
+      return false;
     }
-    return next;
   });
-  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
 }
-async function mutateMembers(teamId, mutate) {
+async function listSharedNests(userId) {
   const db = getDb();
-  await db.transaction(async (tx) => {
-    const row = await tx.get("SELECT members FROM teams WHERE id = ?", [
-      teamId
-    ]);
-    if (!row) throw new NotFoundError("Team not found");
-    const next = mutate(parseMembers(row.members));
-    await tx.run("UPDATE teams SET members = ?, updated_at = ? WHERE id = ?", [
-      JSON.stringify(next),
-      (/* @__PURE__ */ new Date()).toISOString(),
-      teamId
-    ]);
-  });
+  const direct = await db.all(
+    `SELECT DISTINCT n.* FROM nests n
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN stewards s
+         ON s.nest_id = n.id AND s.is_active = 1
+        AND LOWER(s.user_email) = LOWER(u.email)
+       WHERE n.user_id != ?
+         AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
+       ORDER BY n.created_at DESC`,
+    [userId, userId, userId]
+  );
+  const seen = new Set(direct.map((n) => n.id));
+  for (const n of await nestsSharedViaTeams(userId)) {
+    if (!seen.has(n.id)) {
+      direct.push(n);
+      seen.add(n.id);
+    }
+  }
+  if (await isServerAdminUserId(userId)) {
+    const anon = await db.all(
+      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      [ANON_USER_ID]
+    );
+    for (const n of anon) {
+      if (!seen.has(n.id)) {
+        direct.push(n);
+        seen.add(n.id);
+      }
+    }
+  }
+  direct.sort(
+    (a, b) => a.created_at === b.created_at ? 0 : a.created_at < b.created_at ? 1 : -1
+  );
+  return direct;
 }
-function parseSharedTeams(json) {
-  if (!json) return [];
-  try {
-    const parsed = JSON.parse(json);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
+async function listVisibleNests(userId) {
+  const db = getDb();
+  const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  const params = includeAnon ? [userId, userId, userId, ANON_USER_ID] : [userId, userId, userId];
+  const rows = await db.all(
+    `SELECT DISTINCT n.* FROM nests n
+       LEFT JOIN nest_collaborators nc
+         ON nc.nest_id = n.id AND nc.user_id = ?
+       LEFT JOIN users u ON u.id = ?
+       LEFT JOIN stewards s
+         ON s.nest_id = n.id AND s.is_active = 1
+        AND LOWER(s.user_email) = LOWER(u.email)
+      WHERE n.user_id = ?
+         OR nc.user_id IS NOT NULL
+         OR s.id IS NOT NULL
+         ${includeAnon ? "OR n.user_id = ?" : ""}
+      ORDER BY n.created_at DESC`,
+    params
+  );
+  const seen = new Set(rows.map((n) => n.id));
+  for (const n of await nestsSharedViaTeams(userId)) {
+    if (!seen.has(n.id)) {
+      rows.push(n);
+      seen.add(n.id);
+    }
   }
+  return rows;
 }
-async function listNestTeams(nestId) {
+async function listPublicNests(userId) {
   const db = getDb();
-  const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
-    nestId
-  ]);
-  if (!row) throw new NotFoundError("Nest not found");
-  return parseSharedTeams(row.shared_teams);
+  return await db.all(
+    `SELECT n.* FROM nests n
+       WHERE n.visibility = 'public'
+         AND n.user_id != ?
+         AND NOT EXISTS (
+           SELECT 1 FROM nest_collaborators nc
+           WHERE nc.nest_id = n.id AND nc.user_id = ?
+         )
+       ORDER BY n.created_at DESC`,
+    [userId, userId]
+  );
 }
-async function shareTeamWithNest(params) {
+async function getNest(nestId) {
   const db = getDb();
-  return db.transaction(async (tx) => {
-    const team = await tx.get(
-      "SELECT id, name, owner_id, members FROM teams WHERE id = ?",
-      [params.teamId]
-    );
-    if (!team) throw new NotFoundError("Team not found");
-    if (managementRank(team, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.editor) {
-      throw new ForbiddenError(
-        "You need to be an editor, admin, or owner of a team to share it. View-only members can't."
-      );
-    }
-    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
-      params.nestId
-    ]);
-    if (!nest) throw new NotFoundError("Nest not found");
-    const refs = parseSharedTeams(nest.shared_teams);
-    if (refs.some((r) => r.teamId === params.teamId)) {
-      throw new ConflictError("This team is already shared with the nest.");
-    }
-    refs.push({ teamId: team.id, teamName: team.name });
-    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
-      JSON.stringify(refs),
-      params.nestId
-    ]);
-    const hasGovernanceRole = parseMembers(team.members).some(
-      (m) => m.role === "viewer" || m.role === "editor"
-    );
-    if (hasGovernanceRole) {
-      await tx.run("UPDATE nests SET stewardship_enabled = 1 WHERE id = ?", [
-        params.nestId
-      ]);
-    }
-    return refs;
-  });
+  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]) || null;
 }
-async function unshareTeamFromNest(params) {
+async function deleteNest(nestId) {
   const db = getDb();
-  return db.transaction(async (tx) => {
-    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
-      params.nestId
-    ]);
-    if (!nest) throw new NotFoundError("Nest not found");
-    const refs = parseSharedTeams(nest.shared_teams);
-    const next = refs.filter((r) => r.teamId !== params.teamId);
-    if (next.length === refs.length) {
-      throw new NotFoundError("Team is not shared with this nest.");
+  await db.transaction(async (tx) => {
+    const id = nestId;
+    await tx.run("DELETE FROM approved_versions WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM node_versions WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM review_requests WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM nest_collaborators WHERE nest_id = ?", [id]);
+    try {
+      await tx.run("DELETE FROM node_tag_index WHERE nest_id = ?", [id]);
+    } catch {
     }
-    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
-      JSON.stringify(next),
-      params.nestId
-    ]);
-    return next;
+    await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM nests WHERE id = ?", [id]);
   });
+  const path = resolveNestPath(nestId);
+  try {
+    rmSync2(path, { recursive: true, force: true });
+  } catch (err) {
+    console.warn(`[nests] failed to remove nest directory ${path}:`, err);
+  }
+  trackEvent("nest.delete", { nestId });
 }
-async function refreshTeamNameRefs(tx, teamId, newName) {
-  const nests = await tx.all(
-    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
-    [`%${teamId}%`]
-  );
-  for (const n of nests) {
-    const refs = parseSharedTeams(n.shared_teams);
-    let changed = false;
-    for (const r of refs) {
-      if (r.teamId === teamId && r.teamName !== newName) {
-        r.teamName = newName;
-        changed = true;
-      }
+
+// src/nodes/flat-storage.ts
+import { readdirSync } from "fs";
+import { join as join4, relative, sep } from "path";
+import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
+var META_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "QWEN.md"
+]);
+var FlatNestStorage = class extends NestStorage2 {
+  async discoverDocuments() {
+    const root = this.root;
+    let entries;
+    try {
+      entries = readdirSync(root, { recursive: true, withFileTypes: true });
+    } catch (err) {
+      console.error("[FlatNestStorage] cannot read folder", root, err);
+      return [];
     }
-    if (changed) {
-      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
-        JSON.stringify(refs),
-        n.id
-      ]);
+    const ids = [];
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith(".md")) continue;
+      if (META_FILES.has(e.name)) continue;
+      const dir = e.parentPath ?? e.path ?? root;
+      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
+      if (rel.split("/").some(isSkippedSegment)) continue;
+      ids.push(rel.replace(/\.md$/, ""));
+    }
+    const nodes = [];
+    for (const id of ids.sort()) {
+      try {
+        nodes.push(await this.readDocument(id));
+      } catch (err) {
+        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+      }
     }
+    return nodes;
   }
-}
-async function removeTeamRefs(tx, teamId) {
-  const nests = await tx.all(
-    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
-    [`%${teamId}%`]
-  );
-  for (const n of nests) {
-    const refs = parseSharedTeams(n.shared_teams);
-    const next = refs.filter((r) => r.teamId !== teamId);
-    if (next.length !== refs.length) {
-      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
-        JSON.stringify(next),
-        n.id
-      ]);
+};
+
+// src/nodes/engine.ts
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  async get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = resolveNestPath(nestId);
+      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = { storage, query, versions };
+      this.cache.set(nestId, engine);
     }
+    return engine;
   }
-}
-async function resolveTeamRolesForUser(nestId, userId) {
-  const refs = await listNestTeams(nestId).catch(() => []);
-  if (refs.length === 0) return [];
-  const db = getDb();
-  const roles = /* @__PURE__ */ new Set();
-  for (const ref of refs) {
-    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
-      ref.teamId
-    ]);
-    if (!row) continue;
-    const member = parseMembers(row.members).find((m) => m.userId === userId);
-    if (member) roles.add(member.role);
+  evict(nestId) {
+    this.cache.delete(nestId);
   }
-  return [...roles];
-}
+};
+var engineCache = new NestEngineCache();
 
-// src/governance/roles.ts
-function collabPermToRole(permission) {
-  switch (permission) {
-    case "owner":
-      return "owner";
-    case "admin":
-      return "admin";
-    case "write":
-      return "editor";
-    case "read":
-      return "viewer";
-    default:
-      return null;
-  }
-}
-function teamRoleToPermission(role) {
-  switch (role) {
-    case "admin":
-      return "admin";
-    case "editor":
-      return "write";
-    case "viewer":
-      return "read";
-    default:
-      return null;
+// src/governance/title-resolver.ts
+async function buildTitleMap(nestId) {
+  try {
+    const { storage } = await engineCache.get(nestId);
+    const docs = await storage.discoverDocuments();
+    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
+  } catch {
+    return /* @__PURE__ */ new Map();
   }
 }
-var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
-var canViewWith = (roles) => roles.length > 0;
-var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var PRECEDENCE = [
-  "owner",
-  "admin",
-  "editor",
-  "reviewer",
-  "viewer"
-];
-function primaryRole(roles) {
-  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
-  return null;
+function folderForNode(nodeId) {
+  return nodeId.replace(/^nodes\//, "").split("/").slice(0, -1).join("/");
 }
-
-// src/shared/access.ts
-async function isServerAdminUserId(userId) {
-  if (await isLicenseAdminUserId(userId)) return true;
-  const row = await getDb().get(
-    "SELECT email FROM users WHERE id = ?",
-    [userId]
-  );
-  return !!row?.email && isSuperAdmin(row.email);
+async function describeNode(nestId, nodeId) {
+  const titles = await buildTitleMap(nestId);
+  const title = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  return folder ? `${title} (in ${folder})` : title;
 }
-var PERMISSION_LEVELS = {
-  none: 0,
-  read: 1,
-  write: 2,
-  admin: 3,
-  owner: 4
-};
-async function resolveNestPermission(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return "none";
-  if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
-    return "owner";
-  }
-  if (await isLicenseAdminUserId(userId)) return "admin";
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) {
-    return "admin";
-  }
-  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
-  let best = "none";
-  const directGrant = await db.get(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) best = higher(best, directGrant.permission);
-  if (best === "admin") return best;
-  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
-    best = higher(best, teamRoleToPermission(role));
+async function nestName(nestId) {
+  try {
+    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+      nestId
+    ]);
+    return row?.name || nestId;
+  } catch {
+    return nestId;
   }
-  if (best === "admin") return best;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
-  );
-  if (stewardGrant) best = higher(best, "read");
-  if (nest.visibility === "public") best = higher(best, "read");
-  return best;
 }
-function permissionLevel(p) {
-  return PERMISSION_LEVELS[p] ?? 0;
+function docLink(nestId, nodeId, baseUrl) {
+  const base = baseUrl || config.PUBLIC_BASE_URL;
+  if (!base) return "";
+  const q = new URLSearchParams({ nest: nestId });
+  if (nodeId) q.set("doc", nodeId);
+  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
 }
-async function isPublicReader(nestId, userId) {
-  const db = getDb();
-  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
-  if (!nest) return false;
-  if (nest.visibility !== "public") return false;
-  if (nest.user_id === userId) return false;
-  const directGrant = await db.get(
-    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  if (directGrant) return false;
-  if (await isLicenseAdminUserId(userId)) return false;
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  if (caller?.email && isSuperAdmin(caller.email)) return false;
-  const stewardGrant = await db.get(
-    `SELECT 1 FROM stewards s
-         JOIN users u ON u.id = ?
-        WHERE s.nest_id = ? AND s.is_active = 1
-          AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`,
-    [userId, nestId]
-  );
-  if (stewardGrant) return false;
-  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
-  return true;
+async function buildDocContext(nestId, nodeId, baseUrl) {
+  const titles = await buildTitleMap(nestId);
+  const docTitle = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  const name = await nestName(nestId);
+  return {
+    docTitle,
+    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
+    label: folder ? `${docTitle} (in ${folder})` : docTitle,
+    path: folder ? `${name} / ${folder}` : name,
+    link: docLink(nestId, nodeId, baseUrl)
+  };
 }
 
 // src/governance/stewardship-service.ts
@@ -1717,6 +2178,9 @@ async function createStewardRecord(params) {
   for (const user of params.users) {
     const email = user.email.trim().toLowerCase();
     if (!email) continue;
+    if (!isEmailish(email)) {
+      throw new ValidationError(`"${user.email}" is not a valid email address.`);
+    }
     if (email === actor) {
       throw new ValidationError(
         "You already manage this nest, so you can't add yourself as a steward."
@@ -1777,6 +2241,32 @@ async function createStewardRecord(params) {
     "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0",
     [params.nestId]
   );
+  if (results.length > 0) {
+    let scopeLabel;
+    if (params.scope === "document") {
+      const titles = await buildTitleMap(params.nestId);
+      const docTitle = titles.get(nodePattern) || nodePattern;
+      const capitalized = docTitle.charAt(0).toUpperCase() + docTitle.slice(1);
+      scopeLabel = `"${capitalized}" document`;
+    } else if (params.scope === "tag") {
+      scopeLabel = `#${tagName}`;
+    } else {
+      scopeLabel = "the whole nest";
+    }
+    const shareNestName = await nestName(params.nestId);
+    const link = docLink(params.nestId, void 0, params.baseUrl);
+    for (const s of results) {
+      void sendEmailToRecipient(s.userEmail, {
+        status: "steward",
+        docTitle: shareNestName,
+        path: shareNestName,
+        permission: s.role,
+        scopeLabel,
+        by: params.assignedBy || void 0,
+        link
+      });
+    }
+  }
   return results;
 }
 async function resolveStewardsForNode(nestId, nodeId) {
@@ -1872,6 +2362,20 @@ async function getCollaboratorRole(nestId, userEmail) {
   );
   return row?.permission ?? null;
 }
+async function resolveGrantRoles(nestId, userEmail, userId) {
+  const [grantRaw, stewardRoles, teamRoles] = await Promise.all([
+    getCollaboratorRole(nestId, userEmail),
+    getStewardRolesForUser(nestId, userEmail),
+    resolveTeamRolesForUser(nestId, userId)
+  ]);
+  return [
+    ...new Set(
+      [collabPermToRole(grantRaw), ...stewardRoles, ...teamRoles].filter(
+        Boolean
+      )
+    )
+  ];
+}
 async function resolveUserRoles(nestId, userEmail, opts) {
   const roles = /* @__PURE__ */ new Set();
   if (isSuperAdmin(userEmail)) roles.add("admin");
@@ -2099,26 +2603,9 @@ export {
   getAccessConfig,
   isSuperAdmin,
   isConfigSuperAdmin,
-  createTeam,
-  findTeamByExternalId,
-  listTeamsForUser,
-  getTeam,
-  renameTeam,
-  deleteTeam,
-  addMember,
-  resolveMemberIdentity,
-  replaceTeamRoster,
-  updateMemberRole,
-  removeMember,
-  listNestTeams,
-  shareTeamWithNest,
-  unshareTeamFromNest,
-  resolveTeamRolesForUser,
-  collabPermToRole,
-  isServerAdminUserId,
-  resolveNestPermission,
-  permissionLevel,
-  isPublicReader,
+  verifySmtp,
+  notifyEmailForNest,
+  sendEmailToRecipient,
   nestStorageRoot,
   resolveNestPath,
   uniqueNestName,
@@ -2132,6 +2619,7 @@ export {
   importNest,
   listNests,
   listSharedNests,
+  listVisibleNests,
   listPublicNests,
   getNest,
   deleteNest,
@@ -2141,6 +2629,24 @@ export {
   nestName,
   docLink,
   buildDocContext,
+  createTeam,
+  findTeamByExternalId,
+  listTeamsForUser,
+  getTeam,
+  renameTeam,
+  deleteTeam,
+  addMember,
+  resolveMemberIdentity,
+  replaceTeamRoster,
+  updateMemberRole,
+  removeMember,
+  listNestTeams,
+  shareTeamWithNest,
+  unshareTeamFromNest,
+  isServerAdminUserId,
+  resolveNestPermission,
+  permissionLevel,
+  isPublicReader,
   assignSteward,
   removeSteward,
   updateSteward,
@@ -2155,6 +2661,7 @@ export {
   getStewardRolesForUser,
   getStewardsForUser,
   getCollaboratorRole,
+  resolveGrantRoles,
   resolveUserRoles,
   canManageStewards,
   canCreateInNest,