@promptowl/contextnest-community 1.16.1 → 1.18.0

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   addWatcher,
   approve,
   canReadNode,
+  canRequestDeletion,
   cancelReview,
   declineDeletion,
   deletionTargetTitle,
@@ -38,25 +39,47 @@ import {
   seedDefaultEdgeTypes,
   sendTestNotification,
   submitForReview,
-  withNodeWriteLock
-} from "./chunk-QJVRZT6M.js";
+  withNodeWriteLock,
+  withdrawDeletionRequest
+} from "./chunk-HGN45I5P.js";
+import {
+  canCreateInNest,
+  canManageStewards,
+  canUserAccess,
+  canUserApprove,
+  canUserEdit,
+  createStewardRecord,
+  getCollaboratorRole,
+  getStewardRolesForUser,
+  getStewardsForNest,
+  getStewardsForUser,
+  listStewards,
+  removeSteward,
+  resolveGrantRoles,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  resolveUserRoles,
+  syncFromConfig,
+  updateSteward
+} from "./chunk-TQACHVVA.js";
 import {
   createGrant,
   deleteGrant,
   grantCoversNode,
-  hasAnyGrant,
+  grantRoleForNode,
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-OTGZQZKK.js";
+} from "./chunk-QUZXRLUA.js";
 import {
   generateApiKey,
   getKeyPrefix,
   hashApiKey,
   hashPassword,
   parseBearerToken,
+  verifyKeyRequest,
   verifyPassword
-} from "./chunk-XRK6SQSC.js";
+} from "./chunk-F66VCBLA.js";
 import {
   checkConflict,
   createVersion,
@@ -64,36 +87,32 @@ import {
   getApprovedVersions,
   getCurrentVersion,
   getDisplayStatus,
+  getDisplayStatuses,
   getTrackedNodeIds,
   getVersions,
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-D6HICFVW.js";
+} from "./chunk-34UXRZXD.js";
 import {
-  canCreateInNest,
-  canManageStewards,
-  canUserAccess,
-  canUserApprove,
-  canUserEdit,
-  createStewardRecord,
-  getCollaboratorRole,
-  getStewardRolesForUser,
-  getStewardsForNest,
-  getStewardsForUser,
-  listStewards,
-  removeSteward,
-  resolveGrantRoles,
-  resolveStewardsForNode,
-  resolveStewardsWithFallback,
-  resolveUserRoles,
-  syncFromConfig,
-  updateSteward
-} from "./chunk-CLKZZZS2.js";
+  approveExternalEdit,
+  getExternalEditDetail,
+  getPendingChange,
+  listExternalEditVerdicts,
+  listNestExternalEdits,
+  loadLatestApprovedNode,
+  rejectExternalEdit,
+  scanDocumentForDrift,
+  scanNestForDrift,
+  startDriftScanner
+} from "./chunk-OOBZG6BW.js";
 import {
   addMember,
+  assertSafeNodeId,
   buildTitleMap,
   canApproveWith,
+  canEditWith,
+  collabPermToRole,
   createNest,
   createTeam,
   deleteNest,
@@ -102,14 +121,17 @@ import {
   docLink,
   engineApi,
   engineCache,
+  ensureNodeIndex,
   findTeamByExternalId,
   folderForNode,
+  folderOfId,
   getAccessConfig,
   getCurrentLicense,
   getNest,
   getSuspensionReason,
   getTeam,
   importNest,
+  indexedFolderCounts,
   insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
@@ -134,19 +156,25 @@ import {
   nestPrimeTags,
   nestReviewsPrimeOnly,
   nestStorageRoot,
+  nodesWithSuggestions,
   normalizeTag,
   nowExpr,
   opContext,
   permissionLevel,
   persistSetting,
+  primaryRole,
+  readIndexedNodes,
+  rebuildNodeIndex,
   removeMember,
   removeNodeFromTagIndex,
   renameNest,
   renameTeam,
   replaceTeamRoster,
   resolveMemberIdentity,
+  resolveNestAccess,
   resolveNestPath,
   resolveNestPermission,
+  resolveTeamRolesForUser,
   sendEmailToRecipient,
   setAllowSelfApprove,
   setPrimeOnlyReview,
@@ -162,7 +190,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-FUUJG6XP.js";
 import {
   AppError,
   ConflictError,
@@ -178,11 +206,12 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 import {
   ANON_EMAIL,
-  ANON_USER_ID
-} from "./chunk-SLTQACJW.js";
+  ANON_USER_ID,
+  MAX_FOLDER_DEPTH
+} from "./chunk-YB3LKF7U.js";
 import {
   normalizeEmail
 } from "./chunk-FRQJWGN3.js";
@@ -1076,19 +1105,11 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
   const db = getDb();
   const userId = c.get("userId");
-  const existing = await db.get(
-    "SELECT key_prefix FROM api_keys WHERE user_id = ?",
-    [userId]
-  );
-  if (existing) {
-    return c.json(
-      {
-        error: "An API key already exists for this user. Rotate it instead.",
-        key_prefix: existing.key_prefix
-      },
-      409
-    );
-  }
+  const check = await verifyKeyRequest(db, userId, {
+    action: "generate",
+    label: body.label
+  });
+  if (!check.ok) return c.json({ error: check.error }, check.status);
   const apiKey = generateApiKey();
   const keyId = uuid2();
   await db.run(
@@ -1099,11 +1120,11 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
       hashApiKey(apiKey),
       getKeyPrefix(apiKey),
       body.nest_id || null,
-      body.label || null
+      check.label
     ]
   );
   return c.json(
-    { api_key: apiKey, key_prefix: getKeyPrefix(apiKey) },
+    { id: keyId, api_key: apiKey, key_prefix: getKeyPrefix(apiKey), label: check.label },
     201
   );
 });
@@ -1111,15 +1132,22 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const body = await c.req.json().catch(() => ({}));
   const db = getDb();
   const userId = c.get("userId");
+  const check = await verifyKeyRequest(db, userId, {
+    action: "update",
+    label: body.label,
+    keyId: body.key_id
+  });
+  if (!check.ok) return c.json({ error: check.error }, check.status);
+  const prior = check.key;
   const apiKey = generateApiKey();
   const keyId = uuid2();
-  const prior = await db.get(
-    "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
-    [userId]
-  );
-  const nestScope = "nest_id" in body ? body.nest_id || null : prior?.nest_id ?? null;
-  await db.transaction(async (tx) => {
-    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
+  const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
+  const replaced = await db.transaction(async (tx) => {
+    const removed = await tx.run(
+      "DELETE FROM api_keys WHERE id = ? AND user_id = ?",
+      [prior.id, userId]
+    );
+    if (removed.changes === 0) return false;
     await tx.run(
       "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
       [
@@ -1128,29 +1156,47 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
         hashApiKey(apiKey),
         getKeyPrefix(apiKey),
         nestScope,
-        body.label ?? prior?.label ?? null
+        check.label ?? prior.label
       ]
     );
+    return true;
+  });
+  if (!replaced) {
+    return c.json(
+      { error: "That key no longer exists \u2014 reload and try again." },
+      404
+    );
+  }
+  return c.json({
+    id: keyId,
+    api_key: apiKey,
+    key_prefix: getKeyPrefix(apiKey),
+    label: check.label ?? prior.label
   });
-  return c.json({ api_key: apiKey, key_prefix: getKeyPrefix(apiKey) });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
   const db = getDb();
+  const userId = c.get("userId");
+  const check = await verifyKeyRequest(db, userId, { action: "fetch" });
+  if (!check.ok) return c.json({ error: check.error }, check.status);
   const keys = await db.all(
-    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?",
-    [c.get("userId")]
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ? ORDER BY created_at ASC, id ASC",
+    [userId]
   );
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   const db = getDb();
-  const result = await db.run(
-    "DELETE FROM api_keys WHERE id = ? AND user_id = ?",
-    [c.req.param("keyId"), c.get("userId")]
-  );
-  if (result.changes === 0) {
-    return c.json({ error: "Key not found" }, 404);
-  }
+  const userId = c.get("userId");
+  const check = await verifyKeyRequest(db, userId, {
+    action: "update",
+    keyId: c.req.param("keyId")
+  });
+  if (!check.ok) return c.json({ error: check.error }, check.status);
+  await db.run("DELETE FROM api_keys WHERE id = ? AND user_id = ?", [
+    check.key.id,
+    userId
+  ]);
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
@@ -1607,13 +1653,14 @@ import { Hono as Hono3 } from "hono";
 
 // src/nodes/service.ts
 import {
-  parseDocument as parseDocument2,
+  parseDocument,
   normalizeStatus,
   isRejected,
+  filterDocuments,
   DocumentNotFoundError
 } from "@promptowl/contextnest-engine";
 import { rename, mkdir } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { dirname, join } from "path";
 
 // src/governance/safe-publish.ts
 import {
@@ -1641,6 +1688,9 @@ function stripUndefinedDeep(value) {
   return value;
 }
 
+// src/nodes/service.ts
+import { inputJsonSchema } from "@promptowl/contextnest-engine/api";
+
 // src/governance/prime-service.ts
 async function isPrimeDocument(nestId, tags, metadata) {
   const flag = documentPrimeFlag(metadata);
@@ -1658,313 +1708,6 @@ function documentPrimeFlag(metadata) {
   return void 0;
 }
 
-// src/governance/external-edit-service.ts
-import { readFile } from "fs/promises";
-import { join } from "path";
-import {
-  detectDrift,
-  stageSuggestion,
-  ChainEventLog,
-  approveSuggestion,
-  rejectSuggestion,
-  listSuggestions,
-  readSuggestion,
-  parseDocument,
-  VersionManager,
-  computeContentHash,
-  getChecksumContent
-} from "@promptowl/contextnest-engine";
-var communityRbac = {
-  isCzar: () => false,
-  canIngest: () => true,
-  isDocOwner: () => true
-};
-function docPath(nestId, documentId) {
-  return join(resolveNestPath(nestId), `${documentId}.md`);
-}
-async function readRaw(nestId, documentId) {
-  try {
-    return await readFile(docPath(nestId, documentId), "utf-8");
-  } catch {
-    return null;
-  }
-}
-async function loadChainHead(storage, documentId) {
-  const history = await storage.readHistory(documentId);
-  if (!history || history.versions.length === 0) return null;
-  const latest = history.versions[history.versions.length - 1];
-  try {
-    const content = await new VersionManager(storage).reconstructVersion(
-      documentId,
-      latest.version
-    );
-    return { version: latest.version, content };
-  } catch {
-    return null;
-  }
-}
-async function loadLatestApprovedNode(nestId, documentId) {
-  const { storage } = await engineCache.get(nestId);
-  const head = await loadChainHead(storage, documentId);
-  if (!head) return null;
-  return parseDocument(docPath(nestId, documentId), head.content, documentId);
-}
-async function bodyMatchesLatestVersion(storage, documentId, liveBodyHash) {
-  const head = await loadChainHead(storage, documentId);
-  if (!head) return false;
-  const headBodyHash = computeContentHash(getChecksumContent(head.content));
-  return headBodyHash === liveBodyHash;
-}
-async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner") {
-  const res = await scanDocumentForDriftInternal(nestId, documentId, actor);
-  return res?.meta ?? null;
-}
-async function scanDocumentForDriftInternal(nestId, documentId, actor) {
-  const { storage } = await engineCache.get(nestId);
-  const node = await storage.readDocument(documentId).catch(() => null);
-  if (!node) return null;
-  const raw = await readRaw(nestId, documentId);
-  if (raw == null) return null;
-  const drift = detectDrift(raw, node.frontmatter.checksum);
-  if (!drift.drifted) return null;
-  if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
-    return null;
-  }
-  const approved = await loadChainHead(storage, documentId);
-  if (!approved) return null;
-  const existing = await listSuggestions(storage, documentId);
-  const dup = existing.find((s) => s.proposed_hash === drift.actualHash);
-  if (dup) return { meta: dup, created: false };
-  const result = await stageSuggestion({
-    storage,
-    documentId,
-    approvedRawContent: approved.content,
-    proposedRawContent: raw,
-    source: "out-of-band-edit",
-    actor,
-    docTier: "standard"
-  });
-  return { meta: result.meta, created: true };
-}
-async function scanNestForDrift(nestId, actor = "system:scanner") {
-  const { storage, invalidateDiscovery } = await engineCache.get(nestId);
-  invalidateDiscovery();
-  const docs = await storage.discoverDocuments();
-  const results = await Promise.all(
-    docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
-  );
-  const staged = results.filter((r) => r?.created).length;
-  return { scanned: docs.length, staged };
-}
-async function getPendingChange(nestId, documentId) {
-  const { storage } = await engineCache.get(nestId);
-  const list = await listSuggestions(storage, documentId);
-  for (let i = list.length - 1; i >= 0; i--) {
-    const meta = list[i];
-    if (await bodyMatchesLatestVersion(storage, documentId, meta.proposed_hash)) {
-      continue;
-    }
-    return {
-      suggestion_id: meta.suggestion_id,
-      detected_at: meta.detected_at,
-      source: meta.source,
-      proposed_hash: meta.proposed_hash
-    };
-  }
-  return null;
-}
-async function listNestExternalEdits(nestId) {
-  const { storage } = await engineCache.get(nestId);
-  const docs = await storage.discoverDocuments();
-  const lists = await Promise.all(
-    docs.map(async (doc) => {
-      const metas = await listSuggestions(storage, doc.id);
-      const fresh = [];
-      for (const meta of metas) {
-        if (await bodyMatchesLatestVersion(storage, doc.id, meta.proposed_hash)) {
-          continue;
-        }
-        fresh.push(meta);
-      }
-      return fresh;
-    })
-  );
-  const entries = lists.flat().map((meta) => ({
-    suggestion_id: meta.suggestion_id,
-    nest_id: nestId,
-    document_id: meta.document_id,
-    source: meta.source,
-    detected_at: meta.detected_at,
-    actor: meta.actor,
-    target_hash: meta.target_hash,
-    proposed_hash: meta.proposed_hash,
-    note: meta.note
-  }));
-  return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
-}
-async function getExternalEditDetail(nestId, documentId, suggestionId) {
-  const { storage } = await engineCache.get(nestId);
-  const found = await readSuggestion(storage, documentId, suggestionId);
-  if (!found) return null;
-  return {
-    suggestion_id: found.meta.suggestion_id,
-    nest_id: nestId,
-    document_id: found.meta.document_id,
-    source: found.meta.source,
-    detected_at: found.meta.detected_at,
-    actor: found.meta.actor,
-    target_hash: found.meta.target_hash,
-    proposed_hash: found.meta.proposed_hash,
-    note: found.meta.note,
-    patch: found.patch
-  };
-}
-async function recordVerdict(nestId, event) {
-  try {
-    const { storage } = await engineCache.get(nestId);
-    await new ChainEventLog(storage).append(event);
-    return true;
-  } catch (err) {
-    console.error(
-      `[external-edit] failed to record verdict ${event.event_id} for nest ${nestId}:`,
-      err
-    );
-    return false;
-  }
-}
-async function listExternalEditVerdicts(nestId, documentId) {
-  try {
-    const { storage } = await engineCache.get(nestId);
-    const events = await new ChainEventLog(storage).readByDocument(documentId);
-    return events.flatMap((e) => {
-      const meta = e.action_metadata || {};
-      if (typeof meta.suggestion_id !== "string") return [];
-      const reason = meta.rejection_reason;
-      const comment = meta.approval_comment;
-      return [
-        {
-          suggestion_id: meta.suggestion_id,
-          status: typeof reason === "string" ? "rejected" : "approved",
-          actor: e.actor,
-          at: e.timestamp,
-          note: typeof reason === "string" ? reason : typeof comment === "string" ? comment : void 0,
-          source: typeof meta.source === "string" ? meta.source : void 0
-        }
-      ];
-    });
-  } catch (err) {
-    console.error(
-      `[external-edit] failed to read verdicts for ${nestId}/${documentId}:`,
-      err
-    );
-    return [];
-  }
-}
-async function mirrorVersion(input) {
-  const { storage } = await engineCache.get(input.nestId);
-  const node = await storage.readDocument(input.documentId);
-  const { upsertVersion: upsertVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-V6K5SZ3P.js");
-  await upsertVersion2({
-    nestId: input.nestId,
-    nodeId: input.documentId,
-    version: input.version,
-    content: node.body || "",
-    author: input.actor,
-    status: "published",
-    tags: node.frontmatter.tags || [],
-    changeNote: input.note
-  });
-  await setApprovedVersion2(
-    input.nestId,
-    input.documentId,
-    input.version,
-    input.actor
-  );
-}
-async function approveExternalEdit(input) {
-  const { storage } = await engineCache.get(input.nestId);
-  let result;
-  try {
-    result = await approveSuggestion({
-      storage,
-      rbac: communityRbac,
-      documentId: input.documentId,
-      suggestionId: input.suggestionId,
-      actor: input.actor,
-      zone: "default",
-      comment: input.comment
-    });
-  } catch (err) {
-    console.error(
-      `[external-edit] approveSuggestion failed for ${input.nestId}/${input.documentId} suggestion=${input.suggestionId}:`,
-      err
-    );
-    throw err;
-  }
-  try {
-    await mirrorVersion({
-      nestId: input.nestId,
-      documentId: input.documentId,
-      version: result.versionEntry.version,
-      actor: input.actor,
-      note: input.comment ? `External edit approved: ${input.comment}` : "External edit approved"
-    });
-  } catch (err) {
-    console.error(
-      `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
-      err
-    );
-  }
-  const historyRecorded = await recordVerdict(input.nestId, result.chainEvent);
-  return { ...result, historyRecorded };
-}
-async function rejectExternalEdit(input) {
-  const { storage } = await engineCache.get(input.nestId);
-  const result = await rejectSuggestion({
-    storage,
-    rbac: communityRbac,
-    documentId: input.documentId,
-    suggestionId: input.suggestionId,
-    actor: input.actor,
-    zone: "default",
-    reason: input.reason
-  });
-  const historyRecorded = await recordVerdict(input.nestId, result.chainEvent);
-  try {
-    const approved = await loadChainHead(storage, input.documentId);
-    if (approved) {
-      await storage.writeDocument(input.documentId, approved.content);
-    }
-  } catch (err) {
-    console.error(
-      `[external-edit] revert-on-reject failed for ${input.nestId}/${input.documentId}:`,
-      err
-    );
-  }
-  return { ...result, historyRecorded };
-}
-var scannerTimer = null;
-async function scanAllNests() {
-  const db = getDb();
-  const rows = await db.all("SELECT id FROM nests");
-  await Promise.all(
-    rows.map(
-      ({ id }) => scanNestForDrift(id).catch(
-        (err) => console.error(`[external-edit] scan failed for nest ${id}:`, err)
-      )
-    )
-  );
-}
-function startDriftScanner(intervalMs = 3e4) {
-  if (scannerTimer) return;
-  scannerTimer = setInterval(() => {
-    scanAllNests().catch(
-      (err) => console.error("[external-edit] scanner tick failed:", err)
-    );
-  }, intervalMs);
-  scannerTimer.unref?.();
-}
-
 // src/nodes/service.ts
 async function userIdFromEmail(email) {
   const db = getDb();
@@ -1983,17 +1726,42 @@ function assertTitleLength(title) {
     );
   }
 }
-function assertTitleSluggable(title) {
-  if (!slugify(title)) {
+function assertTitleReadable(title) {
+  if (!/[\p{L}\p{N}]/u.test(title)) {
     throw new ValidationError(
-      "the document id is built from the title using a-z and 0-9, so the title needs at least one of those"
+      "the title needs at least one letter or number \u2014 it is what search and wiki links read back"
     );
   }
 }
-var slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+var slugify = (s) => s.normalize("NFKD").replace(/\p{M}+/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+async function generatedSlug(storage, prefix) {
+  for (let n = 1; n <= 1e3; n++) {
+    const slug = `document-${n}`;
+    try {
+      await storage.readDocument(`${prefix}${slug}`);
+    } catch (err) {
+      if (err instanceof DocumentNotFoundError) return slug;
+      throw err;
+    }
+  }
+  throw new ValidationError(
+    "too many generated document ids in this folder \u2014 give the document a title with Latin letters or digits, or file it elsewhere"
+  );
+}
 function isIdUnderFolder(id, folder) {
   return id.startsWith(`nodes/${folder}/`) || id.startsWith(`${folder}/`);
 }
+function assertSafeFolder(folder) {
+  if (folder.split(/[/\\]/).some((seg) => seg === "..")) {
+    throw new ValidationError(
+      `Invalid folder "${folder}": path traversal ("..") is not allowed.`
+    );
+  }
+}
+async function storagePrefix(nestId) {
+  const { storage } = await engineCache.get(nestId);
+  return await storage.detectLayout() === "structured" ? "nodes" : "";
+}
 function folderToSegments(folder) {
   const segments = folder.split("/").map(slugify).filter(Boolean);
   if (folder.trim() && segments.length === 0) {
@@ -2002,8 +1770,10 @@ function folderToSegments(folder) {
     );
   }
   if (segments[0] === "nodes") segments.shift();
-  if (segments.length > 8) {
-    throw new ValidationError("folder may nest at most 8 levels deep");
+  if (segments.length > MAX_FOLDER_DEPTH) {
+    throw new ValidationError(
+      `folder may nest at most ${MAX_FOLDER_DEPTH} levels deep`
+    );
   }
   if (segments.some((seg) => seg.length > 100)) {
     throw new ValidationError(
@@ -2039,7 +1809,7 @@ function toSafeError(err, context, message) {
 }
 function bodyOnly(nodeId, raw) {
   try {
-    return parseDocument2(`${nodeId}.md`, raw, nodeId).body ?? "";
+    return parseDocument(`${nodeId}.md`, raw, nodeId).body ?? "";
   } catch {
     return raw;
   }
@@ -2124,6 +1894,15 @@ async function resolveAuthorship(nestId, nodes) {
   }
   return result;
 }
+var folderScopeSupported = null;
+function engineScopesFolders() {
+  if (folderScopeSupported === null) {
+    const op = engineApi.getOperation("context_list");
+    const properties = op ? inputJsonSchema(op).properties ?? {} : {};
+    folderScopeSupported = "folder" in properties;
+  }
+  return folderScopeSupported;
+}
 async function getNodeForCaller(nestId, selector, userId, userEmail, opts = {}) {
   if (selector.id && !await canReadNode(nestId, selector.id, userId, userEmail)) {
     throw new ForbiddenError(
@@ -2165,29 +1944,49 @@ async function getNodeForCaller(nestId, selector, userId, userEmail, opts = {})
   };
 }
 async function listNodesForCaller(nestId, userId, filters = {}) {
+  if (filters.folder !== void 0) assertSafeFolder(filters.folder);
   const { versions: versionManager } = await engineCache.get(nestId);
   const userEmail = await resolveCallerEmail(userId);
-  const { documents } = await engineApi.run(
-    "context_list",
-    {
-      ...filters.type ? { type: filters.type } : {},
-      ...filters.tag ? { tag: filters.tag } : {},
-      ...filters.status ? { status: filters.status } : {},
-      // Unlike the CLI and mcp-server, a retired node stays in this listing:
-      // here it is an unpublished document its stewards may still need to act
-      // on, not one removed from retrieval. An imported vault carrying
-      // `status: rejected` registers exactly that way.
-      include_retired: true,
-      full: true
-    },
-    await opContext(nestId, userEmail)
-  );
-  const nodes = documents.map((d) => ({
+  const frontmatterFilters = {
+    ...filters.type ? { type: filters.type } : {},
+    ...filters.tag ? { tag: filters.tag } : {},
+    ...filters.status ? { status: filters.status } : {},
+    includeRetired: true
+  };
+  let documents;
+  if (filters.withContent) {
+    const scopeInEngine = filters.folder !== void 0 && engineScopesFolders();
+    const scopePrefix = scopeInEngine ? await storagePrefix(nestId) : "";
+    ({ documents } = await engineApi.run(
+      "context_list",
+      {
+        ...frontmatterFilters,
+        include_retired: true,
+        ...scopeInEngine ? {
+          folder: [scopePrefix, filters.folder].filter(Boolean).join("/"),
+          recursive: false
+        } : {},
+        full: true
+      },
+      await opContext(nestId, userEmail)
+    ));
+  } else {
+    await ensureNodeIndex(nestId);
+    const indexed = await readIndexedNodes(
+      nestId,
+      filters.folder !== void 0 ? { folder: filters.folder } : {}
+    );
+    documents = filterDocuments(indexed, frontmatterFilters);
+  }
+  const scoped = filters.folder === void 0 ? documents : documents.filter((d) => folderOfId(d.id) === filters.folder);
+  const nodes = scoped.map((d) => ({
     id: d.id,
     filePath: "",
     rawContent: "",
     frontmatter: d.frontmatter,
-    body: d.body
+    // Empty on the indexed path: no listing renders a body, and the
+    // approved-only branch below serves its own from the version store.
+    body: d.body ?? ""
   }));
   const publicReader = await isPublicReader(nestId, userId);
   const approvedOnly = publicReader || filters.approvedOnly === true;
@@ -2199,14 +1998,18 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
     nodes,
     approvedVersions ?? void 0
   );
-  if (await resolveNestPermission(nestId, userId) === "none" && !await isStewardshipEnabled(nestId)) {
-    const grants = await listUserGrants(nestId, userId);
-    accessible = grants.length ? nodes.filter((d) => grantCoversNode(grants, d.id)) : accessible;
-  }
+  const myGrants = await listUserGrants(nestId, userId);
   if (approvedVersions && !publicReader) {
     accessible = accessible.filter((d) => approvedVersions.has(d.id));
   }
   if (filters.limit) accessible = accessible.slice(0, filters.limit);
+  const [displayStatuses, driftedDocs] = approvedVersions ? [null, null] : await Promise.all([
+    getDisplayStatuses(nestId),
+    // From the DB, not a vault walk. The disk truth behind it is
+    // reconciled by the index rebuild and kept current by the stage /
+    // approve / reject paths.
+    nodesWithSuggestions(nestId)
+  ]);
   const authorship = publicReader ? null : await resolveAuthorship(
     nestId,
     accessible.map((d) => ({
@@ -2222,6 +2025,9 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.author = people.author;
         r.collaborators = people.collaborators;
       }
+      if (myGrants.length) {
+        r.myGrant = grantRoleForNode(myGrants, doc.id);
+      }
       if (approvedVersions) {
         const approved = approvedVersions.get(doc.id);
         if (approved != null) {
@@ -2246,22 +2052,125 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         return r;
       }
       let pending = null;
-      try {
-        pending = await getPendingChange(nestId, doc.id);
-      } catch {
-        pending = null;
+      if (driftedDocs?.has(doc.id)) {
+        try {
+          pending = await getPendingChange(nestId, doc.id);
+        } catch {
+          pending = null;
+        }
       }
       if (pending) {
         r.pendingChange = pending;
         r.status = "external_edit_pending";
       } else {
-        r.status = await getDisplayStatus(nestId, r.id);
+        r.status = displayStatuses?.get(r.id) ?? "draft";
       }
       return r;
     })
   );
   return enriched;
 }
+function withSubtreeTotals(direct) {
+  return direct.map(({ path, count }) => ({
+    path,
+    count,
+    total: direct.reduce(
+      (sum, f) => f.path === path || f.path.startsWith(`${path}/`) ? sum + f.count : sum,
+      0
+    )
+  })).sort((a, b) => a.path.localeCompare(b.path));
+}
+async function listNestFolders(nestId, opts = {}) {
+  if (opts.folder !== void 0) assertSafeFolder(opts.folder);
+  await ensureNodeIndex(nestId);
+  const counts = /* @__PURE__ */ new Map();
+  for (const { path, count } of await indexedFolderCounts(nestId)) {
+    counts.set(path, count);
+    let parent = path;
+    while (parent.includes("/")) {
+      parent = parent.slice(0, parent.lastIndexOf("/"));
+      if (!counts.has(parent)) counts.set(parent, 0);
+    }
+  }
+  const direct = [...counts].map(([path, count]) => ({ path, count }));
+  const scope = opts.folder ?? "";
+  const inScope = direct.filter((f) => {
+    if (scope && !f.path.startsWith(`${scope}/`)) return false;
+    if (opts.recursive === false) {
+      const rel = scope ? f.path.slice(scope.length + 1) : f.path;
+      return !rel.includes("/");
+    }
+    return true;
+  });
+  return withSubtreeTotals(inScope);
+}
+var RECENT_LIMIT = 3;
+async function nestCensus(nestId, userId) {
+  const userEmail = await resolveCallerEmail(userId);
+  await ensureNodeIndex(nestId);
+  const documents = await readIndexedNodes(nestId);
+  const visible = await filterAccessible(nestId, userId, userEmail, documents);
+  const tags = {};
+  const types = {};
+  const direct = /* @__PURE__ */ new Map();
+  const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1e3;
+  let editedLast7d = 0;
+  for (const d of visible) {
+    const fm = d.frontmatter;
+    types[fm.type || "document"] = (types[fm.type || "document"] || 0) + 1;
+    for (const t of fm.tags || []) tags[String(t)] = (tags[String(t)] || 0) + 1;
+    const folder = folderOfId(d.id);
+    if (folder) direct.set(folder, (direct.get(folder) || 0) + 1);
+    const edited = Date.parse(String(fm.updated_at || ""));
+    if (!Number.isNaN(edited) && edited >= cutoff) editedLast7d++;
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const folder of direct.keys()) {
+    const segs = folder.split("/");
+    for (let i = 1; i <= segs.length; i++) paths.add(segs.slice(0, i).join("/"));
+  }
+  const folders = withSubtreeTotals(
+    [...paths].map((path) => ({ path, count: direct.get(path) ?? 0 }))
+  );
+  const statusMap = await getDisplayStatuses(nestId);
+  const statuses = {};
+  for (const d of visible) {
+    const st = statusMap.get(d.id) ?? "draft";
+    statuses[st] = (statuses[st] || 0) + 1;
+  }
+  const authorship = await resolveAuthorship(
+    nestId,
+    visible.map((d) => ({
+      id: d.id,
+      frontmatterAuthor: d.frontmatter.author ?? null
+    }))
+  );
+  const authors = [
+    ...new Set(
+      [...authorship.values()].map((a) => a.author).filter((a) => !!a)
+    )
+  ].sort((a, b) => a.localeCompare(b));
+  const recent = visible.filter((d) => d.frontmatter.updated_at).sort(
+    (a, b) => String(b.frontmatter.updated_at).localeCompare(
+      String(a.frontmatter.updated_at)
+    )
+  ).slice(0, RECENT_LIMIT).map((d) => ({
+    id: d.id,
+    title: String(d.frontmatter.title ?? ""),
+    type: d.frontmatter.type || "document",
+    updated_at: d.frontmatter.updated_at
+  }));
+  return {
+    total: visible.length,
+    folders,
+    tags,
+    types,
+    statuses,
+    authors,
+    editedLast7d,
+    recent
+  };
+}
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
   return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
 }
@@ -2287,14 +2196,27 @@ async function autoPublishReason(nestId, userEmail, doc) {
   return await actorAutoPublishes(nestId, userEmail) ? "owner/admin self-approve" : null;
 }
 async function createNode(nestId, input, userEmail) {
+  const generatedId = !input.id && !slugify(input.title);
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await createNodeOnce(nestId, input, userEmail);
+    } catch (err) {
+      if (!generatedId || attempt >= 3 || !(err instanceof ConflictError)) {
+        throw err;
+      }
+    }
+  }
+}
+async function createNodeOnce(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
   assertTitleLength(input.title);
-  if (!input.id) assertTitleSluggable(input.title);
+  assertTitleReadable(input.title);
   const slug = slugify(input.title).slice(0, 100).replace(/-+$/, "");
   let id = input.id;
   if (!id) {
     const folderSegments = folderToSegments(input.folder ?? "");
-    id = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/${slug}` : `nodes/${slug}`;
+    const prefix = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/` : "nodes/";
+    id = `${prefix}${slug || await generatedSlug(storage, prefix)}`;
   }
   const tags = (input.tags || []).map(normalizeTag2);
   const requestedType = input.type || "document";
@@ -2555,7 +2477,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
       if (patch.title) {
         if (patch.title !== node.frontmatter.title) {
           assertTitleLength(patch.title);
-          assertTitleSluggable(patch.title);
+          assertTitleReadable(patch.title);
         }
         node = {
           ...node,
@@ -2703,6 +2625,8 @@ var NODE_KEYED_TABLES = [
   ["annotation_threads", "node_id"],
   ["comments", "node_id"],
   ["node_tag_index", "node_id"],
+  ["node_index", "node_id"],
+  ["node_suggestions", "node_id"],
   ["watchers", "node_id"],
   ["schedules", "agent_node"],
   // A live capability token bound to one agent node — deleting the agent must
@@ -2781,8 +2705,8 @@ async function moveNode(nestId, nodeId, folder, userEmail) {
     await storage.writeDocument(newId, serializeNodeSafe(moved));
     try {
       const nestPath = resolveNestPath(nestId);
-      const oldChain = join2(nestPath, dirname(nodeId), ".versions", leaf);
-      const newChain = join2(nestPath, dirname(newId), ".versions", leaf);
+      const oldChain = join(nestPath, dirname(nodeId), ".versions", leaf);
+      const newChain = join(nestPath, dirname(newId), ".versions", leaf);
       if (oldChain !== newChain) {
         await mkdir(dirname(newChain), { recursive: true });
         await rename(oldChain, newChain);
@@ -2815,6 +2739,11 @@ async function moveNode(nestId, nodeId, folder, userEmail) {
       await storage.deleteDocument(oldDerived);
     } catch {
     }
+    try {
+      await storage.regenerateIndex();
+    } catch (err) {
+      console.error("[move] regenerateIndex failed", nestId, nodeId, newId, err);
+    }
     await trackEvent("node.move", { nestId, nodeId, newId });
     return { node: moved, previousId: nodeId };
   });
@@ -2885,7 +2814,7 @@ async function deleteFolder(nestId, folder, userEmail) {
 
 // src/nests/unsynced-service.ts
 import { readdirSync, readFileSync, statSync } from "fs";
-import { join as join3, relative, resolve } from "path";
+import { join as join2, relative, resolve } from "path";
 import { rm } from "fs/promises";
 var RESERVED = /* @__PURE__ */ new Set(["nests"]);
 function isNestStorageRoot(absPath) {
@@ -2902,7 +2831,7 @@ function scanMarkdown(dir) {
   }
   for (const e of entries) {
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
-    const full = join3(dir, e.name);
+    const full = join2(dir, e.name);
     if (e.isDirectory()) {
       const sub = scanMarkdown(full);
       count += sub.count;
@@ -2952,7 +2881,7 @@ function collectLeafFolders(rel, abs) {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
     out.push(
-      ...collectLeafFolders(`${rel}/${e.name}`, join3(abs, e.name))
+      ...collectLeafFolders(`${rel}/${e.name}`, join2(abs, e.name))
     );
   }
   return out;
@@ -2970,7 +2899,7 @@ function listUnsyncedFolders() {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".")) continue;
     if (RESERVED.has(e.name)) continue;
-    const abs = join3(root, e.name);
+    const abs = join2(root, e.name);
     if (isNestStorageRoot(abs)) continue;
     out.push(...collectLeafFolders(e.name, abs));
   }
@@ -3007,7 +2936,7 @@ function collectMarkdownFiles(dir, root) {
   }
   for (const e of entries) {
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
-    const full = join3(dir, e.name);
+    const full = join2(dir, e.name);
     if (e.isDirectory()) {
       out.push(...collectMarkdownFiles(full, root));
     } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
@@ -3025,7 +2954,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
     `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
   );
   assertSafeFolderName(folderName);
-  const src = join3(config.DATA_ROOT, folderName);
+  const src = join2(config.DATA_ROOT, folderName);
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
@@ -3081,7 +3010,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
 async function deleteUnsyncedFolder(folderName) {
   console.log(`[unsynced] delete requested folder="${folderName}"`);
   assertSafeFolderName(folderName);
-  const src = join3(config.DATA_ROOT, folderName);
+  const src = join2(config.DATA_ROOT, folderName);
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for delete");
   }
@@ -3099,16 +3028,22 @@ async function deleteUnsyncedFolder(folderName) {
 }
 
 // src/nests/routes.ts
-async function effectivePermission(nestId, userId) {
-  if (config.AUTH_MODE === "open") {
-    const db = getDb();
-    const nest = await db.get(
-      "SELECT user_id FROM nests WHERE id = ?",
-      [nestId]
-    );
-    if (nest && nest.user_id === ANON_USER_ID) return "owner";
+async function effectiveAccess(nestId, userId) {
+  const access = await resolveNestAccess(nestId, userId);
+  if (config.AUTH_MODE === "open" && access.ownerId === ANON_USER_ID) {
+    return { permission: "owner", access };
+  }
+  const permission = access.permission;
+  if (permission === "none" && access.hasGrant) {
+    return { permission: "read", access };
   }
-  return resolveNestPermission(nestId, userId);
+  return { permission, access };
+}
+async function effectivePermission(nestId, userId) {
+  return (await effectiveAccess(nestId, userId)).permission;
+}
+function isGrantOnly(access) {
+  return access.permission === "none" && access.hasGrant;
 }
 var nestRoutes = new Hono3();
 nestRoutes.get("/", async (c) => {
@@ -3119,8 +3054,31 @@ nestRoutes.get("/", async (c) => {
   const db = getDb();
   const ownerEmailSql = "SELECT email FROM users WHERE id = ?";
   const callerEmail = await resolveCallerEmail(userId);
+  const myGrantRows = await db.all(
+    "SELECT nest_id, target FROM grants WHERE user_id = ?",
+    [userId]
+  );
+  const grantTargetsByNest = /* @__PURE__ */ new Map();
+  for (const r of myGrantRows) {
+    const arr = grantTargetsByNest.get(r.nest_id) ?? [];
+    arr.push({ target: r.target });
+    grantTargetsByNest.set(r.nest_id, arr);
+  }
   const annotate = async (n) => {
-    const permission = await effectivePermission(n.id, userId);
+    const { permission, access } = await effectiveAccess(n.id, userId);
+    if (permission !== "owner" && // open-mode commons promotion outranks a grant
+    isGrantOnly(access)) {
+      const owner_email2 = n.user_id === ANON_USER_ID ? null : (await db.get(ownerEmailSql, [n.user_id]))?.email ?? null;
+      return {
+        ...n,
+        permission: "read",
+        is_owner: false,
+        owner_email: owner_email2,
+        roles: ["viewer"],
+        grant_only: true,
+        stewardship_enabled: !!n.stewardship_enabled
+      };
+    }
     const is_owner = permission === "owner";
     const needOwnerEmail = !is_owner && n.user_id !== ANON_USER_ID;
     const [roles, owner_email] = await Promise.all([
@@ -3135,6 +3093,7 @@ nestRoutes.get("/", async (c) => {
       is_owner,
       owner_email,
       roles,
+      grant_only: false,
       stewardship_enabled: !!n.stewardship_enabled
     };
   };
@@ -3147,9 +3106,11 @@ nestRoutes.get("/", async (c) => {
   }
   const out = await Promise.all(deduped.map(annotate));
   const docRows = await db.all(
-    "SELECT nest_id, COUNT(DISTINCT node_id) AS c FROM node_versions GROUP BY nest_id"
+    `SELECT nest_id, COUNT(DISTINCT node_id) AS c, MAX(created_at) AS last_activity
+       FROM node_versions GROUP BY nest_id`
   );
   const docByNest = new Map(docRows.map((r) => [r.nest_id, Number(r.c)]));
+  const activityByNest = new Map(docRows.map((r) => [r.nest_id, r.last_activity]));
   const collabRows = await db.all(
     "SELECT nest_id, COUNT(*) AS c FROM nest_collaborators GROUP BY nest_id"
   );
@@ -3178,14 +3139,39 @@ nestRoutes.get("/", async (c) => {
     if (arr.length < 8) arr.push(r.email);
     collabEmailsByNest.set(r.nest_id, arr);
   }
-  const withMeta = out.map((n) => ({
-    ...n,
-    document_count: docByNest.get(n.id) ?? 0,
-    collaborator_count: collabByNest.get(n.id) ?? 0,
-    steward_count: stewardByNest.get(n.id) ?? 0,
-    steward_emails: stewardEmailsByNest.get(n.id) ?? [],
-    collaborator_emails: collabEmailsByNest.get(n.id) ?? []
-  }));
+  const grantOnlyIds = out.filter((n) => n.grant_only).map((n) => n.id);
+  const grantedDocsByNest = /* @__PURE__ */ new Map();
+  if (grantOnlyIds.length) {
+    const rows = await db.all(
+      `SELECT DISTINCT nest_id, node_id FROM node_versions
+        WHERE nest_id IN (${grantOnlyIds.map(() => "?").join(",")})`,
+      grantOnlyIds
+    );
+    for (const r of rows) {
+      const targets = grantTargetsByNest.get(r.nest_id) ?? [];
+      if (grantCoversNode(targets, r.node_id)) {
+        grantedDocsByNest.set(r.nest_id, (grantedDocsByNest.get(r.nest_id) ?? 0) + 1);
+      }
+    }
+  }
+  const withMeta = out.map(
+    (n) => n.grant_only ? {
+      ...n,
+      document_count: grantedDocsByNest.get(n.id) ?? 0,
+      collaborator_count: 0,
+      steward_count: 0,
+      steward_emails: [],
+      collaborator_emails: []
+    } : {
+      ...n,
+      last_activity: activityByNest.get(n.id) ?? null,
+      document_count: docByNest.get(n.id) ?? 0,
+      collaborator_count: collabByNest.get(n.id) ?? 0,
+      steward_count: stewardByNest.get(n.id) ?? 0,
+      steward_emails: stewardEmailsByNest.get(n.id) ?? [],
+      collaborator_emails: collabEmailsByNest.get(n.id) ?? []
+    }
+  );
   return c.json({ nests: withMeta });
 });
 nestRoutes.post("/", async (c) => {
@@ -3291,7 +3277,7 @@ nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   if (nestId === "unsynced") return handleUnsyncedList(c);
   const userId = c.get("userId");
-  const permission = await effectivePermission(nestId, userId);
+  const { permission, access } = await effectiveAccess(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
@@ -3301,8 +3287,15 @@ nestRoutes.get("/:nestId", async (c) => {
     roles = ["owner", ...roles];
   }
   const myStewards = await getStewardsForUser(nestId, email);
+  const grant_only = roles.length === 0 && isGrantOnly(access);
   const nest = await getNest(nestId);
-  return c.json({ nest, permission, roles, myStewards });
+  return c.json({
+    nest,
+    permission,
+    roles: grant_only ? ["viewer"] : roles,
+    myStewards,
+    grant_only
+  });
 });
 nestRoutes.patch("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3435,7 +3428,7 @@ async function addCollaborator(params) {
     if (existing) {
       userId = existing.id;
     } else {
-      const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
+      const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
       userId = uuid3();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
@@ -3627,7 +3620,7 @@ async function resolveGrantee(email) {
   const e = normalizeEmail(email);
   const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
   if (existing) return existing.id;
-  const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
+  const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
   const id = uuid4();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
@@ -3635,6 +3628,41 @@ async function resolveGrantee(email) {
   );
   return id;
 }
+async function assertGrantAddsAccess(params) {
+  const { nestId, email, userId, targetType, target, role } = params;
+  const roles = [];
+  if (userId) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (access.ownerId === userId) roles.push("owner");
+    const collab = collabPermToRole(access.collaboratorPermission);
+    if (collab) roles.push(collab);
+    for (const teamRole of await resolveTeamRolesForUser(nestId, userId)) {
+      roles.push(teamRole);
+    }
+  }
+  if (targetType === "document") {
+    const stewards = await resolveStewardsForNode(nestId, target);
+    for (const s of stewards) {
+      if (s.steward.userEmail.toLowerCase() === email.toLowerCase()) {
+        roles.push(s.steward.role);
+      }
+    }
+  }
+  const covered = role === "write" ? canEditWith(roles) : roles.length > 0;
+  if (covered) {
+    const held = primaryRole(roles) ?? "existing";
+    throw new ValidationError(
+      `${email} already has ${held} access here, so this ${targetType} is already ${role === "write" ? "editable by" : "visible to"} them.`
+    );
+  }
+  if (!userId) return;
+  const existing = await resolveNodeGrant(nestId, userId, target);
+  if (existing && (role === "read" || existing === "write")) {
+    throw new ValidationError(
+      `${email} has already been shared this ${targetType} (${existing === "write" ? "can edit" : "can view"}).`
+    );
+  }
+}
 grantRoutes.post("/", async (c) => {
   const nestId = c.req.param("nestId");
   await requireManage(c, nestId);
@@ -3650,7 +3678,19 @@ grantRoutes.post("/", async (c) => {
   if (!["read", "write"].includes(role)) {
     throw new ValidationError("role must be read | write");
   }
-  const userId = await resolveGrantee(body.email);
+  const email = normalizeEmail(body.email);
+  const known = await getDb().get("SELECT id FROM users WHERE LOWER(email) = ?", [
+    email
+  ]);
+  await assertGrantAddsAccess({
+    nestId,
+    email,
+    userId: known?.id ?? null,
+    targetType,
+    target,
+    role
+  });
+  const userId = known?.id ?? await resolveGrantee(body.email);
   const grant = await createGrant({
     nestId,
     targetType,
@@ -4002,6 +4042,25 @@ teamRoutes.delete("/:teamId/members/:userId", async (c) => {
 });
 
 // src/nodes/search.ts
+async function discoverForSearch(storage) {
+  return storage.discoverDocuments({ includeRetired: true });
+}
+function titleScore(title, query) {
+  const t = (title || "").toLowerCase();
+  const q = query.trim().toLowerCase();
+  if (!q) return 0;
+  if (t === q) return 4;
+  let midWord = false;
+  for (let i = t.indexOf(q); i !== -1; i = t.indexOf(q, i + 1)) {
+    if (i === 0) return 3;
+    if (!/[a-z0-9]/.test(t[i - 1])) return 2;
+    midWord = true;
+  }
+  if (midWord) return 1;
+  const terms = q.split(/\s+/).filter(Boolean);
+  if (terms.length > 1 && terms.every((term) => t.includes(term))) return 1;
+  return 0;
+}
 function matchDocuments(documents, query) {
   const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return [];
@@ -4013,15 +4072,25 @@ function matchDocuments(documents, query) {
       ...node.frontmatter.tags || []
     ].join(" ").toLowerCase();
     return terms.every((term) => haystack.includes(term));
-  });
+  }).sort(
+    (a, b) => titleScore(b.frontmatter.title, query) - titleScore(a.frontmatter.title, query)
+  );
 }
-function toSearchHit(node) {
+function bodySnippet(body, query) {
+  const flat = body.replace(/\s+/g, " ").trim();
+  const terms = (query || "").toLowerCase().split(/\s+/).filter(Boolean);
+  const at = terms.map((t) => flat.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0];
+  if (at === void 0 || at < 80) return flat.slice(0, 200);
+  const start = Math.max(0, at - 60);
+  return `\u2026${flat.slice(start, start + 200)}`;
+}
+function toSearchHit(node, query) {
   return {
     id: node.id,
     title: node.frontmatter.title,
     type: node.frontmatter.type || "document",
     tags: node.frontmatter.tags || [],
-    snippet: (node.body || "").slice(0, 200).replace(/\n/g, " ")
+    snippet: bodySnippet(node.body || "", query)
   };
 }
 
@@ -4029,7 +4098,7 @@ function toSearchHit(node) {
 import { Hono as Hono8 } from "hono";
 
 // src/nodes/markdown-export.ts
-import { parseDocument as parseDocument3 } from "@promptowl/contextnest-engine";
+import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
 function nodeToMarkdown(node) {
   const tags = node.tags ?? [];
   return [
@@ -4065,7 +4134,7 @@ function rawContentType(nodeType) {
 function frontmatterBlockOf(raw) {
   if (!raw || !raw.startsWith("---")) return "";
   try {
-    const body = parseDocument3("frontmatter-split.md", raw, "frontmatter-split").body ?? "";
+    const body = parseDocument2("frontmatter-split.md", raw, "frontmatter-split").body ?? "";
     if (raw.endsWith(body)) return raw.slice(0, raw.length - body.length);
   } catch {
   }
@@ -4111,7 +4180,14 @@ nodeRoutes.get("/", async (c) => {
     // Lets an owner preview what making the nest public would expose.
     ...q.approved_only === "1" || q.approved_only === "true" ? { approvedOnly: true } : {},
     // Ignore junk rather than 400 — a bad ?limit should not fail a listing.
-    ...limit !== void 0 && Number.isFinite(limit) && limit > 0 ? { limit } : {}
+    ...limit !== void 0 && Number.isFinite(limit) && limit > 0 ? { limit } : {},
+    // Present (even as "") = one folder level only, for the lazily-expanded
+    // document tree. Absent = the whole nest, as every existing caller expects.
+    ...q.folder !== void 0 ? { folder: q.folder } : {},
+    // Bodies are off by default — the list is served from the DB index, which
+    // holds metadata only. Opt back in and the listing crawls the vault for
+    // them; kept for any client that was reading `content` off this route.
+    ...q.content === "1" || q.content === "true" ? { withContent: true } : {}
   });
   return c.json({ count: nodes.length, nodes });
 });
@@ -4153,7 +4229,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-LTREGVSJ.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-U4CKL7Y5.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4174,7 +4250,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-V2GR6VM3.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-H2M5ACPQ.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -4298,6 +4374,7 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       response.collaborators = people.collaborators;
     }
   }
+  response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
   if (publicReader) {
     const approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
@@ -5233,7 +5310,7 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
 
 // src/nests/bundle-service.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join4, sep } from "path";
+import { join as join3, sep } from "path";
 import JSZip from "jszip";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 function walkFiles(root) {
@@ -5246,7 +5323,7 @@ function walkFiles(root) {
   }
   for (const rel of entries) {
     try {
-      if (statSync2(join4(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+      if (statSync2(join3(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
     } catch {
     }
   }
@@ -5287,7 +5364,7 @@ async function exportNestBundle(nestId, includeDrafts) {
     const segs = rel.split("/");
     const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
     if (!keep) continue;
-    zip.file(rel, readFileSync2(join4(nestPath, rel)));
+    zip.file(rel, readFileSync2(join3(nestPath, rel)));
   }
   trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
   return zip.generateAsync({ type: "arraybuffer" });
@@ -5458,7 +5535,9 @@ queryRoutes.get("/changes", async (c) => {
   const includeContent = ["1", "true"].includes(
     c.req.query("include_content") || ""
   );
-  const all = await listNodesForCaller(nestId, userId);
+  const all = await listNodesForCaller(nestId, userId, {
+    ...includeContent ? { withContent: true } : {}
+  });
   const db = getDb();
   const publicReader = await isPublicReader(nestId, userId);
   const approvedRows = await db.all(
@@ -5525,7 +5604,10 @@ queryRoutes.get("/runnables", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
   const all = await listNodesForCaller(nestId, userId, {
-    type: RUNNABLE_NODE_TYPES
+    type: RUNNABLE_NODE_TYPES,
+    // The prompt/skill body IS the payload here — an orchestrator pulls it to
+    // run the thing, so this surface pays for the file reads.
+    withContent: true
   });
   const runnables = all.map((n) => ({
     id: n.id,
@@ -5785,15 +5867,14 @@ queryRoutes.get("/search", async (c) => {
   }
   const nestId = c.req.param("nestId");
   const { storage } = await engineCache.get(nestId);
-  const documents = await storage.discoverDocuments();
-  const matches = matchDocuments(documents, q);
+  const matches = matchDocuments(await discoverForSearch(storage), q);
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const accessible = await filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
-    nodes: accessible.map(toSearchHit)
+    nodes: accessible.map((n) => toSearchHit(n, q))
   });
 });
 queryRoutes.get("/overview", async (c) => {
@@ -5821,6 +5902,25 @@ queryRoutes.get("/overview", async (c) => {
     }))
   });
 });
+queryRoutes.get("/census", async (c) => {
+  const census = await nestCensus(c.req.param("nestId"), c.get("userId"));
+  return c.json({ census });
+});
+queryRoutes.get("/folders", async (c) => {
+  const q = c.req.query();
+  const folders = await listNestFolders(c.req.param("nestId"), {
+    ...q.folder !== void 0 ? { folder: q.folder } : {},
+    ...q.recursive === "0" || q.recursive === "false" ? { recursive: false } : {}
+  });
+  return c.json({ folders });
+});
+queryRoutes.post("/reindex", async (c) => {
+  if (permissionLevel(c.get("nestPermission")) < permissionLevel("write")) {
+    throw new ForbiddenError("Reindexing a nest requires write access");
+  }
+  const indexed = await rebuildNodeIndex(c.req.param("nestId"));
+  return c.json({ indexed });
+});
 queryRoutes.get("/comment-counts", async (c) => {
   const counts = await countThreadsByNode(c.req.param("nestId"));
   return c.json({ counts });
@@ -5833,10 +5933,6 @@ queryRoutes.get("/context", async (c) => {
 queryRoutes.get("/export", async (c) => {
   const nestId = c.req.param("nestId");
   if (c.req.query("format") === "bundle") {
-    const perm = await resolveNestPermission(nestId, c.get("userId"));
-    if (perm !== "owner" && perm !== "admin") {
-      throw new ForbiddenError("Only the nest owner or an admin can export a bundle");
-    }
     const draftsParam = c.req.query("includeDrafts");
     const includeDrafts = draftsParam === "1" || draftsParam === "true";
     const zip = await exportNestBundle(nestId, includeDrafts);
@@ -5969,30 +6065,6 @@ import { Hono as Hono12 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
-// src/shared/node-id.ts
-function assertSafeNodeId(rawId) {
-  let id = rawId;
-  try {
-    id = decodeURIComponent(rawId);
-  } catch {
-  }
-  if (!id || id.length > 512) {
-    throw new ValidationError("invalid node id");
-  }
-  if (id.includes("\0") || id.includes("\\")) {
-    throw new ValidationError("invalid node id");
-  }
-  if (id.startsWith("/")) {
-    throw new ValidationError("invalid node id (absolute path)");
-  }
-  for (const seg of id.split("/")) {
-    if (seg === "" || seg === "." || seg === "..") {
-      throw new ValidationError("invalid node id (path traversal)");
-    }
-  }
-  return id;
-}
-
 // src/telemetry/trace-log.ts
 var PRUNE_EVERY = 500;
 var insertsSincePrune = 0;
@@ -6296,6 +6368,30 @@ async function appendRunStep(runId, input) {
   return { seq };
 }
 var RUN_STATUSES = ["running", "succeeded", "failed", "cancelled"];
+async function cancelDescendants(runId) {
+  const db = getDb();
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  const trace = JSON.stringify({ error: "Parent run cancelled" });
+  let frontier = [runId];
+  let cancelled = 0;
+  for (let depth = 0; frontier.length && depth < 64; depth++) {
+    const ph = frontier.map(() => "?").join(",");
+    const kids = await db.all(
+      `SELECT id FROM runs WHERE parent_run_id IN (${ph}) AND status = 'running'`,
+      frontier
+    );
+    if (!kids.length) break;
+    frontier = kids.map((k) => k.id);
+    const kph = frontier.map(() => "?").join(",");
+    await db.run(
+      `UPDATE runs SET status = 'cancelled', trace = COALESCE(trace, ?), finished_at = ?
+        WHERE id IN (${kph}) AND status = 'running'`,
+      [trace, at, ...frontier]
+    );
+    cancelled += frontier.length;
+  }
+  return cancelled;
+}
 async function closeRun(runId, input) {
   const status = input.status;
   if (typeof status !== "string" || !RUN_STATUSES.includes(status)) {
@@ -6317,6 +6413,7 @@ async function closeRun(runId, input) {
     if (!run) throw new NotFoundError("Run not found");
     throw new ConflictError("Run already terminal \u2014 status can't be changed");
   }
+  if (status === "cancelled") await cancelDescendants(runId);
   return { status };
 }
 async function getRunTrace(run, opts) {
@@ -7620,7 +7717,9 @@ ${context_md}`;
         {},
         await opContext(nestId, userEmail)
       );
-      const visible = await listNodesForCallerByEmail(nestId, userEmail, {});
+      const visible = await listNodesForCallerByEmail(nestId, userEmail, {
+        withContent: true
+      });
       const types = {};
       const tags = {};
       for (const n of visible) {
@@ -7923,6 +8022,13 @@ ${sections}`;
           (n) => String(n.frontmatter.title ?? "").toLowerCase() === wanted
         );
         if (twin) {
+          const twinVersions = await getVersions(nestId, twin.id);
+          if (twinVersions.length === 0) {
+            return toolError(
+              `A node titled "${twin.frontmatter.title}" already exists (${twin.id}) but has no version history, which is why it doesn't show up in a read or a draft list. It may be an interrupted create or a document whose import never finished. Write into it with context_update "${twin.id}" to keep whatever is there, or remove it with context_delete "${twin.id}" and create again \u2014 check its content first.`,
+              "DOCUMENT_ALREADY_EXISTS"
+            );
+          }
           return toolError(
             `A node titled "${twin.frontmatter.title}" already exists (${twin.id}). Titles must be unique \u2014 MCP tools resolve documents by title, so a second one would be unreachable. Use context_update to change it, context_move to refile it, or create this one under a different title.`,
             "DOCUMENT_ALREADY_EXISTS"
@@ -8076,6 +8182,9 @@ ${sections}`;
         return "reason is required \u2014 say why it should be deleted; that is what the admin judges.";
       }
       if (args.nest === true) {
+        if (!await canRequestDeletion({ nestId, userId, userEmail, nodeId: "" })) {
+          return "Only an editor, a nest admin, or the nest owner can request the deletion of a nest.";
+        }
         const request2 = await requestDeletion({
           nestId,
           nodeId: nestId,
@@ -8088,6 +8197,9 @@ ${sections}`;
 Request id: \`${request2.id}\``;
       }
       if (typeof args.folder === "string" && args.folder.trim()) {
+        if (!await canRequestDeletion({ nestId, userId, userEmail, nodeId: "" })) {
+          return "Only an editor, a nest admin, or the nest owner can request the deletion of a folder.";
+        }
         const folder = args.folder.trim().replace(/^\/+|\/+$/g, "").replace(/^nodes\//, "");
         const docs = await storage.discoverDocuments();
         const inside = docs.filter((d) => isIdUnderFolder(d.id, folder));
@@ -8110,6 +8222,14 @@ Request id: \`${request2.id}\``;
       if (!await canReadNode(nestId, node.id, userId, userEmail)) {
         return `Node not found: ${node.id}`;
       }
+      if (!await canRequestDeletion({
+        nestId,
+        userId,
+        userEmail,
+        nodeId: node.id
+      })) {
+        return "Only an editor, a nest admin, or the nest owner can request the deletion of a document.";
+      }
       const request = await requestDeletion({
         nestId,
         nodeId: node.id,
@@ -8434,14 +8554,14 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-I535QVTW.js");
-        const db = (await import("./client-OBS5HOTA.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-ME7HIVHU.js");
+        const db = (await import("./client-SW5I6ZBK.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
-          const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
+          const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
           const { v4: uuid16 } = await import("uuid");
           const id = uuid16();
           await db.run(
@@ -8904,8 +9024,9 @@ runDetailRoutes.patch("/:id", requireWorkflowPlane, async (c) => {
     throw new ValidationError("status must be running | succeeded | failed | cancelled");
   }
   const terminal = status !== "running";
-  await getDb().run(
-    `UPDATE runs SET status = ?, trace = COALESCE(?, trace), finished_at = ? WHERE id = ?`,
+  const res = await getDb().run(
+    `UPDATE runs SET status = ?, trace = COALESCE(?, trace), finished_at = ?
+      WHERE id = ? AND status = 'running'`,
     [
       status,
       body.trace === void 0 ? null : JSON.stringify(body.trace),
@@ -8913,6 +9034,13 @@ runDetailRoutes.patch("/:id", requireWorkflowPlane, async (c) => {
       run.id
     ]
   );
+  if (!res.changes) {
+    const now = await getDb().get("SELECT status FROM runs WHERE id = ?", [
+      run.id
+    ]);
+    throw new ConflictError(`Run already terminal (${now?.status ?? "closed"})`);
+  }
+  if (status === "cancelled") await cancelDescendants(run.id);
   if (status === "failed") {
     const err = body.trace && typeof body.trace === "object" ? String(body.trace.error ?? "").slice(0, 200) : "";
     void dispatchEvent({
@@ -9521,8 +9649,8 @@ definitionRoutes.delete("/:id", async (c) => {
 // src/nests/asset-routes.ts
 import { Hono as Hono18 } from "hono";
 import { v4 as uuid13 } from "uuid";
-import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
+import { join as join4 } from "path";
 var assetRoutes = new Hono18();
 var CONTENT_TYPES = {
   png: "image/png",
@@ -9570,9 +9698,9 @@ assetRoutes.post("/", async (c) => {
     );
   }
   const name = `${uuid13()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join5(resolveNestPath(nestId), "assets");
+  const dir = join4(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
-  await writeFile(join5(dir, name), Buffer.from(await file.arrayBuffer()));
+  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
   const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
@@ -9594,7 +9722,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile2(join5(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile(join4(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -10024,6 +10152,11 @@ Streamable HTTP, stateless. Two endpoints:
   (new document in a writable nest; a \`folder\` path creates the folder).
 - \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, full toolset including writes and
   governance (create/update, submit/approve/reject, stewards, sharing).
+  Sharing a slice is one call: \`context_grant\` with
+  \`{ "email", "target_type": "document" | "folder", "target", "role": "read" | "write" }\`
+  \u2014 \`target\` is a node id (\`nodes/win-loss-log\`) or a folder prefix
+  (\`nodes/gtm/deals\`). The recipient reaches exactly that document, or
+  everything under that folder, and nothing else in the nest. Owner/admin only.
 
 Claude Code / Cursor / VS Code connect natively via HTTP with the
 \`Authorization: Bearer\` header. Claude Desktop needs the mcp-remote bridge:
@@ -10032,20 +10165,9 @@ Claude Code / Cursor / VS Code connect natively via HTTP with the
 npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
 \`\`\`
 
-## ctx CLI (npm: @promptowl/contextnest-cli)
-
-\`npm i -g @promptowl/contextnest-cli\`
-
-- \`ctx push --server ${B} --nest <nest-id> --key <api-key>\` \u2014 upload a local
-  vault into a nest (add \`--include-drafts\` for unpublished nodes).
-- All other ctx commands (\`query\`, \`add\`, \`search\`, \`checkpoint\`) operate on
-  a LOCAL vault directory only. For remote reads use the API or MCP above \u2014
-  there is currently no remote \`ctx query\`.
-
 ## npm packages
 
 - \`@promptowl/contextnest-community\` \u2014 this server
-- \`@promptowl/contextnest-cli\` \u2014 the ctx CLI
 - \`@promptowl/contextnest-engine\` \u2014 vault storage + selector/graph engine
 
 ## Conventions
@@ -10410,7 +10532,7 @@ function rowToComment(row) {
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync3, existsSync } from "fs";
-import { join as join6 } from "path";
+import { join as join5 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -10476,9 +10598,9 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join6(nestPath, "stewards.yaml"),
-    join6(nestPath, "stewards.yml"),
-    join6(nestPath, ".context", "stewards.yaml")
+    join5(nestPath, "stewards.yaml"),
+    join5(nestPath, "stewards.yml"),
+    join5(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
@@ -10624,6 +10746,25 @@ function denyUnlessNestManager(c, what) {
     403
   );
 }
+async function mayRequestDeletion(c, nestId, nodeId) {
+  return canRequestDeletion({
+    nestId,
+    userId: c.get("userId"),
+    userEmail: await getUserEmail4(c),
+    nodeId,
+    // The middleware promotes open-mode callers; resolving fresh would miss it.
+    permission: c.get("nestPermission")
+  });
+}
+function denyUnlessEditor(allowed, c, what) {
+  if (allowed) return null;
+  return c.json(
+    {
+      error: `Only an editor, a nest admin, or the nest owner can request the deletion of ${what}.`
+    },
+    403
+  );
+}
 governanceRoutes.post("/delete-folder", async (c) => {
   const nestId = c.req.param("nestId");
   const denied = denyUnlessNestManager(c, "a folder");
@@ -10641,6 +10782,12 @@ governanceRoutes.post("/delete-folder", async (c) => {
 });
 governanceRoutes.post("/request-deletion", async (c) => {
   const nestId = c.req.param("nestId");
+  const denied = denyUnlessEditor(
+    await mayRequestDeletion(c, nestId, ""),
+    c,
+    "a folder or a nest"
+  );
+  if (denied) return denied;
   const body = await c.req.json().catch(() => ({}));
   const reason = body.reason?.trim();
   if (!reason) {
@@ -10731,6 +10878,16 @@ governanceRoutes.post("/deletion-requests/:id/decline", async (c) => {
   if (!request) return c.json({ error: "Deletion request not found" }, 404);
   return c.json({ request });
 });
+governanceRoutes.post("/deletion-requests/:id/withdraw", async (c) => {
+  const nestId = c.req.param("nestId");
+  const request = await withdrawDeletionRequest({
+    nestId,
+    id: c.req.param("id"),
+    withdrawnBy: await getUserEmail4(c)
+  });
+  if (!request) return c.json({ error: "Deletion request not found or not yours" }, 404);
+  return c.json({ withdrawn: true, request });
+});
 governanceRoutes.get("/feed", async (c) => {
   const nestId = c.req.param("nestId");
   const filterRaw = c.req.query("filter");
@@ -10804,7 +10961,7 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const approved = await getApprovedVersion(nestId, nodeId);
   const { versions: versionManager } = await engineCache.get(nestId);
   const resolutions = await getDb().all(
-    `SELECT version, status, resolved_by
+    `SELECT version, status, resolved_by, resolution_note
        FROM review_requests
       WHERE nest_id = ? AND node_id = ?
         AND status IN ('approved', 'rejected')
@@ -10815,13 +10972,21 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const byVersion = /* @__PURE__ */ new Map();
   for (const r of resolutions) {
     if (!byVersion.has(r.version)) {
-      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+      byVersion.set(r.version, {
+        status: r.status,
+        resolvedBy: r.resolved_by,
+        resolutionNote: r.resolution_note?.trim() || void 0
+      });
     }
   }
   const enriched = await Promise.all(
     allVersions.map(async (v) => {
       const r = byVersion.get(v.version);
-      const resolution = r ? { resolvedBy: r.resolvedBy, resolutionStatus: r.status } : {};
+      const resolution = r ? {
+        resolvedBy: r.resolvedBy,
+        resolutionStatus: r.status,
+        resolutionNote: r.resolutionNote
+      } : {};
       try {
         const diff = await versionManager.getDiff(nodeId, v.version);
         return { ...v, ...resolution, diff: diff ?? void 0 };
@@ -10988,6 +11153,12 @@ governanceNodeRoutes.post("/:nodeId{.+}/request-deletion", async (c) => {
   if (!await canReadNode(nestId, nodeId, c.get("userId"), userEmail)) {
     return c.json({ error: `Node not found: ${nodeId}` }, 404);
   }
+  const denied = denyUnlessEditor(
+    await mayRequestDeletion(c, nestId, nodeId),
+    c,
+    "a document"
+  );
+  if (denied) return denied;
   const { storage } = await engineCache.get(nestId);
   try {
     await storage.readDocument(nodeId);
@@ -11193,19 +11364,19 @@ async function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, join as join7, relative as relative2 } from "path";
+import { dirname as dirname2, join as join6, relative as relative2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var SERVICE_VERSION = (() => {
   try {
-    return JSON.parse(readFileSync4(join7(HERE, "..", "package.json"), "utf8")).version;
+    return JSON.parse(readFileSync4(join6(HERE, "..", "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
 })();
 var UI_DIR_CANDIDATES = [
-  join7(HERE, "web3"),
-  join7(process.cwd(), "dist", "web3")
+  join6(HERE, "web3"),
+  join6(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
@@ -12102,14 +12273,14 @@ function createApp() {
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
     const perNest = await Promise.all(
-      (await listVisibleNests(userId)).map(async (nest) => {
+      (await listVisibleNests(userId, { readable: true })).map(async (nest) => {
         try {
           const { storage } = await engineCache.get(nest.id);
-          const matches = matchDocuments(await storage.discoverDocuments(), q);
+          const matches = matchDocuments(await discoverForSearch(storage), q);
           if (matches.length === 0) return [];
           const accessible = await filterAccessible(nest.id, userId, userEmail, matches);
           return accessible.map((n) => ({
-            ...toSearchHit(n),
+            ...toSearchHit(n, q),
             nest_id: nest.id,
             nest_name: nest.name ?? nest.id
           }));
@@ -12119,7 +12290,7 @@ function createApp() {
         }
       })
     );
-    const hits = perNest.flat();
+    const hits = perNest.flat().sort((a, b) => titleScore(b.title, q) - titleScore(a.title, q));
     return c.json({
       query: q,
       count: hits.length,
@@ -12195,7 +12366,8 @@ function createApp() {
       c.set("nestPermission", "owner");
       return next();
     }
-    const permission = await resolveNestPermission(nestId, userId);
+    const access = await resolveNestAccess(nestId, userId);
+    const permission = access.permission;
     const isReadQuery = parts.length === 2 && ["context", "query", "search", "export"].includes(parts[1]);
     let grantRole = null;
     let grantNestVisible = false;
@@ -12208,11 +12380,13 @@ function createApp() {
         }
         grantRole = await resolveNodeGrant(nestId, userId, targetTail);
       } else if (parts.length === 1 && c.req.method === "GET") {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
       } else if (parts[1] === "nodes" && parts.length === 2 && c.req.method === "GET") {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
       } else if (isReadQuery) {
-        grantNestVisible = await hasAnyGrant(nestId, userId);
+        grantNestVisible = access.hasGrant;
+      } else if (parts[1] === "definitions" && parts.length === 2 && c.req.method === "GET") {
+        grantNestVisible = access.hasGrant;
       }
       if (!grantRole && !grantNestVisible) {
         return deny(404, "Nest not found", {
@@ -12225,7 +12399,7 @@ function createApp() {
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
-    const isDeletionRequestAction = /\/request-deletion$/.test(path);
+    const isDeletionRequestAction = /\/request-deletion$/.test(path) || /\/deletion-requests\/[^/]+\/withdraw$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
     if (isStewardRoster && permission !== "owner" && permission !== "admin") {
       return c.json(