@promptowl/contextnest-community 1.14.0 → 1.15.0

package/dist/{chunk-KPK656BH.js → chunk-7BOG3S5H.js}

@@ -4,209 +4,27 @@ import {
   NotFoundError,
   ValidationError
 } from "./chunk-GUNJTORH.js";
-import {
-  normalizeEmail
-} from "./chunk-FRQJWGN3.js";
-import {
-  insertOrReplace,
-  nowExpr
-} from "./chunk-XQ46F76G.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-I5KYGMIT.js";
+} from "./chunk-BCFKLY4H.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
-
-// src/governance/stewardship-service.ts
-import { v4 as uuid3 } from "uuid";
-
-// src/governance/access-service.ts
-import { readFileSync, existsSync } from "fs";
-import { join } from "path";
-var accessConfig = null;
-var grantedSuperAdmins = /* @__PURE__ */ new Set();
-async function loadGrantedSuperAdmins() {
-  const rows = await getDb().all(
-    "SELECT email FROM super_admins"
-  );
-  grantedSuperAdmins = new Set(rows.map((r) => r.email.toLowerCase()));
-}
-function loadAccessConfig() {
-  const candidates = [
-    join(config.DATA_ROOT, "access.yaml"),
-    join(config.DATA_ROOT, "access.yml")
-  ];
-  for (const path of candidates) {
-    if (existsSync(path)) {
-      const content = readFileSync(path, "utf-8");
-      accessConfig = parseAccessYaml(content);
-      return accessConfig;
-    }
-  }
-  accessConfig = null;
-  return null;
-}
-function getAccessConfig() {
-  return accessConfig;
-}
-function isSuperAdmin(email) {
-  const lower = email.toLowerCase();
-  if (grantedSuperAdmins.has(lower)) return true;
-  return isConfigSuperAdmin(lower);
-}
-function isConfigSuperAdmin(email) {
-  if (!accessConfig?.super_admins) return false;
-  return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
-}
-function parseAccessYaml(content) {
-  const result = {};
-  const lines = content.split("\n");
-  let currentSection = null;
-  let currentGroup = null;
-  let inMembers = false;
-  for (const rawLine of lines) {
-    const line = rawLine.trimEnd();
-    if (!line || line.startsWith("#")) continue;
-    if (!line.startsWith(" ") && !line.startsWith("	")) {
-      const match = line.match(/^(\w+):\s*(.*)?$/);
-      if (!match) continue;
-      const key = match[1];
-      const value = match[2]?.trim();
-      if (key === "mode") {
-        result.mode = value;
-        currentSection = null;
-      } else if (key === "allowed_users") {
-        currentSection = "allowed_users";
-        result.allowed_users = [];
-      } else if (key === "groups") {
-        currentSection = "groups";
-        result.groups = {};
-      } else if (key === "super_admins") {
-        currentSection = "super_admins";
-        result.super_admins = [];
-      }
-      currentGroup = null;
-      inMembers = false;
-      continue;
-    }
-    const listMatch = line.match(/^\s+-\s+["']?([^"'\n]+?)["']?\s*$/);
-    if (currentSection === "allowed_users" && listMatch) {
-      result.allowed_users.push(listMatch[1].trim());
-      continue;
-    }
-    if (currentSection === "super_admins" && listMatch) {
-      result.super_admins.push(listMatch[1].trim());
-      continue;
-    }
-    if (currentSection === "groups") {
-      const groupMatch = line.match(/^  (\w+):$/);
-      if (groupMatch) {
-        currentGroup = groupMatch[1];
-        result.groups[currentGroup] = { members: [], default_permission: "read" };
-        inMembers = false;
-        continue;
-      }
-      if (currentGroup) {
-        const propMatch = line.match(/^\s{4}(\w+):\s*(.*)?$/);
-        if (propMatch) {
-          const prop = propMatch[1];
-          const val = propMatch[2]?.trim();
-          if (prop === "default_permission" && val) {
-            result.groups[currentGroup].default_permission = val;
-          }
-          if (prop === "members") {
-            inMembers = true;
-          }
-          continue;
-        }
-        if (inMembers && listMatch) {
-          result.groups[currentGroup].members.push(listMatch[1].trim());
-        }
-      }
-    }
-  }
-  return result;
-}
-
-// src/nodes/engine.ts
 import {
-  NestStorage as NestStorage3,
-  GraphQueryEngine,
-  VersionManager
-} from "@promptowl/contextnest-engine";
-
-// src/nests/service.ts
-import { rmSync as rmSync2, mkdirSync } from "fs";
-import { v4 as uuid2 } from "uuid";
-import { NestStorage } from "@promptowl/contextnest-engine";
+  normalizeEmail
+} from "./chunk-FRQJWGN3.js";
 
-// src/fs/vault-import.ts
-import { rmSync } from "fs";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join2, dirname, isAbsolute } from "path";
-function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
-}
-var ALLOWED_DOT_DIRS = /* @__PURE__ */ new Set([".versions", ".context"]);
-function safeSegments(rel) {
-  if (!rel || isAbsolute(rel)) return null;
-  const segs = rel.split(/[\\/]/).filter(Boolean);
-  if (!segs.length) return null;
-  for (const s of segs) {
-    if (s === "..") return null;
-    if (!ALLOWED_DOT_DIRS.has(s) && isSkippedSegment(s)) return null;
-  }
-  return segs;
-}
-var WRITE_CONCURRENCY = 32;
-async function writeImportedFiles(dest, files) {
-  const targets = [];
-  const skipped = [];
-  for (const f of files) {
-    const segs = safeSegments(f?.path || "");
-    if (!segs) {
-      skipped.push(f?.path || "(empty)");
-      continue;
-    }
-    targets.push({ full: join2(dest, ...segs), content: f.content ?? "" });
-  }
-  const dirs = new Set(targets.map((t) => dirname(t.full)));
-  await Promise.all([...dirs].map((d) => mkdir(d, { recursive: true })));
-  let written = 0;
-  for (let i = 0; i < targets.length; i += WRITE_CONCURRENCY) {
-    const batch = targets.slice(i, i + WRITE_CONCURRENCY);
-    await Promise.all(
-      batch.map(async (t) => {
-        await writeFile(t.full, t.content, "utf-8");
-        written++;
-      })
-    );
-  }
-  console.log(
-    `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
-  );
-  if (skipped.length) {
-    console.log("[import] skipped (unsafe/hidden path):", skipped.join(", "));
-  }
-  return written;
-}
-function discardImportDir(dest) {
-  try {
-    rmSync(dest, { recursive: true, force: true });
-  } catch {
-  }
+// src/db/sql.ts
+function nowExpr(db) {
+  return db.dialect === "sqlite" ? "datetime('now')" : "to_char((now() AT TIME ZONE 'utc'), 'YYYY-MM-DD HH24:MI:SS')";
 }
-
-// src/shared/paths.ts
-import { join as join3 } from "path";
-function nestStorageRoot() {
-  return config.NEST_STORAGE_ROOT;
+function insertOrIgnore(db, insertSql) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR IGNORE INTO") : `${insertSql} ON CONFLICT DO NOTHING`;
 }
-function resolveNestPath(nestId) {
-  return join3(nestStorageRoot(), nestId);
+function insertOrReplace(db, insertSql, conflictCols, set) {
+  return db.dialect === "sqlite" ? insertSql.replace(/^\s*INSERT\s+INTO/i, "INSERT OR REPLACE INTO") : `${insertSql} ON CONFLICT (${conflictCols.join(", ")}) DO UPDATE SET ${set}`;
 }
 
 // src/telemetry/tracker.ts
@@ -640,53 +458,173 @@ async function _validateLicenseImpl(forceFresh) {
   }
 }
 
-// src/governance/teams-service.ts
-import { v4 as uuid } from "uuid";
-
-// src/notify/email-render.ts
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+// src/governance/access-service.ts
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+var accessConfig = null;
+var grantedSuperAdmins = /* @__PURE__ */ new Set();
+async function loadGrantedSuperAdmins() {
+  const rows = await getDb().all(
+    "SELECT email FROM super_admins"
+  );
+  grantedSuperAdmins = new Set(rows.map((r) => r.email.toLowerCase()));
 }
-var EVENT = {
-  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
-  ":x:": { icon: "\u274C", color: "#dc2626" },
-  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
-  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
-};
-var ALL_EMOJI = Object.fromEntries(
-  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
-);
-function renderText(message) {
-  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
+function loadAccessConfig() {
+  const candidates = [
+    join(config.DATA_ROOT, "access.yaml"),
+    join(config.DATA_ROOT, "access.yml")
+  ];
+  for (const path of candidates) {
+    if (existsSync(path)) {
+      const content = readFileSync(path, "utf-8");
+      accessConfig = parseAccessYaml(content);
+      return accessConfig;
+    }
+  }
+  accessConfig = null;
+  return null;
 }
-var STATUS_META = {
-  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
-  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
-  pending_review: {
-    subjectWord: "awaiting review",
-    label: "Pending review",
-    color: "#d97706"
-  },
-  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" },
-  invited: { subjectWord: "invited you", label: "Invitation", color: "#2563eb" },
-  steward: { subjectWord: "steward", label: "Steward", color: "#7c3aed" }
-};
-var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
-var detailRow = (label, valueHtml) => `<tr>
-      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
-      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
-    </tr>`;
-var plainRow = (label, value) => ({
-  label,
-  text: value,
-  html: escapeHtml(value)
-});
-var governanceRows = (x) => [
-  plainRow("Path", x.d.path),
-  { label: "Status", text: x.meta.label, html: x.statusBadge },
-  ...x.d.version != null ? [plainRow("Version", `v${x.d.version}`)] : []
-];
-var TEMPLATES = {
+function getAccessConfig() {
+  return accessConfig;
+}
+function isSuperAdmin(email) {
+  const lower = email.toLowerCase();
+  if (grantedSuperAdmins.has(lower)) return true;
+  return isConfigSuperAdmin(lower);
+}
+function isConfigSuperAdmin(email) {
+  if (!accessConfig?.super_admins) return false;
+  return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
+}
+function parseAccessYaml(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let currentSection = null;
+  let currentGroup = null;
+  let inMembers = false;
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    if (!line || line.startsWith("#")) continue;
+    if (!line.startsWith(" ") && !line.startsWith("	")) {
+      const match = line.match(/^(\w+):\s*(.*)?$/);
+      if (!match) continue;
+      const key = match[1];
+      const value = match[2]?.trim();
+      if (key === "mode") {
+        result.mode = value;
+        currentSection = null;
+      } else if (key === "allowed_users") {
+        currentSection = "allowed_users";
+        result.allowed_users = [];
+      } else if (key === "groups") {
+        currentSection = "groups";
+        result.groups = {};
+      } else if (key === "super_admins") {
+        currentSection = "super_admins";
+        result.super_admins = [];
+      }
+      currentGroup = null;
+      inMembers = false;
+      continue;
+    }
+    const listMatch = line.match(/^\s+-\s+["']?([^"'\n]+?)["']?\s*$/);
+    if (currentSection === "allowed_users" && listMatch) {
+      result.allowed_users.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "super_admins" && listMatch) {
+      result.super_admins.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "groups") {
+      const groupMatch = line.match(/^  (\w+):$/);
+      if (groupMatch) {
+        currentGroup = groupMatch[1];
+        result.groups[currentGroup] = { members: [], default_permission: "read" };
+        inMembers = false;
+        continue;
+      }
+      if (currentGroup) {
+        const propMatch = line.match(/^\s{4}(\w+):\s*(.*)?$/);
+        if (propMatch) {
+          const prop = propMatch[1];
+          const val = propMatch[2]?.trim();
+          if (prop === "default_permission" && val) {
+            result.groups[currentGroup].default_permission = val;
+          }
+          if (prop === "members") {
+            inMembers = true;
+          }
+          continue;
+        }
+        if (inMembers && listMatch) {
+          result.groups[currentGroup].members.push(listMatch[1].trim());
+        }
+      }
+    }
+  }
+  return result;
+}
+
+// src/notify/email-render.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var EVENT = {
+  ":white_check_mark:": { icon: "\u2705", color: "#16a34a" },
+  ":x:": { icon: "\u274C", color: "#dc2626" },
+  ":memo:": { icon: "\u{1F4DD}", color: "#d97706" },
+  ":key:": { icon: "\u{1F511}", color: "#2563eb" }
+};
+var ALL_EMOJI = Object.fromEntries(
+  Object.entries(EVENT).map(([code, m]) => [code, m.icon])
+);
+function renderText(message) {
+  return message.replace(/:[a-z_]+:/g, (m) => ALL_EMOJI[m] ?? "").replace(/\*/g, "").replace(/[ \t]{2,}/g, " ").trim();
+}
+var STATUS_META = {
+  approved: { subjectWord: "approved", label: "Approved", color: "#16a34a" },
+  rejected: { subjectWord: "rejected", label: "Rejected", color: "#dc2626" },
+  pending_review: {
+    subjectWord: "awaiting review",
+    label: "Pending review",
+    color: "#d97706"
+  },
+  shared: { subjectWord: "shared with you", label: "Shared", color: "#2563eb" },
+  invited: { subjectWord: "invited you", label: "Invitation", color: "#2563eb" },
+  steward: { subjectWord: "steward", label: "Steward", color: "#7c3aed" },
+  deletion_requested: {
+    subjectWord: "flagged for deletion",
+    label: "Deletion requested",
+    color: "#d97706"
+  },
+  deletion_declined: {
+    subjectWord: "kept",
+    label: "Deletion declined",
+    color: "#d97706"
+  },
+  deletion_deleted: {
+    subjectWord: "deleted",
+    label: "Deleted",
+    color: "#dc2626"
+  }
+};
+var cap = (s) => s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+var detailRow = (label, valueHtml) => `<tr>
+      <td style="padding:5px 0;font-size:13px;color:#6b7280;width:90px;vertical-align:top;">${label}</td>
+      <td style="padding:5px 0;font-size:13px;color:#111827;vertical-align:top;">${valueHtml}</td>
+    </tr>`;
+var plainRow = (label, value) => ({
+  label,
+  text: value,
+  html: escapeHtml(value)
+});
+var governanceRows = (x) => [
+  plainRow("Path", x.d.path),
+  { label: "Status", text: x.meta.label, html: x.statusBadge },
+  ...x.d.version != null ? [plainRow("Version", `v${x.d.version}`)] : []
+];
+var TEMPLATES = {
   approved: {
     heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
     detailsHeader: "Document details",
@@ -739,6 +677,32 @@ var TEMPLATES = {
       ] : []
     ]
   },
+  // Deletion requests reuse the governance details block — same "what/where/
+  // status" shape, and the reason/note rides in `note` like a review note.
+  deletion_requested: {
+    heading: (x) => `${x.title} is ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Review the request",
+    lineT: (x) => `${x.title} has been flagged for deletion${x.byT}${x.noteT}. Delete it or decline the request from the nest.`,
+    lineH: (x) => `${x.doc} has been flagged for deletion${x.byH}${x.noteH}. Delete it or decline the request from the nest.`,
+    rows: governanceRows
+  },
+  deletion_declined: {
+    heading: (x) => `Your deletion request for ${x.title} was declined`,
+    detailsHeader: "Document details",
+    linkLabel: "Open document",
+    lineT: (x) => `Your request to delete ${x.title} was declined${x.byT}${x.noteT}. The document stays.`,
+    lineH: (x) => `Your request to delete ${x.doc} was declined${x.byH}${x.noteH}. The document stays.`,
+    rows: governanceRows
+  },
+  deletion_deleted: {
+    heading: (x) => `${x.title} was ${x.meta.subjectWord}`,
+    detailsHeader: "Document details",
+    linkLabel: "Open nest",
+    lineT: (x) => `${x.title} has been deleted${x.byT}${x.noteT} \u2014 your deletion request was accepted.`,
+    lineH: (x) => `${x.doc} has been deleted${x.byH}${x.noteH} \u2014 your deletion request was accepted.`,
+    rows: governanceRows
+  },
   steward: {
     heading: (x) => `You're now a steward of ${x.title}`,
     detailsHeader: "Details",
@@ -1008,70 +972,284 @@ async function sendEmailToRecipient(to, details) {
   }
 }
 
-// src/governance/teams-service.ts
-var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
-function parseMembers(json) {
-  if (!json) return [];
-  try {
-    const parsed = JSON.parse(json);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
+// src/nests/service.ts
+import { rmSync as rmSync2, mkdirSync } from "fs";
+import { v4 as uuid2 } from "uuid";
+import { NestStorage as NestStorage3 } from "@promptowl/contextnest-engine";
+
+// src/fs/vault-import.ts
+import { rmSync } from "fs";
+import { writeFile, mkdir } from "fs/promises";
+import { join as join2, dirname, isAbsolute } from "path";
+function isSkippedSegment(segment) {
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
 }
-function rowToTeam(row) {
-  return {
-    id: row.id,
-    name: row.name,
-    owner_id: row.owner_id,
-    members: parseMembers(row.members),
-    source: row.source ?? null,
-    external_id: row.external_id ?? null,
-    created_at: row.created_at,
-    updated_at: row.updated_at
-  };
+var ALLOWED_DOT_DIRS = /* @__PURE__ */ new Set([".versions", ".context"]);
+function safeSegments(rel) {
+  if (!rel || isAbsolute(rel)) return null;
+  const segs = rel.split(/[\\/]/).filter(Boolean);
+  if (!segs.length) return null;
+  for (const s of segs) {
+    if (s === "..") return null;
+    if (!ALLOWED_DOT_DIRS.has(s) && isSkippedSegment(s)) return null;
+  }
+  return segs;
 }
-async function enrichTeam(team) {
-  const db = getDb();
-  const ids = team.members.map((m) => m.userId);
-  const invited = /* @__PURE__ */ new Map();
-  if (ids.length) {
-    const rows = await db.all(
-      `SELECT id, is_invited FROM users WHERE id IN (${ids.map(() => "?").join(",")})`,
-      ids
+var WRITE_CONCURRENCY = 32;
+async function writeImportedFiles(dest, files) {
+  const targets = [];
+  const skipped = [];
+  for (const f of files) {
+    const segs = safeSegments(f?.path || "");
+    if (!segs) {
+      skipped.push(f?.path || "(empty)");
+      continue;
+    }
+    targets.push({ full: join2(dest, ...segs), content: f.content ?? "" });
+  }
+  const dirs = new Set(targets.map((t) => dirname(t.full)));
+  await Promise.all([...dirs].map((d) => mkdir(d, { recursive: true })));
+  let written = 0;
+  for (let i = 0; i < targets.length; i += WRITE_CONCURRENCY) {
+    const batch = targets.slice(i, i + WRITE_CONCURRENCY);
+    await Promise.all(
+      batch.map(async (t) => {
+        await writeFile(t.full, t.content, "utf-8");
+        written++;
+      })
     );
-    for (const r of rows) invited.set(r.id, r.is_invited);
   }
-  const owner = await db.get("SELECT email FROM users WHERE id = ?", [
-    team.owner_id
-  ]);
-  return {
-    ...team,
-    owner_email: owner?.email,
-    // Unknown id (deleted user) → treat as not registered.
-    members: team.members.map((m) => ({
-      ...m,
-      registered: (invited.get(m.userId) ?? 1) === 0
-    }))
-  };
+  console.log(
+    `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
+  );
+  if (skipped.length) {
+    console.log("[import] skipped (unsafe/hidden path):", skipped.join(", "));
+  }
+  return written;
 }
-function assertValidRole(role) {
-  if (!VALID_TEAM_ROLES.includes(role)) {
-    throw new ValidationError(
-      "role must be admin, editor, or viewer"
-    );
+function discardImportDir(dest) {
+  try {
+    rmSync(dest, { recursive: true, force: true });
+  } catch {
   }
 }
-async function loadTeamRow(teamId) {
-  const db = getDb();
-  const row = await db.get("SELECT * FROM teams WHERE id = ?", [
-    teamId
-  ]);
-  if (!row) throw new NotFoundError("Team not found");
-  return row;
+
+// src/shared/paths.ts
+import { join as join3 } from "path";
+function nestStorageRoot() {
+  return config.NEST_STORAGE_ROOT;
 }
-var ROLE_RANK = {
-  viewer: 1,
+function resolveNestPath(nestId) {
+  return join3(nestStorageRoot(), nestId);
+}
+
+// src/governance/teams-service.ts
+import { v4 as uuid } from "uuid";
+
+// src/nodes/engine.ts
+import {
+  NestStorage as NestStorage2,
+  GraphQueryEngine,
+  VersionManager
+} from "@promptowl/contextnest-engine";
+
+// src/nodes/flat-storage.ts
+import { readdirSync } from "fs";
+import { join as join4, relative, sep } from "path";
+import { NestStorage } from "@promptowl/contextnest-engine";
+var META_FILES = /* @__PURE__ */ new Set([
+  "INDEX.md",
+  "CONTEXT.md",
+  "CLAUDE.md",
+  "GEMINI.md",
+  "AGENTS.md",
+  "QWEN.md"
+]);
+var FlatNestStorage = class extends NestStorage {
+  async discoverDocuments() {
+    const root = this.root;
+    let entries;
+    try {
+      entries = readdirSync(root, { recursive: true, withFileTypes: true });
+    } catch (err) {
+      console.error("[FlatNestStorage] cannot read folder", root, err);
+      return [];
+    }
+    const ids = [];
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith(".md")) continue;
+      if (META_FILES.has(e.name)) continue;
+      const dir = e.parentPath ?? e.path ?? root;
+      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
+      if (rel.split("/").some(isSkippedSegment)) continue;
+      ids.push(rel.replace(/\.md$/, ""));
+    }
+    const nodes = [];
+    for (const id of ids.sort()) {
+      try {
+        nodes.push(await this.readDocument(id));
+      } catch (err) {
+        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
+      }
+    }
+    return nodes;
+  }
+};
+
+// src/nodes/engine.ts
+var NestEngineCache = class {
+  cache = /* @__PURE__ */ new Map();
+  async get(nestId) {
+    let engine = this.cache.get(nestId);
+    if (!engine) {
+      const nestPath = resolveNestPath(nestId);
+      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage2(nestPath);
+      const query = new GraphQueryEngine(storage);
+      const versions = new VersionManager(storage);
+      engine = { storage, query, versions };
+      this.cache.set(nestId, engine);
+    }
+    return engine;
+  }
+  evict(nestId) {
+    this.cache.delete(nestId);
+  }
+};
+var engineCache = new NestEngineCache();
+
+// src/governance/title-resolver.ts
+async function buildTitleMap(nestId) {
+  try {
+    const { storage } = await engineCache.get(nestId);
+    const docs = await storage.discoverDocuments();
+    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function folderForNode(nodeId) {
+  const segments = nodeId.split("/");
+  const root = segments.indexOf("nodes");
+  return segments.slice(root + 1, -1).join("/");
+}
+async function describeNode(nestId, nodeId) {
+  const title = await titleForNode(nestId, nodeId);
+  const folder = folderForNode(nodeId);
+  return folder ? `${title} (in ${folder})` : title;
+}
+async function titleForNode(nestId, nodeId) {
+  const titles = await buildTitleMap(nestId);
+  return titles.get(nodeId) || titleFallback(titles, nodeId);
+}
+function titleFallback(titles, nodeId) {
+  const at = nodeId.indexOf("nodes/");
+  if (at > 0) {
+    const normalized = nodeId.slice(at);
+    const hit = titles.get(normalized);
+    if (hit) return hit;
+  }
+  return nodeId.split("/").pop() || nodeId;
+}
+function prettyFolderPath(path) {
+  return path.replace(/^nodes\//, "").split("/").filter(Boolean).map(
+    (seg) => seg.split(/[-_]/).map((s) => s ? s[0].toUpperCase() + s.slice(1) : s).join(" ")
+  ).join(" / ");
+}
+async function nestName(nestId) {
+  try {
+    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
+      nestId
+    ]);
+    return row?.name || nestId;
+  } catch {
+    return nestId;
+  }
+}
+function docLink(nestId, nodeId, baseUrl) {
+  const base = baseUrl || config.PUBLIC_BASE_URL;
+  if (!base) return "";
+  const q = new URLSearchParams({ nest: nestId });
+  if (nodeId) q.set("doc", nodeId);
+  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
+}
+async function buildDocContext(nestId, nodeId, baseUrl) {
+  const titles = await buildTitleMap(nestId);
+  const docTitle = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  const name = await nestName(nestId);
+  return {
+    docTitle,
+    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
+    label: folder ? `${docTitle} (in ${folder})` : docTitle,
+    path: folder ? `${name} / ${folder}` : name,
+    link: docLink(nestId, nodeId, baseUrl)
+  };
+}
+
+// src/governance/teams-service.ts
+var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
+function parseMembers(json) {
+  if (!json) return [];
+  try {
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function rowToTeam(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    owner_id: row.owner_id,
+    members: parseMembers(row.members),
+    source: row.source ?? null,
+    external_id: row.external_id ?? null,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+async function enrichTeam(team) {
+  const db = getDb();
+  const ids = team.members.map((m) => m.userId);
+  const invited = /* @__PURE__ */ new Map();
+  if (ids.length) {
+    const rows = await db.all(
+      `SELECT id, is_invited FROM users WHERE id IN (${ids.map(() => "?").join(",")})`,
+      ids
+    );
+    for (const r of rows) invited.set(r.id, r.is_invited);
+  }
+  const owner = await db.get("SELECT email FROM users WHERE id = ?", [
+    team.owner_id
+  ]);
+  return {
+    ...team,
+    owner_email: owner?.email,
+    // Unknown id (deleted user) → treat as not registered.
+    members: team.members.map((m) => ({
+      ...m,
+      registered: (invited.get(m.userId) ?? 1) === 0
+    }))
+  };
+}
+function assertValidRole(role) {
+  if (!VALID_TEAM_ROLES.includes(role)) {
+    throw new ValidationError(
+      "role must be admin, editor, or viewer"
+    );
+  }
+}
+async function loadTeamRow(teamId) {
+  const db = getDb();
+  const row = await db.get("SELECT * FROM teams WHERE id = ?", [
+    teamId
+  ]);
+  if (!row) throw new NotFoundError("Team not found");
+  return row;
+}
+var ROLE_RANK = {
+  viewer: 1,
   editor: 2,
   admin: 3
 };
@@ -1467,6 +1645,7 @@ function teamRoleToPermission(role) {
 var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
 var canViewWith = (roles) => roles.length > 0;
 var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var canApproveWith = (roles) => includesAny(roles, ["owner", "admin", "reviewer"]);
 var PRECEDENCE = [
   "owner",
   "admin",
@@ -1562,6 +1741,39 @@ async function isPublicReader(nestId, userId) {
   return true;
 }
 
+// src/governance/tag-index-service.ts
+function normalizeTag(raw) {
+  return raw.trim().replace(/^#+/, "").toLowerCase();
+}
+async function syncNodeTags(nestId, nodeId, tags) {
+  const db = getDb();
+  const normalized = Array.from(
+    new Set(
+      tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
+    )
+  );
+  const insertSql = insertOrIgnore(
+    db,
+    "INSERT INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+  );
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    for (const tag of normalized) {
+      await tx.run(insertSql, [nestId, nodeId, tag]);
+    }
+  });
+}
+async function removeNodeFromTagIndex(nestId, nodeId) {
+  const db = getDb();
+  await db.run(
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  );
+}
+
 // src/nests/service.ts
 async function isImportedNest(nestId) {
   const row = await getDb().get(
@@ -1619,6 +1831,43 @@ async function setAllowSelfApprove(nestId, allow) {
     nestId
   ]);
 }
+async function nestReviewsPrimeOnly(nestId) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT prime_only_review FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.prime_only_review;
+}
+async function setPrimeOnlyReview(nestId, enabled) {
+  const db = getDb();
+  await db.run("UPDATE nests SET prime_only_review = ? WHERE id = ?", [
+    enabled ? 1 : 0,
+    nestId
+  ]);
+}
+async function nestPrimeTags(nestId) {
+  const db = getDb();
+  const row = await db.get("SELECT prime_tags FROM nests WHERE id = ?", [
+    nestId
+  ]);
+  return parsePrimeTags(row?.prime_tags);
+}
+async function setPrimeTags(nestId, tags) {
+  const db = getDb();
+  await db.run("UPDATE nests SET prime_tags = ? WHERE id = ?", [
+    parsePrimeTags(tags.join(",")).join(","),
+    nestId
+  ]);
+}
+function parsePrimeTags(raw) {
+  if (!raw) return [];
+  return [
+    ...new Set(
+      raw.split(",").map((t) => normalizeTag(t)).filter(Boolean)
+    )
+  ];
+}
 async function disableStewardshipAndWipeGovernance(nestId) {
   const db = getDb();
   return db.transaction(async (tx) => {
@@ -1700,7 +1949,7 @@ async function createNest(userId, name, description) {
   );
   const path = resolveNestPath(id);
   mkdirSync(path, { recursive: true });
-  const storage = new NestStorage(path);
+  const storage = new NestStorage3(path);
   await storage.init(trimmed);
   trackEvent("nest.create", { nestId: id, userId });
   return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
@@ -1896,696 +2145,10 @@ async function deleteNest(nestId) {
   trackEvent("nest.delete", { nestId });
 }
 
-// src/nodes/flat-storage.ts
-import { readdirSync } from "fs";
-import { join as join4, relative, sep } from "path";
-import { NestStorage as NestStorage2 } from "@promptowl/contextnest-engine";
-var META_FILES = /* @__PURE__ */ new Set([
-  "INDEX.md",
-  "CONTEXT.md",
-  "CLAUDE.md",
-  "GEMINI.md",
-  "AGENTS.md",
-  "QWEN.md"
-]);
-var FlatNestStorage = class extends NestStorage2 {
-  async discoverDocuments() {
-    const root = this.root;
-    let entries;
-    try {
-      entries = readdirSync(root, { recursive: true, withFileTypes: true });
-    } catch (err) {
-      console.error("[FlatNestStorage] cannot read folder", root, err);
-      return [];
-    }
-    const ids = [];
-    for (const e of entries) {
-      if (!e.isFile() || !e.name.endsWith(".md")) continue;
-      if (META_FILES.has(e.name)) continue;
-      const dir = e.parentPath ?? e.path ?? root;
-      const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
-      if (rel.split("/").some(isSkippedSegment)) continue;
-      ids.push(rel.replace(/\.md$/, ""));
-    }
-    const nodes = [];
-    for (const id of ids.sort()) {
-      try {
-        nodes.push(await this.readDocument(id));
-      } catch (err) {
-        console.error("[FlatNestStorage] skipped unreadable doc", id, err);
-      }
-    }
-    return nodes;
-  }
-};
-
-// src/nodes/engine.ts
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  async get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath = resolveNestPath(nestId);
-      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-
-// src/governance/title-resolver.ts
-async function buildTitleMap(nestId) {
-  try {
-    const { storage } = await engineCache.get(nestId);
-    const docs = await storage.discoverDocuments();
-    return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
-  } catch {
-    return /* @__PURE__ */ new Map();
-  }
-}
-function folderForNode(nodeId) {
-  return nodeId.replace(/^nodes\//, "").split("/").slice(0, -1).join("/");
-}
-async function describeNode(nestId, nodeId) {
-  const titles = await buildTitleMap(nestId);
-  const title = titles.get(nodeId) || nodeId;
-  const folder = folderForNode(nodeId);
-  return folder ? `${title} (in ${folder})` : title;
-}
-async function nestName(nestId) {
-  try {
-    const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
-      nestId
-    ]);
-    return row?.name || nestId;
-  } catch {
-    return nestId;
-  }
-}
-function docLink(nestId, nodeId, baseUrl) {
-  const base = baseUrl || config.PUBLIC_BASE_URL;
-  if (!base) return "";
-  const q = new URLSearchParams({ nest: nestId });
-  if (nodeId) q.set("doc", nodeId);
-  return `${base.replace(/\/$/, "")}/?${q.toString()}`;
-}
-async function buildDocContext(nestId, nodeId, baseUrl) {
-  const titles = await buildTitleMap(nestId);
-  const docTitle = titles.get(nodeId) || nodeId;
-  const folder = folderForNode(nodeId);
-  const name = await nestName(nestId);
-  return {
-    docTitle,
-    // Slack one-liner label ("Title (in Folder)"), same as describeNode().
-    label: folder ? `${docTitle} (in ${folder})` : docTitle,
-    path: folder ? `${name} / ${folder}` : name,
-    link: docLink(nestId, nodeId, baseUrl)
-  };
-}
-
-// src/governance/stewardship-service.ts
-async function assignSteward(data) {
-  const db = getDb();
-  const id = uuid3();
-  await db.run(
-    `INSERT INTO stewards
-     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    [
-      id,
-      data.nestId,
-      data.scope,
-      data.nodePattern || null,
-      data.tagName || null,
-      data.userEmail,
-      data.userId || null,
-      data.role,
-      data.assignedBy,
-      data.isActive ? 1 : 0
-    ]
-  );
-  return { ...data, id };
-}
-async function removeSteward(id) {
-  const db = getDb();
-  await db.run("DELETE FROM stewards WHERE id = ?", [id]);
-}
-var VALID_STEWARD_ROLES = ["editor", "reviewer", "viewer"];
-async function updateSteward(id, update) {
-  const db = getDb();
-  const current = await db.get(
-    "SELECT * FROM stewards WHERE id = ? AND is_active = 1",
-    [id]
-  );
-  if (!current) {
-    throw new ValidationError("Steward not found");
-  }
-  const role = update.role ?? current.role;
-  if (!VALID_STEWARD_ROLES.includes(role)) {
-    throw new ValidationError(
-      `Invalid role "${role}" \u2014 must be editor, reviewer, or viewer.`
-    );
-  }
-  let scope = current.scope;
-  let nodePattern = current.node_pattern ?? null;
-  let tagName = current.tag_name ?? null;
-  if (update.scope) {
-    scope = update.scope;
-    nodePattern = null;
-    tagName = null;
-    switch (scope) {
-      case "document":
-        if (!update.documentId)
-          throw new ValidationError("documentId required for document scope");
-        nodePattern = update.documentId;
-        break;
-      case "tag":
-        if (!update.tagName)
-          throw new ValidationError("tagName required for tag scope");
-        tagName = update.tagName.trim().replace(/^#+/, "").toLowerCase();
-        break;
-      case "nest":
-        break;
-    }
-    const dup = await db.get(
-      `SELECT role FROM stewards
-         WHERE nest_id = ? AND is_active = 1 AND id != ? AND scope = ?
-           AND user_email = ?
-           AND COALESCE(node_pattern, '') = COALESCE(?, '')
-           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
-      [current.nest_id, id, scope, current.user_email, nodePattern, tagName]
-    );
-    if (dup) {
-      const scopeLabel = scope === "document" ? `document "${nodePattern}"` : scope === "tag" ? `tag "#${tagName}"` : "this nest";
-      throw new ConflictError(
-        `"${current.user_email}" is already a steward of ${scopeLabel} with the "${dup.role}" role.`
-      );
-    }
-  }
-  await db.run(
-    "UPDATE stewards SET role = ?, scope = ?, node_pattern = ?, tag_name = ? WHERE id = ?",
-    [role, scope, nodePattern, tagName, id]
-  );
-  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
-  return rowToSteward(row);
-}
-async function updateStewardRole(id, role) {
-  return updateSteward(id, { role });
-}
-async function getSteward(id) {
-  const db = getDb();
-  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
-  return row ? rowToSteward(row) : null;
-}
-async function getStewardsForNest(nestId) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1",
-    [nestId]
-  );
-  return enrichWithTitles(nestId, rows.map(rowToSteward));
-}
-async function getStewardsForScope(params) {
-  const db = getDb();
-  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
-  const args = [params.nestId];
-  if (params.scope) {
-    sql += " AND scope = ?";
-    args.push(params.scope);
-  }
-  if (params.scopeTarget) {
-    sql += " AND (node_pattern = ? OR tag_name = ?)";
-    args.push(params.scopeTarget, params.scopeTarget);
-  }
-  return (await db.all(sql, args)).map(rowToSteward);
-}
-async function listStewards(params) {
-  const db = getDb();
-  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
-  const args = [params.nestId];
-  if (params.scope) {
-    sql += " AND scope = ?";
-    args.push(params.scope);
-  }
-  if (params.search) {
-    sql += " AND (user_email LIKE ? OR tag_name LIKE ? OR node_pattern LIKE ?)";
-    const like = `%${params.search.toLowerCase()}%`;
-    args.push(like, like, like);
-  }
-  sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
-  const stewards = (await db.all(sql, args)).map(rowToSteward);
-  return enrichWithTitles(params.nestId, stewards);
-}
-async function enrichWithTitles(nestId, stewards) {
-  if (!stewards.some((s) => s.scope === "document")) return stewards;
-  const titleByNodeId = await buildTitleMap(nestId);
-  for (const s of stewards) {
-    if (s.scope === "document" && s.nodePattern) {
-      s.nodeTitle = titleByNodeId.get(s.nodePattern);
-    }
-  }
-  return stewards;
-}
-async function createStewardRecord(params) {
-  if (params.users.length === 0) {
-    throw new Error("At least one user is required");
-  }
-  let nodePattern;
-  let tagName;
-  switch (params.scope) {
-    case "document":
-      if (!params.documentId) throw new Error("documentId required for document scope");
-      nodePattern = params.documentId;
-      break;
-    case "tag":
-      if (!params.tagName) throw new Error("tagName required for tag scope");
-      tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
-      break;
-    case "nest":
-      break;
-  }
-  const db = getDb();
-  const results = [];
-  const actor = (params.assignedBy || "").trim().toLowerCase();
-  const ownerEmail = (await getNestOwnerEmail(params.nestId) || "").toLowerCase();
-  for (const user of params.users) {
-    const email = user.email.trim().toLowerCase();
-    if (!email) continue;
-    if (!isEmailish(email)) {
-      throw new ValidationError(`"${user.email}" is not a valid email address.`);
-    }
-    if (email === actor) {
-      throw new ValidationError(
-        "You already manage this nest, so you can't add yourself as a steward."
-      );
-    }
-    if (ownerEmail && email === ownerEmail) {
-      throw new ValidationError(
-        "The nest owner already has full access and doesn't need a steward role."
-      );
-    }
-    const existing = await db.get(
-      `SELECT * FROM stewards
-         WHERE nest_id = ? AND is_active = 1 AND scope = ? AND user_email = ?
-           AND COALESCE(node_pattern, '') = COALESCE(?, '')
-           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
-      [
-        params.nestId,
-        params.scope,
-        email,
-        nodePattern ?? null,
-        tagName ?? null
-      ]
-    );
-    if (existing) {
-      const scopeLabel = params.scope === "document" ? `document "${nodePattern}"` : params.scope === "tag" ? `tag "#${tagName}"` : "this nest";
-      throw new ConflictError(
-        `"${email}" is already a steward of ${scopeLabel} with the "${existing.role}" role. Remove the existing assignment first to change the role.`
-      );
-    }
-    const userRow = await db.get(
-      "SELECT id FROM users WHERE email = ?",
-      [email]
-    );
-    let userId = userRow?.id;
-    if (!userId) {
-      const { hashPassword } = await import("./keys-73STFJJB.js");
-      userId = uuid3();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword(uuid3())]
-      );
-    }
-    const created = await assignSteward({
-      nestId: params.nestId,
-      scope: params.scope,
-      nodePattern,
-      tagName,
-      userEmail: email,
-      userId,
-      role: user.role ?? "reviewer",
-      assignedBy: params.assignedBy,
-      assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      isActive: true
-    });
-    results.push(created);
-  }
-  await db.run(
-    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0",
-    [params.nestId]
-  );
-  if (results.length > 0) {
-    let scopeLabel;
-    if (params.scope === "document") {
-      const titles = await buildTitleMap(params.nestId);
-      const docTitle = titles.get(nodePattern) || nodePattern;
-      const capitalized = docTitle.charAt(0).toUpperCase() + docTitle.slice(1);
-      scopeLabel = `"${capitalized}" document`;
-    } else if (params.scope === "tag") {
-      scopeLabel = `#${tagName}`;
-    } else {
-      scopeLabel = "the whole nest";
-    }
-    const shareNestName = await nestName(params.nestId);
-    const link = docLink(params.nestId, void 0, params.baseUrl);
-    for (const s of results) {
-      void sendEmailToRecipient(s.userEmail, {
-        status: "steward",
-        docTitle: shareNestName,
-        path: shareNestName,
-        permission: s.role,
-        scopeLabel,
-        by: params.assignedBy || void 0,
-        link
-      });
-    }
-  }
-  return results;
-}
-async function resolveStewardsForNode(nestId, nodeId) {
-  return (await resolve(nestId, nodeId)).stewards;
-}
-async function resolveStewardsWithFallback(nestId, nodeId) {
-  return resolve(nestId, nodeId);
-}
-async function resolve(nestId, nodeId) {
-  const db = getDb();
-  const rows = await db.all(
-    `
-      SELECT s.*, 1 AS priority, ('document: ' || s.node_pattern) AS match_source
-        FROM stewards s
-        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
-          AND s.node_pattern = ?
-      UNION ALL
-      SELECT s.*, 2 AS priority, ('tag: ' || s.tag_name) AS match_source
-        FROM stewards s
-        JOIN node_tag_index nt
-          ON nt.nest_id = s.nest_id
-         AND nt.tag_name = s.tag_name
-        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
-          AND nt.node_id = ?
-      UNION ALL
-      SELECT s.*, 3 AS priority, 'nest-level steward' AS match_source
-        FROM stewards s
-        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
-      ORDER BY priority ASC, user_email ASC
-      `,
-    [
-      nestId,
-      nodeId,
-      // document branch
-      nestId,
-      nodeId,
-      // tag branch
-      nestId
-      // nest branch
-    ]
-  );
-  const resolved = rows.map((row) => ({
-    steward: rowToSteward(row),
-    priority: row.priority,
-    source: row.match_source
-  }));
-  if (resolved.length > 0) {
-    return { stewards: resolved, fallbackToOwner: false };
-  }
-  const owner = await db.get(
-    `SELECT u.email FROM nests n
-       JOIN users u ON u.id = n.user_id
-       WHERE n.id = ?`,
-    [nestId]
-  );
-  return {
-    stewards: [],
-    fallbackToOwner: true,
-    ownerEmail: owner?.email
-  };
-}
-async function userIdForEmail(email) {
-  const db = getDb();
-  const row = await db.get(
-    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
-    [email]
-  );
-  return row?.id;
-}
-async function getStewardRolesForUser(nestId, userEmail) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT DISTINCT role FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
-    [nestId, userEmail]
-  );
-  return rows.map((r) => r.role);
-}
-async function getStewardsForUser(nestId, userEmail) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
-    [nestId, userEmail]
-  );
-  return rows.map(rowToSteward);
-}
-async function getCollaboratorRole(nestId, userEmail) {
-  const userId = await userIdForEmail(userEmail);
-  if (!userId) return null;
-  const db = getDb();
-  const row = await db.get(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
-    [nestId, userId]
-  );
-  return row?.permission ?? null;
-}
-async function resolveGrantRoles(nestId, userEmail, userId) {
-  const [grantRaw, stewardRoles, teamRoles] = await Promise.all([
-    getCollaboratorRole(nestId, userEmail),
-    getStewardRolesForUser(nestId, userEmail),
-    resolveTeamRolesForUser(nestId, userId)
-  ]);
-  return [
-    ...new Set(
-      [collabPermToRole(grantRaw), ...stewardRoles, ...teamRoles].filter(
-        Boolean
-      )
-    )
-  ];
-}
-async function resolveUserRoles(nestId, userEmail, opts) {
-  const roles = /* @__PURE__ */ new Set();
-  if (isSuperAdmin(userEmail)) roles.add("admin");
-  const owner = await getNestOwnerEmail(nestId);
-  if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
-    roles.add("owner");
-  }
-  const userId = await userIdForEmail(userEmail);
-  if (userId) {
-    const collabRole = collabPermToRole(await resolveNestPermission(nestId, userId));
-    if (collabRole) roles.add(collabRole);
-    for (const role of await resolveTeamRolesForUser(nestId, userId)) {
-      roles.add(role);
-    }
-  }
-  const stewardRoles = opts?.nodeId ? (await resolveStewardsForNode(nestId, opts.nodeId)).filter(
-    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
-  ).map((r) => r.steward.role) : await getStewardRolesForUser(nestId, userEmail);
-  for (const role of stewardRoles) roles.add(role);
-  return [...roles];
-}
-async function canManageStewards(nestId, userId) {
-  if (config.AUTH_MODE === "open") return true;
-  const perm = await resolveNestPermission(nestId, userId);
-  return perm === "owner" || perm === "admin";
-}
-async function canCreateInNest(nestId, userEmail) {
-  if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
-  const userId = await userIdForEmail(userEmail);
-  if (userId) {
-    const perm = await resolveNestPermission(nestId, userId);
-    if (perm === "owner" || perm === "admin" || perm === "write") return true;
-  }
-  return (await getStewardsForUser(nestId, userEmail)).some(
-    (s) => s.role === "editor" && s.scope === "nest"
-  );
-}
-async function getNestOwnerEmail(nestId) {
-  const db = getDb();
-  const row = await db.get(
-    `SELECT u.email FROM nests n
-       JOIN users u ON u.id = n.user_id
-       WHERE n.id = ?`,
-    [nestId]
-  );
-  return row?.email ?? null;
-}
-async function canUserEdit(nestId, nodeId, userEmail) {
-  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
-  if (roles.includes("owner")) {
-    return { allowed: true, reason: "nest owner", role: "owner" };
-  }
-  if (isSuperAdmin(userEmail)) {
-    return { allowed: true, reason: "super admin", role: "super_admin" };
-  }
-  if (canEditWith(roles)) {
-    return {
-      allowed: true,
-      reason: "editor access (collaborator or steward)",
-      role: roles.includes("admin") ? "admin" : "editor"
-    };
-  }
-  return { allowed: false, reason: "no editor role on this node", role: null };
-}
-async function getCurrentVersionAuthor(nestId, nodeId) {
-  const db = getDb();
-  const row = await db.get(
-    `SELECT author FROM node_versions
-       WHERE nest_id = ? AND node_id = ?
-       ORDER BY version DESC LIMIT 1`,
-    [nestId, nodeId]
-  );
-  return row?.author ?? null;
-}
-async function getPendingReviewRequester(nestId, nodeId) {
-  const db = getDb();
-  const row = await db.get(
-    `SELECT requested_by FROM review_requests
-       WHERE nest_id = ? AND node_id = ? AND status = 'pending'
-       ORDER BY requested_at DESC LIMIT 1`,
-    [nestId, nodeId]
-  );
-  return row?.requested_by ?? null;
-}
-async function canUserApprove(nestId, nodeId, userEmail) {
-  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
-  const isOwner = roles.includes("owner");
-  const isSuper = isSuperAdmin(userEmail);
-  const allowSelf = await nestAllowsSelfApprove(nestId);
-  const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
-  const actor = await getPendingReviewRequester(nestId, nodeId) ?? await getCurrentVersionAuthor(nestId, nodeId);
-  const isOwnSubmission = !!actor && actor.toLowerCase() === userEmail.toLowerCase();
-  if (hasStewardApprove) {
-    if (isOwnSubmission && !((isOwner || isSuper) && allowSelf)) {
-      return {
-        allowed: false,
-        reason: "You submitted this version for review, so you can't approve it yourself. Ask another reviewer to approve it (separation of duties).",
-        role: roles.includes("admin") ? "admin" : "reviewer"
-      };
-    }
-    return {
-      allowed: true,
-      reason: "reviewer access (collaborator or steward)",
-      role: roles.includes("admin") ? "admin" : "reviewer"
-    };
-  }
-  if (isOwner || isSuper) {
-    if (allowSelf) {
-      return {
-        allowed: true,
-        reason: isOwner ? "nest owner (self-approve enabled)" : "super admin",
-        role: isOwner ? "owner" : "super_admin"
-      };
-    }
-    return {
-      allowed: false,
-      reason: "Approvals go to assigned reviewers while self-approve is off. Enable self-approve in nest settings to approve directly (e.g. while seeding), or add a reviewer steward.",
-      role: isOwner ? "owner" : "super_admin"
-    };
-  }
-  const held = primaryRole(roles);
-  return {
-    allowed: false,
-    reason: held ? `You're a "${held}" on this document \u2014 only reviewers (or admins) can approve. Ask the nest owner to grant you the reviewer steward role.` : "You're not a steward on this document, so you can't approve it. Ask the nest owner to add you as a reviewer.",
-    role: held
-  };
-}
-async function canUserAccess(nestId, nodeId, userEmail) {
-  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
-  if (roles.includes("owner")) {
-    return { allowed: true, reason: "nest owner", role: "owner" };
-  }
-  if (isSuperAdmin(userEmail)) {
-    return { allowed: true, reason: "super admin", role: "super_admin" };
-  }
-  if (canViewWith(roles)) {
-    return {
-      allowed: true,
-      reason: "collaborator or steward access",
-      role: primaryRole(roles)
-    };
-  }
-  return { allowed: false, reason: "no collaborator or steward access", role: null };
-}
-async function syncFromConfig(nestId, config2) {
-  const db = getDb();
-  let count = 0;
-  await db.run(
-    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?",
-    [nestId]
-  );
-  await db.run(
-    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?",
-    [nestId]
-  );
-  const addEntries = async (scope, entries, target) => {
-    for (const entry of entries) {
-      const user = await db.get(
-        "SELECT id FROM users WHERE email = ?",
-        [entry.email]
-      );
-      const rawRole = entry.role || "reviewer";
-      const role = rawRole === "admin" ? "reviewer" : rawRole;
-      await assignSteward({
-        nestId,
-        scope,
-        nodePattern: target?.nodePattern,
-        tagName: target?.tagName ? target.tagName.trim().replace(/^#+/, "").toLowerCase() : void 0,
-        userEmail: entry.email.toLowerCase(),
-        userId: user?.id,
-        role,
-        assignedBy: "config",
-        assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        isActive: true
-      });
-      count++;
-    }
-  };
-  if (config2.nest) {
-    await addEntries("nest", config2.nest);
-  }
-  if (config2.tags) {
-    for (const [tagName, entries] of Object.entries(config2.tags)) {
-      await addEntries("tag", entries, { tagName });
-    }
-  }
-  if (config2.documents) {
-    for (const [docPattern, entries] of Object.entries(config2.documents)) {
-      await addEntries("document", entries, { nodePattern: docPattern });
-    }
-  }
-  return count;
-}
-function rowToSteward(row) {
-  return {
-    id: row.id,
-    nestId: row.nest_id,
-    scope: row.scope,
-    nodePattern: row.node_pattern || void 0,
-    tagName: row.tag_name || void 0,
-    userEmail: row.user_email,
-    userId: row.user_id || void 0,
-    role: row.role,
-    assignedBy: row.assigned_by,
-    assignedAt: row.assigned_at,
-    isActive: !!row.is_active
-  };
-}
-
 export {
+  nowExpr,
+  insertOrIgnore,
+  insertOrReplace,
   trackEvent,
   startTelemetryLoop,
   persistSetting,
@@ -2608,11 +2171,18 @@ export {
   sendEmailToRecipient,
   nestStorageRoot,
   resolveNestPath,
+  normalizeTag,
+  syncNodeTags,
+  removeNodeFromTagIndex,
   uniqueNestName,
   isStewardshipEnabled,
   setStewardshipEnabled,
   nestAllowsSelfApprove,
   setAllowSelfApprove,
+  nestReviewsPrimeOnly,
+  setPrimeOnlyReview,
+  nestPrimeTags,
+  setPrimeTags,
   disableStewardshipAndWipeGovernance,
   renameNest,
   createNest,
@@ -2625,7 +2195,10 @@ export {
   deleteNest,
   engineCache,
   buildTitleMap,
+  folderForNode,
   describeNode,
+  titleForNode,
+  prettyFolderPath,
   nestName,
   docLink,
   buildDocContext,
@@ -2643,30 +2216,14 @@ export {
   listNestTeams,
   shareTeamWithNest,
   unshareTeamFromNest,
+  resolveTeamRolesForUser,
+  collabPermToRole,
+  canViewWith,
+  canEditWith,
+  canApproveWith,
+  primaryRole,
   isServerAdminUserId,
   resolveNestPermission,
   permissionLevel,
-  isPublicReader,
-  assignSteward,
-  removeSteward,
-  updateSteward,
-  updateStewardRole,
-  getSteward,
-  getStewardsForNest,
-  getStewardsForScope,
-  listStewards,
-  createStewardRecord,
-  resolveStewardsForNode,
-  resolveStewardsWithFallback,
-  getStewardRolesForUser,
-  getStewardsForUser,
-  getCollaboratorRole,
-  resolveGrantRoles,
-  resolveUserRoles,
-  canManageStewards,
-  canCreateInNest,
-  canUserEdit,
-  canUserApprove,
-  canUserAccess,
-  syncFromConfig
+  isPublicReader
 };