@promptowl/contextnest-community 1.2.0 → 1.3.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-E7E3JMQR.js";
+} from "./chunk-EDJRDWPL.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +25,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-LO54V4AU.js";
+} from "./chunk-6AXBB65N.js";
 import {
   AppError,
   ConflictError,
@@ -67,6 +67,7 @@ import {
   nestAllowsSelfApprove,
   permissionLevel,
   removeSteward,
+  renameNest,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
@@ -77,15 +78,16 @@ import {
   startTelemetryLoop,
   syncFromConfig,
   trackEvent,
+  uniqueNestName,
   updateSteward,
   validateLicense
-} from "./chunk-5MT4ZBVF.js";
+} from "./chunk-SO74PQWI.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-G62P54ET.js";
+} from "./chunk-UEHFNBNR.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -210,6 +212,11 @@ var authMiddleware = createMiddleware(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
+// src/shared/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function liveBucket(key, cutoff) {
@@ -300,12 +307,13 @@ authRoutes.post("/register", async (c) => {
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  const email = normalizeEmail(body.email);
   const ip = clientIp(c);
   if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id, is_invited FROM users WHERE email = ?").get(body.email);
+  const existing = db.prepare("SELECT id, is_invited FROM users WHERE LOWER(email) = ?").get(email);
   let userId;
   const passwordHash = await hashPassword(body.password);
   if (existing && existing.is_invited === 1) {
@@ -313,15 +321,15 @@ authRoutes.post("/register", async (c) => {
     db.prepare(
       "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
     ).run(passwordHash, body.name || null, userId);
-    trackEvent("user.register", { userId, email: body.email, claimed: true });
+    trackEvent("user.register", { userId, email, claimed: true });
   } else if (existing) {
     throw new ValidationError("Email already registered");
   } else {
     userId = uuid();
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, body.email, body.name || null, passwordHash);
-    trackEvent("user.register", { userId, email: body.email });
+    ).run(userId, email, body.name || null, passwordHash);
+    trackEvent("user.register", { userId, email });
   }
   const sessionId = createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
@@ -329,9 +337,9 @@ authRoutes.post("/register", async (c) => {
     {
       user: {
         id: userId,
-        email: body.email,
+        email,
         name: body.name || null,
-        is_admin: isLicenseAdminEmail(body.email)
+        is_admin: isLicenseAdminEmail(email)
       }
     },
     201
@@ -352,8 +360,8 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = db.prepare(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE email = ?"
-  ).get(body.email);
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?"
+  ).get(emailLower);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
     if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
@@ -538,14 +546,15 @@ authRoutes.post("/promptowl", async (c) => {
     }
   }
   const db = getDb();
-  let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
+  const meEmail = normalizeEmail(me.email);
+  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, me.email, me.name || null, placeholderHash);
-    user = { id: userId, email: me.email, name: me.name || null };
+    ).run(userId, meEmail, me.name || null, placeholderHash);
+    user = { id: userId, email: meEmail, name: me.name || null };
     trackEvent("user.register", {
       userId,
       email: me.email,
@@ -727,6 +736,7 @@ authRoutes.delete("/users/:userId", async (c) => {
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
+  const email = normalizeEmail(body.email);
   const callerId = resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
@@ -745,14 +755,14 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
+  let user = db.prepare("SELECT id, email FROM users WHERE LOWER(email) = ?").get(email);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-    ).run(userId, body.email, null, placeholderHash);
-    user = { id: userId, email: body.email };
+    ).run(userId, email, null, placeholderHash);
+    user = { id: userId, email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
@@ -1069,7 +1079,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-624QTR5K.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1449,6 +1459,185 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   return { node, version: responseVersion };
 }
 
+// src/nests/unsynced-service.ts
+import { readdirSync, readFileSync, rmSync, statSync } from "fs";
+import { join as join2, relative } from "path";
+var RESERVED = /* @__PURE__ */ new Set(["nests"]);
+function scanMarkdown(dir) {
+  let count = 0;
+  let size = 0;
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return { count, size };
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      const sub = scanMarkdown(full);
+      count += sub.count;
+      size += sub.size;
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        size += statSync(full).size;
+        count++;
+      } catch {
+      }
+    }
+  }
+  return { count, size };
+}
+function hasDirectMarkdown(dir) {
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  return entries.some(
+    (e) => e.isFile() && e.name.toLowerCase().endsWith(".md")
+  );
+}
+function collectLeafFolders(rel, abs) {
+  if (hasDirectMarkdown(abs)) {
+    const { count, size } = scanMarkdown(abs);
+    const segments = rel.split("/").filter(Boolean);
+    return [
+      {
+        name: rel,
+        label: segments[segments.length - 1] || rel,
+        mdCount: count,
+        sizeBytes: size
+      }
+    ];
+  }
+  let entries = [];
+  try {
+    entries = readdirSync(abs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    out.push(
+      ...collectLeafFolders(`${rel}/${e.name}`, join2(abs, e.name))
+    );
+  }
+  return out;
+}
+function listUnsyncedFolders() {
+  const root = config.DATA_ROOT;
+  let entries = [];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".")) continue;
+    if (RESERVED.has(e.name)) continue;
+    out.push(...collectLeafFolders(e.name, join2(root, e.name)));
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name));
+  console.log(
+    `[unsynced] discovered ${out.length} candidate folder(s) under ${root}`
+  );
+  return out;
+}
+function assertSafeFolderName(name) {
+  if (!name || name.includes("\\")) {
+    throw new ValidationError("Invalid folder name");
+  }
+  const segments = name.split("/").filter(Boolean);
+  if (segments.length === 0) {
+    throw new ValidationError("Invalid folder name");
+  }
+  if (RESERVED.has(segments[0])) {
+    throw new ValidationError("Folder is not eligible for sync");
+  }
+  for (const seg of segments) {
+    if (seg === ".." || seg.startsWith(".") || seg === "node_modules") {
+      throw new ValidationError("Folder is not eligible for sync");
+    }
+  }
+}
+function collectMarkdownFiles(dir, root) {
+  const out = [];
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...collectMarkdownFiles(full, root));
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        const rel = relative(root, full);
+        out.push({ path: rel, content: readFileSync(full, "utf-8") });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+async function syncUnsyncedFolder(userId, folderName, callerEmail) {
+  console.log(
+    `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
+  );
+  assertSafeFolderName(folderName);
+  const src = join2(config.DATA_ROOT, folderName);
+  let stat;
+  try {
+    stat = statSync(src);
+  } catch {
+    console.warn(`[unsynced] source missing: ${src}`);
+    throw new NotFoundError(`Folder not found: ${folderName}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new ValidationError(`Not a directory: ${folderName}`);
+  }
+  const files = collectMarkdownFiles(src, src);
+  console.log(
+    `[unsynced] collected ${files.length} markdown file(s) from ${src}`
+  );
+  if (files.length === 0) {
+    throw new ValidationError(`Folder has no markdown to sync: ${folderName}`);
+  }
+  const segments = folderName.split("/").filter(Boolean);
+  const baseName = segments[segments.length - 1] || folderName;
+  const nestName = uniqueNestName(userId, baseName);
+  if (nestName !== baseName) {
+    console.log(
+      `[unsynced] name "${baseName}" already in use, using "${nestName}" instead`
+    );
+  }
+  const nest = await importNest(userId, nestName, files);
+  console.log(
+    `[unsynced] nest created id=${nest.id} name="${nest.name}" from folder="${folderName}"`
+  );
+  const documents = await registerImportedDocuments(nest.id, callerEmail);
+  console.log(
+    `[unsynced] registered ${documents} document(s) for nest ${nest.id}`
+  );
+  try {
+    rmSync(src, { recursive: true, force: true });
+    console.log(`[unsynced] removed source folder ${src}`);
+  } catch (err) {
+    console.error("[unsynced] failed to remove source folder", src, err);
+  }
+  return { nest, documents };
+}
+
 // src/nests/routes.ts
 function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
@@ -1511,6 +1700,29 @@ nestRoutes.post("/import", async (c) => {
   );
   return c.json({ nest, documents }, 201);
 });
+nestRoutes.get("/unsynced", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can list unsynced folders");
+  }
+  return c.json({ folders: listUnsyncedFolders() });
+});
+nestRoutes.post("/unsynced/sync", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can sync folders");
+  }
+  const body = await c.req.json();
+  if (!body?.name) {
+    throw new ValidationError("name is required");
+  }
+  const result = await syncUnsyncedFolder(
+    userId,
+    body.name,
+    resolveCallerEmail(userId)
+  );
+  return c.json(result, 201);
+});
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1527,6 +1739,25 @@ nestRoutes.get("/:nestId", async (c) => {
   const nest = getNest(nestId);
   return c.json({ nest, permission, roles, myStewards });
 });
+nestRoutes.patch("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const permission = effectivePermission(nestId, userId);
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  if (permission !== "owner" && permission !== "admin") {
+    throw new ForbiddenError(
+      "Only the nest owner or an admin can rename a nest."
+    );
+  }
+  const body = await c.req.json();
+  const nest = renameNest(nestId, {
+    name: body.name,
+    description: body.description
+  });
+  return c.json({ nest });
+});
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1602,7 +1833,8 @@ async function addCollaborator(params) {
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
-    const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(params.email);
+    const email = normalizeEmail(params.email);
+    const existing = db.prepare("SELECT id FROM users WHERE LOWER(email) = ?").get(email);
     if (existing) {
       userId = existing.id;
     } else {
@@ -1610,7 +1842,7 @@ async function addCollaborator(params) {
       userId = uuid2();
       db.prepare(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, params.email, null, await hashPassword2(uuid2()));
+      ).run(userId, email, null, await hashPassword2(uuid2()));
     }
   }
   if (!userId) {
@@ -1781,7 +2013,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VOD5HY3I.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZUSHJCNR.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1802,7 +2034,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-624QTR5K.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1833,7 +2065,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GYX3AW6E.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-QU7Q7XX2.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -2798,6 +3030,26 @@ var TOOL_DEFINITIONS = [
       },
       required: ["email"]
     }
+  },
+  // ─── Unsynced Folder Tools ─────────────────────────────────────────
+  {
+    name: "context_unsynced_list",
+    description: "List folders under the data root that are sync candidates \u2014 dropped in by the starter CLI or copied in manually, not yet converted into a nest. Server-admin only in non-open mode.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_sync_folder",
+    description: "Convert a sibling folder under the data root into a real nest. Imports its markdown, seeds governance, and removes the source folder. Use context_unsynced_list to discover folder names. Server-admin only in non-open mode.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Folder path relative to the data root (e.g. 'nodes/architecture'), as returned by context_unsynced_list."
+        }
+      },
+      required: ["name"]
+    }
   }
 ];
 async function resolveLlmBody(ctx, node) {
@@ -2812,7 +3064,7 @@ async function resolveLlmBody(ctx, node) {
   }
 }
 async function handleToolCall(toolName, args, ctx) {
-  const { storage, queryEngine, versionManager, nestId, userEmail } = ctx;
+  const { storage, queryEngine, versionManager, nestId, userId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
       const content = await storage.readContextMd();
@@ -3174,6 +3426,34 @@ ${list}`;
         return `Failed to share nest: ${err.message}`;
       }
     }
+    case "context_unsynced_list": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to list unsynced folders. Server admin only.";
+      }
+      const folders = listUnsyncedFolders();
+      if (!folders.length) return "No unsynced folders found.";
+      const list = folders.map(
+        (f, i) => `${i + 1}. **${f.label}** \`${f.name}\` \u2014 ${f.mdCount} md file(s), ${f.sizeBytes} bytes`
+      ).join("\n");
+      return `# Unsynced Folders (${folders.length})
+
+${list}`;
+    }
+    case "context_sync_folder": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to sync folders. Server admin only.";
+      }
+      try {
+        const { nest, documents } = await syncUnsyncedFolder(
+          userId,
+          args.name,
+          userEmail
+        );
+        return `Synced folder "${args.name}" \u2192 nest **${nest.name}** (${nest.id}) with ${documents} document(s).`;
+      } catch (err) {
+        return `Failed to sync folder: ${err.message}`;
+      }
+    }
     default:
       return `Unknown tool: ${toolName}`;
   }
@@ -3187,7 +3467,7 @@ function getUserEmail2(userId) {
   const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
   return user?.email || "anonymous@localhost";
 }
-function createMcpServerForNest(nestId, userEmail) {
+function createMcpServerForNest(nestId, userId, userEmail) {
   const server = new McpServer(
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
@@ -3212,6 +3492,7 @@ function createMcpServerForNest(nestId, userEmail) {
         queryEngine: engine.query,
         versionManager: engine.versions,
         nestId,
+        userId,
         userEmail
       });
       return { content: [{ type: "text", text }] };
@@ -3223,7 +3504,7 @@ mcpRoutes.all("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
   const userEmail = getUserEmail2(userId);
-  const server = createMcpServerForNest(nestId, userEmail);
+  const server = createMcpServerForNest(nestId, userId, userEmail);
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
     enableJsonResponse: true
@@ -3242,8 +3523,8 @@ mcpRoutes.all("/", async (c) => {
 import { Hono as Hono7 } from "hono";
 
 // src/governance/stewards-parser.ts
-import { readFileSync, existsSync } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { join as join3 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -3308,15 +3589,15 @@ function parseEntry(str) {
 }
 function loadStewardsConfig(nestId) {
   const dataRoot = config.DATA_ROOT;
-  const nestPath = join2(dataRoot, "nests", nestId);
+  const nestPath = join3(dataRoot, "nests", nestId);
   const candidates = [
-    join2(nestPath, "stewards.yaml"),
-    join2(nestPath, "stewards.yml"),
-    join2(nestPath, ".context", "stewards.yaml")
+    join3(nestPath, "stewards.yaml"),
+    join3(nestPath, "stewards.yml"),
+    join3(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
-      const content = readFileSync(candidatePath, "utf-8");
+      const content = readFileSync2(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -3707,15 +3988,15 @@ function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join3, relative } from "path";
+import { dirname, join as join4, relative as relative2 } from "path";
 import { existsSync as existsSync2 } from "fs";
 var HERE = dirname(fileURLToPath(import.meta.url));
 var UI_DIR_CANDIDATES = [
-  join3(HERE, "web3"),
-  join3(process.cwd(), "dist", "web3")
+  join4(HERE, "web3"),
+  join4(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
-var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
+var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
   c.set("userId", anonId);
@@ -3847,7 +4128,14 @@ function createApp() {
         valid: true,
         tier: info.tier,
         org: info.org,
-        limits: info.limits
+        limits: info.limits,
+        // The key validated and is live now, but if it couldn't be written to
+        // disk it'll be lost on restart — surface that instead of pretending
+        // the setup is durable (the old behavior silently swallowed this).
+        persisted: info.persisted,
+        ...info.persisted ? {} : {
+          warning: `License validated, but it could not be saved to disk (${info.persistError || "unknown error"}). It will be LOST on the next restart. Set ENV_FILE_PATH to a writable, persisted path (e.g. under DATA_ROOT) or provide PROMPTOWL_KEY via the container environment.`
+        }
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to install key";
@@ -3882,6 +4170,7 @@ function createApp() {
     const localPath = c.req.path.replace(/^\/nests\//, "");
     const parts = localPath.split("/").filter(Boolean);
     if (parts.length < 2) return next();
+    if (parts[0] === "unsynced") return next();
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
@@ -4065,7 +4354,7 @@ function createApp() {
 
 // src/db/backfill.ts
 import { NestStorage } from "@promptowl/contextnest-engine";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
   const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
@@ -4086,7 +4375,7 @@ async function backfillNodeVersionsFromHistory(db) {
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath = join4(config.DATA_ROOT, "nests", nestId);
+    const nestPath = join5(config.DATA_ROOT, "nests", nestId);
     const storage = new NestStorage(nestPath);
     let docs;
     try {

package/dist/{review-service-GYX3AW6E.js → review-service-QU7Q7XX2.js}

@@ -6,12 +6,12 @@ import {
   getReviewQueue,
   reject,
   submitForReview
-} from "./chunk-E7E3JMQR.js";
-import "./chunk-LO54V4AU.js";
+} from "./chunk-EDJRDWPL.js";
+import "./chunk-6AXBB65N.js";
 import {
   canUserApprove
-} from "./chunk-5MT4ZBVF.js";
-import "./chunk-G62P54ET.js";
+} from "./chunk-SO74PQWI.js";
+import "./chunk-UEHFNBNR.js";
 export {
   approve,
   canUserApprove,

package/dist/{stewardship-service-VOD5HY3I.js → stewardship-service-ZUSHJCNR.js}

@@ -20,8 +20,8 @@ import {
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-5MT4ZBVF.js";
-import "./chunk-G62P54ET.js";
+} from "./chunk-SO74PQWI.js";
+import "./chunk-UEHFNBNR.js";
 export {
   assignSteward,
   canCreateInNest,

package/dist/{version-service-OCZUV2QP.js → version-service-624QTR5K.js}

@@ -11,8 +11,8 @@ import {
   hashContent,
   setApprovedVersion,
   systemAuthor
-} from "./chunk-LO54V4AU.js";
-import "./chunk-G62P54ET.js";
+} from "./chunk-6AXBB65N.js";
+import "./chunk-UEHFNBNR.js";
 export {
   SYSTEM_AUTHOR_PREFIX,
   checkConflict,