@promptowl/contextnest-community 1.2.0 → 1.4.0

package/CONFIGURATION.md

@@ -50,7 +50,9 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
-| `ENV_FILE_PATH` | `$cwd/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars). Override when your `.env` lives outside the working directory. |
+| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another. Only relevant when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. |
+| `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars), and which the server also reads at boot. Defaults **under `DATA_ROOT`** so the browser License Setup Page persists durably in containers — `$cwd` is `/app` in the official image (root-owned, discarded on container recreate), which silently lost the key. Override only if your writable, persisted `.env` lives elsewhere. In containers, providing `PROMPTOWL_KEY` directly via the environment also works and is read at boot. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
@@ -100,7 +102,7 @@ allowed_users:
   - "*.acme.com"                # email wildcard — anyone @acme.com
   - "partner@vendor.com"         # exact match
 super_admins:
-  - "ceo@acme.com"               # always allowed on every nest
+  - "ceo@acme.com"               # admin on every nest: visibility, collaborators, stewards (not owner-only delete/transfer)
 groups:
   engineering:
     default_permission: write

package/README.md

@@ -110,6 +110,22 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
+## What's new in 1.3.0
+
+- **Server super-admins** — emails listed in `access.yaml: super_admins` administer every nest (change visibility, manage collaborators and stewards) without being added per-nest. Owner-only operations (delete, transfer) still require the nest owner. See [STEWARDSHIP.md](./STEWARDSHIP.md).
+- **License persistence under `DATA_ROOT`** — `PROMPTOWL_KEY` now writes to `$DATA_ROOT/.env` (was `$cwd/.env`, which is root-owned `/app` in the official Docker image and silently lost the key on container recreate). The License Setup Page also surfaces write failures instead of failing quietly. Override via `ENV_FILE_PATH`. See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Case-insensitive email** across registration, login, invite, and access checks. Migration dedupes existing accounts that differ only in case; fixes "I can't log in because I capitalized my email" and access-guard / lockout mismatches.
+- **Document version history + inline diff** — every saved version is browsable in the document detail view, and an inline diff highlights what changed between any two versions.
+- **Nest Overview / index landing** — every nest opens on a grouped table-of-contents with a "recently edited" strip instead of a flat list.
+- **Public/private toggle on the nest header** — visibility is set directly from the header, not buried in a dialog.
+- **Review queue surfaces submitted-for-review edits** — reviewers see the pending versions a contributor staged, not just net-new documents.
+- **Internal-folder sync over MCP** — agents can list a nest's unsynced filesystem folders and pull them into the nest on demand. New `unsynced-service.ts` + MCP tools, covered by `test/unsynced-folder.test.ts` and `test/mcp-unsynced.test.ts`.
+- **Telemetry `batch_id` + user email** — usage events carry a stable `batch_id` (de-duped on the receiver) and the authenticated user email alongside the user id, so the PromptOwl ingest bridge can meter credits to the right account.
+- **Hyperlink navigation fix** — hyperlinks in the editor and viewer navigate to their configured target URL correctly.
+- **Repo / DX** — `CLAUDE.md` at the repo root with project-specific guidance for Claude Code; `claude.yml` (PR assistant) and `claude-code-review.yml` (auto review on PRs) GitHub Actions workflows.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
 ## What's new in 1.2.0
 
 - **Admin user management (no email server needed)** — `POST /auth/admin/reset-password/:userId` sets a user's password or returns a one-time temp password; `DELETE /auth/users/:userId` removes a user and revokes their API keys, sessions, and role rows. New self-service **Change password** in the user menu blocks reusing the current password.

package/dist/{chunk-LO54V4AU.js → chunk-HIH7I232.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-G62P54ET.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-G62P54ET.js → chunk-RMU3LOPH.js}

@@ -14,9 +14,15 @@ var isTestRun = !!process.env.VITEST;
 if (envFileLoaded && !isTestRun) {
   dotenv.config({ path: envFileLoaded, override: true });
 }
+var canonicalEnvFile = process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
+var canonicalEnvLoaded = null;
+if (!isTestRun && canonicalEnvFile !== envFileLoaded && existsSync(canonicalEnvFile)) {
+  dotenv.config({ path: canonicalEnvFile, override: true });
+  canonicalEnvLoaded = canonicalEnvFile;
+}
 if (!isTestRun) {
   console.log(
-    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}`
+    `[config] dotenv: ${envFileLoaded ? `loaded ${envFileLoaded}` : "no .env file found"}` + (canonicalEnvLoaded ? ` + ${canonicalEnvLoaded}` : "")
   );
 }
 function dataRoot() {
@@ -38,6 +44,32 @@ var config = {
   get PROMPTOWL_KEY() {
     return process.env.PROMPTOWL_KEY || "";
   },
+  /**
+   * Shared secret for one-click SSO auto-login from PromptOwl (PO).
+   *
+   * THIS IS THE DOMAIN LOCK. Only the ONE official community deployment is
+   * given this secret (it matches OFFICIAL_COMMUNITY_SSO_SECRET on PO). PO
+   * signs a short-lived JWT ticket with it; this server verifies the ticket
+   * with the same secret at GET /auth/sso.
+   *
+   * Self-hosted deployments leave this UNSET — GET /auth/sso then returns 404,
+   * so the auto-login feature is disabled for every domain except ours. Those
+   * users keep using the manual device-code flow (/auth/promptowl).
+   */
+  get OFFICIAL_COMMUNITY_SSO_SECRET() {
+    return process.env.OFFICIAL_COMMUNITY_SSO_SECRET || "";
+  },
+  /**
+   * This server's own canonical, externally-reachable base URL (e.g.
+   * "https://community.promptowl.ai"). Used to validate the `aud` claim on
+   * incoming SSO tickets — a ticket minted for a different audience is
+   * rejected, so a ticket can't be replayed against another server. Compared
+   * with the trailing slash stripped. When unset, the `aud` check is skipped
+   * (the shared-secret check is still the primary gate).
+   */
+  get PUBLIC_BASE_URL() {
+    return (process.env.PUBLIC_BASE_URL || "").replace(/\/$/, "");
+  },
   /**
    * Restrict "Sign in with PromptOwl":
    *   "open"       — anyone may sign in with PromptOwl (default)
@@ -53,12 +85,15 @@ var config = {
     return v === "admin-only" || v === "disabled" ? v : "open";
   },
   /**
-   * Path to the .env file the server reads its config from. Used by
-   * the license install flow to persist PROMPTOWL_KEY alongside any
-   * existing env vars, instead of a separate sidecar file.
+   * Path to the .env file the server reads its config from and the license
+   * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
+   * $cwd) so it lands on the writable, volume-mounted, restart-surviving path
+   * in containers — $cwd is /app in the official image: root-owned and
+   * discarded on container recreate, which silently lost the key. The boot
+   * dotenv loader reads this same path (see top of file).
    */
   get ENV_FILE_PATH() {
-    return process.env.ENV_FILE_PATH || join(process.cwd(), ".env");
+    return process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
   },
   get TELEMETRY_ENABLED() {
     return process.env.TELEMETRY_ENABLED !== "false";
@@ -167,6 +202,35 @@ function runMigrations(db2) {
     CREATE INDEX IF NOT EXISTS idx_nest_collab_nest ON nest_collaborators(nest_id);
     CREATE INDEX IF NOT EXISTS idx_nest_collab_user ON nest_collaborators(user_id);
 
+    -- Annotation threads on hosted artifacts. Deliberately kept OUT of the
+    -- versioned/hash-chained node layer: annotations are high-churn human
+    -- feedback, not canonical node content. They reference the node + the
+    -- snapshot (node version) they were anchored against.
+    CREATE TABLE IF NOT EXISTS annotation_threads (
+      id TEXT PRIMARY KEY,
+      nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+      node_id TEXT NOT NULL,
+      snapshot_version INTEGER,
+      anchor_json TEXT,                 -- JSON {line?,quote,before,after}; NULL = whole-artifact
+      status TEXT NOT NULL DEFAULT 'open'
+        CHECK(status IN ('open', 'resolved')),
+      created_by TEXT NOT NULL,         -- email
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      resolved_by TEXT,
+      resolved_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS annotation_comments (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL REFERENCES annotation_threads(id) ON DELETE CASCADE,
+      author TEXT NOT NULL,             -- email
+      body TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_annot_threads_node
+      ON annotation_threads(nest_id, node_id);
+    CREATE INDEX IF NOT EXISTS idx_annot_comments_thread
+      ON annotation_comments(thread_id);
+
     -- License validation cache
     CREATE TABLE IF NOT EXISTS license_cache (
       key TEXT PRIMARY KEY,
@@ -559,6 +623,85 @@ function runMigrations(db2) {
       recordMigration("008_drop_steward_folder_scope");
     })();
   }
+  if (!hasMigration("009_lowercase_emails")) {
+    db2.transaction(() => {
+      const collisions = db2.prepare(
+        `SELECT GROUP_CONCAT(email, ', ') AS emails
+             FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1`
+      ).all();
+      for (const c of collisions) {
+        console.warn(
+          `[migration 009] case-collision user rows NOT auto-merged: ${c.emails} \u2014 reconcile manually (pick the row the person logs into; reset its password; ensure collaborator/steward grants point at that user_id).`
+        );
+      }
+      db2.exec(
+        `UPDATE users SET email = LOWER(email)
+           WHERE email <> LOWER(email)
+             AND LOWER(email) NOT IN (
+               SELECT LOWER(email) FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1
+             )`
+      );
+      const remaining = db2.prepare(
+        `SELECT COUNT(*) AS c FROM (
+               SELECT 1 FROM users GROUP BY LOWER(email) HAVING COUNT(*) > 1
+             )`
+      ).get().c;
+      if (remaining === 0) {
+        db2.exec(
+          "CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email_nocase ON users(email COLLATE NOCASE)"
+        );
+      } else {
+        console.warn(
+          `[migration 009] ${remaining} case-collision group(s) remain \u2014 skipping the NOCASE unique index until reconciled.`
+        );
+      }
+    })();
+    recordMigration("009_lowercase_emails");
+  }
+  if (!hasMigration("010_sso_used_jti")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE IF NOT EXISTS sso_used_jti (
+          jti TEXT PRIMARY KEY,
+          used_at TEXT NOT NULL DEFAULT (datetime('now')),
+          expires_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_sso_used_jti_expires
+          ON sso_used_jti(expires_at);
+      `);
+    })();
+    recordMigration("010_sso_used_jti");
+  }
+  if (!hasMigration("011_comments")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE IF NOT EXISTS comments (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          version INTEGER,                 -- optional: comment pinned to a version
+          anchor_start INTEGER,            -- optional: highlight span start (char offset)
+          anchor_end INTEGER,              -- optional: highlight span end
+          anchor_text TEXT,                -- optional: quoted highlighted text
+          parent_id TEXT REFERENCES comments(id) ON DELETE CASCADE,  -- threading
+          author TEXT NOT NULL,            -- email
+          body TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'open'
+            CHECK(status IN ('open', 'resolved')),
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          resolved_by TEXT,                -- email
+          resolved_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_comments_node
+          ON comments(nest_id, node_id, created_at);
+        CREATE INDEX IF NOT EXISTS idx_comments_open
+          ON comments(nest_id, node_id, status);
+        CREATE INDEX IF NOT EXISTS idx_comments_thread
+          ON comments(parent_id);
+      `);
+    })();
+    recordMigration("011_comments");
+  }
 }
 
 // src/db/client.ts

package/dist/{chunk-E7E3JMQR.js → chunk-TTXTEUFT.js}

@@ -1,16 +1,16 @@
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-LO54V4AU.js";
+} from "./chunk-HIH7I232.js";
 import {
   buildTitleMap,
   canUserApprove,
   engineCache,
   resolveStewardsForNode
-} from "./chunk-5MT4ZBVF.js";
+} from "./chunk-XNPD2Q6E.js";
 import {
   getDb
-} from "./chunk-G62P54ET.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-5MT4ZBVF.js → chunk-XNPD2Q6E.js}

@@ -2,7 +2,7 @@ import {
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-G62P54ET.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -26,9 +26,6 @@ function loadAccessConfig() {
   accessConfig = null;
   return null;
 }
-function getAccessConfig() {
-  return accessConfig;
-}
 function isSuperAdmin(email) {
   if (!accessConfig?.super_admins) return false;
   return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
@@ -192,6 +189,11 @@ function discardImportDir(dest) {
 }
 
 // src/telemetry/tracker.ts
+import { createHash } from "crypto";
+function computeBatchId(ids) {
+  const key = ids.slice().sort((a, b) => a - b).join(",");
+  return createHash("sha256").update(key).digest("hex").slice(0, 32);
+}
 function trackEvent(event, data) {
   if (!config.TELEMETRY_ENABLED) return;
   try {
@@ -210,31 +212,61 @@ async function flushTelemetry() {
   const events = db.prepare(
     "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
   ).all();
-  if (events.length === 0 && userCount === 0) return;
+  if (events.length === 0 && userCount === 0) {
+    console.log("[telemetry] skip flush: no events and no users");
+    return;
+  }
+  const emailStmt = db.prepare("SELECT email FROM users WHERE id = ?");
+  const emailCache = /* @__PURE__ */ new Map();
+  const resolveEmail = (userId) => {
+    if (typeof userId !== "string" || !userId) return null;
+    if (emailCache.has(userId)) return emailCache.get(userId) ?? null;
+    const row = emailStmt.get(userId);
+    const email = row?.email ?? null;
+    emailCache.set(userId, email);
+    return email;
+  };
+  const batchId = events.length > 0 ? computeBatchId(events.map((e) => e.id)) : null;
   const payload = {
     server_key: config.PROMPTOWL_KEY,
+    batch_id: batchId,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     stats: { users: userCount, nests: nestCount },
-    events: events.map((e) => ({
-      event: e.event,
-      data: e.data_json ? JSON.parse(e.data_json) : null,
-      at: e.created_at
-    }))
+    events: events.map((e) => {
+      const data = e.data_json ? JSON.parse(e.data_json) : null;
+      if (data && data.userId && !data.userEmail) {
+        const email = resolveEmail(data.userId);
+        if (email) data.userEmail = email;
+      }
+      return {
+        event: e.event,
+        data,
+        at: e.created_at
+      };
+    })
   };
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  const url = `${promptowlUrl}/api/telemetry/ingest`;
+  console.log(
+    `[telemetry] POST ${url} events=${events.length} users=${userCount} nests=${nestCount}`
+  );
+  console.log("[telemetry] payload:", JSON.stringify(payload, null, 2));
   try {
-    const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-    const res = await fetch(`${promptowlUrl}/api/telemetry/ingest`, {
+    const res = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload)
     });
+    console.log(`[telemetry] response: ${res.status} ${res.statusText}`);
     if (res.ok && events.length > 0) {
       const ids = events.map((e) => e.id);
       db.prepare(
         `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
       ).run(...ids);
+      console.log(`[telemetry] marked ${ids.length} events as sent`);
     }
-  } catch {
+  } catch (err) {
+    console.error("[telemetry] flush failed:", err);
   }
 }
 var telemetryTimer = null;
@@ -295,14 +327,18 @@ async function installLicenseKey(key) {
     if (previousKey) {
       await validateLicense({ forceFresh: true });
     }
-    return info;
+    return { ...info, persisted: false };
   }
   try {
     upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+    return { ...info, persisted: true };
   } catch (err) {
-    console.warn("[license] failed to write .env:", err);
+    const persistError = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `[license] validated but FAILED to persist to ${config.ENV_FILE_PATH}: ${persistError}`
+    );
+    return { ...info, persisted: false, persistError };
   }
-  return info;
 }
 var safetyPollHandle = null;
 var SAFETY_POLL_INTERVAL_MS = 60 * 1e3;
@@ -548,6 +584,22 @@ function isImportedNest(nestId) {
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
+function uniqueNestName(userId, baseName) {
+  const db = getDb();
+  const slugTaken = db.prepare(
+    "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1"
+  );
+  let candidate = baseName;
+  let n = 0;
+  while (n < 1e3) {
+    const slug = toSlug(candidate);
+    const hit = slugTaken.get(userId, slug);
+    if (!hit) return candidate;
+    n++;
+    candidate = `${baseName} (${n})`;
+  }
+  return candidate;
+}
 function isStewardshipEnabled(nestId) {
   const db = getDb();
   const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
@@ -584,6 +636,43 @@ function disableStewardshipAndWipeGovernance(nestId) {
   });
   return wipe(nestId);
 }
+function renameNest(nestId, patch) {
+  const db = getDb();
+  const existing = db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+  if (!existing) {
+    throw new ValidationError("Nest not found");
+  }
+  const updates = [];
+  const params = [];
+  if (patch.name !== void 0) {
+    const trimmed = patch.name.trim();
+    if (!trimmed) throw new ValidationError("Name cannot be empty");
+    const slug = toSlug(trimmed);
+    if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
+    const conflict = db.prepare(
+      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1"
+    ).get(existing.user_id, slug, nestId);
+    if (conflict) {
+      throw new ValidationError(
+        `Another nest already uses this name. Pick a different one.`
+      );
+    }
+    updates.push("name = ?", "slug = ?");
+    params.push(trimmed, slug);
+  }
+  if (patch.description !== void 0) {
+    updates.push("description = ?");
+    params.push(patch.description || null);
+  }
+  if (updates.length === 0) {
+    return existing;
+  }
+  params.push(nestId);
+  db.prepare(`UPDATE nests SET ${updates.join(", ")} WHERE id = ?`).run(
+    ...params
+  );
+  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+}
 async function createNest(userId, name, description) {
   const id = uuid();
   const slug = toSlug(name);
@@ -641,6 +730,13 @@ function listNests(userId) {
 }
 function listSharedNests(userId) {
   const db = getDb();
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const isServerAdmin = isLicenseAdminUserId(userId) || (caller?.email ? isSuperAdmin(caller.email) : false);
+  if (isServerAdmin) {
+    return db.prepare(
+      "SELECT * FROM nests WHERE user_id != ? ORDER BY created_at DESC"
+    ).all(userId);
+  }
   return db.prepare(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
@@ -789,6 +885,11 @@ function resolveNestPermission(nestId, userId) {
   if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
     return "owner";
   }
+  if (isLicenseAdminUserId(userId)) return "admin";
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (caller?.email && isSuperAdmin(caller.email)) {
+    return "admin";
+  }
   const directGrant = db.prepare(
     "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
@@ -817,6 +918,9 @@ function isPublicReader(nestId, userId) {
     "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
   ).get(nestId, userId);
   if (directGrant) return false;
+  if (isLicenseAdminUserId(userId)) return false;
+  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (caller?.email && isSuperAdmin(caller.email)) return false;
   const stewardGrant = db.prepare(
     `SELECT 1 FROM stewards s
          JOIN users u ON u.id = ?
@@ -1153,7 +1257,7 @@ function getCollaboratorRole(nestId, userEmail) {
 }
 function resolveUserRoles(nestId, userEmail, opts) {
   const roles = /* @__PURE__ */ new Set();
-  if (isSuperAdmin2(userEmail)) roles.add("admin");
+  if (isSuperAdmin(userEmail)) roles.add("admin");
   const owner = getNestOwnerEmail(nestId);
   if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
     roles.add("owner");
@@ -1169,16 +1273,12 @@ function resolveUserRoles(nestId, userEmail, opts) {
   for (const role of stewardRoles) roles.add(role);
   return [...roles];
 }
-function isSuperAdmin2(userEmail) {
-  const cfg = getAccessConfig();
-  return !!cfg?.super_admins?.includes(userEmail);
-}
 function canManageStewards(userEmail) {
   if (config.AUTH_MODE === "open") return true;
-  return isLicenseAdminEmail(userEmail) || isSuperAdmin2(userEmail);
+  return isLicenseAdminEmail(userEmail) || isSuperAdmin(userEmail);
 }
 function canCreateInNest(nestId, userEmail) {
-  if (config.AUTH_MODE === "open" || isSuperAdmin2(userEmail)) return true;
+  if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
   const userId = userIdForEmail(userEmail);
   if (userId) {
     const perm = resolveNestPermission(nestId, userId);
@@ -1202,7 +1302,7 @@ function canUserEdit(nestId, nodeId, userEmail) {
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
-  if (isSuperAdmin2(userEmail)) {
+  if (isSuperAdmin(userEmail)) {
     return { allowed: true, reason: "super admin", role: "super_admin" };
   }
   if (canEditWith(roles)) {
@@ -1235,7 +1335,7 @@ function getPendingReviewRequester(nestId, nodeId) {
 function canUserApprove(nestId, nodeId, userEmail) {
   const roles = resolveUserRoles(nestId, userEmail, { nodeId });
   const isOwner = roles.includes("owner");
-  const isSuper = isSuperAdmin2(userEmail);
+  const isSuper = isSuperAdmin(userEmail);
   const allowSelf = nestAllowsSelfApprove(nestId);
   const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
   const actor = getPendingReviewRequester(nestId, nodeId) ?? getCurrentVersionAuthor(nestId, nodeId);
@@ -1280,7 +1380,7 @@ function canUserAccess(nestId, nodeId, userEmail) {
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
-  if (isSuperAdmin2(userEmail)) {
+  if (isSuperAdmin(userEmail)) {
     return { allowed: true, reason: "super admin", role: "super_admin" };
   }
   if (canViewWith(roles)) {
@@ -1369,14 +1469,18 @@ export {
   isSuspended,
   getSuspensionReason,
   validateLicense,
+  loadAccessConfig,
+  isSuperAdmin,
   resolveNestPermission,
   permissionLevel,
   isPublicReader,
+  uniqueNestName,
   isStewardshipEnabled,
   setStewardshipEnabled,
   nestAllowsSelfApprove,
   setAllowSelfApprove,
   disableStewardshipAndWipeGovernance,
+  renameNest,
   createNest,
   importNest,
   listNests,
@@ -1385,8 +1489,6 @@ export {
   getNest,
   deleteNest,
   engineCache,
-  loadAccessConfig,
-  isSuperAdmin,
   buildTitleMap,
   canManageWith,
   assignSteward,