@promptowl/contextnest-community 1.4.0 → 1.6.0

package/dist/{chunk-XNPD2Q6E.js → chunk-2TUMMVBG.js}

@@ -1,8 +1,12 @@
 import {
-  ANON_USER_ID,
   config,
-  getDb
-} from "./chunk-RMU3LOPH.js";
+  getDb,
+  insertOrReplace,
+  nowExpr
+} from "./chunk-7V33Z6CS.js";
+import {
+  ANON_USER_ID
+} from "./chunk-SLTQACJW.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -148,7 +152,6 @@ import {
 } from "@promptowl/contextnest-engine";
 
 // src/nests/service.ts
-import { join as join3 } from "path";
 import { rmSync as rmSync2, mkdirSync as mkdirSync2 } from "fs";
 import { v4 as uuid } from "uuid";
 import { NestStorage } from "@promptowl/contextnest-engine";
@@ -188,54 +191,59 @@ function discardImportDir(dest) {
   }
 }
 
+// src/shared/paths.ts
+import { join as join3 } from "path";
+function nestStorageRoot() {
+  return config.NEST_STORAGE_ROOT;
+}
+function resolveNestPath(nestId) {
+  return join3(nestStorageRoot(), nestId);
+}
+
 // src/telemetry/tracker.ts
 import { createHash } from "crypto";
 function computeBatchId(ids) {
   const key = ids.slice().sort((a, b) => a - b).join(",");
   return createHash("sha256").update(key).digest("hex").slice(0, 32);
 }
-function trackEvent(event, data) {
+async function trackEvent(event, data) {
   if (!config.TELEMETRY_ENABLED) return;
   try {
     const db = getDb();
-    db.prepare(
-      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)"
-    ).run(event, data ? JSON.stringify(data) : null);
+    await db.run(
+      "INSERT INTO telemetry_events (event, data_json) VALUES (?, ?)",
+      [event, data ? JSON.stringify(data) : null]
+    );
   } catch {
   }
 }
 async function flushTelemetry() {
   if (!config.TELEMETRY_ENABLED || !config.PROMPTOWL_KEY) return;
   const db = getDb();
-  const userCount = db.prepare("SELECT COUNT(*) as c FROM users").get()?.c || 0;
-  const nestCount = db.prepare("SELECT COUNT(*) as c FROM nests").get()?.c || 0;
-  const events = db.prepare(
+  const userCount = (await db.get("SELECT COUNT(*) as c FROM users"))?.c || 0;
+  const nestCount = (await db.get("SELECT COUNT(*) as c FROM nests"))?.c || 0;
+  const events = await db.all(
     "SELECT id, event, data_json, created_at FROM telemetry_events WHERE sent = 0 ORDER BY id LIMIT 100"
-  ).all();
+  );
   if (events.length === 0 && userCount === 0) {
     console.log("[telemetry] skip flush: no events and no users");
     return;
   }
-  const emailStmt = db.prepare("SELECT email FROM users WHERE id = ?");
   const emailCache = /* @__PURE__ */ new Map();
-  const resolveEmail = (userId) => {
+  const resolveEmail = async (userId) => {
     if (typeof userId !== "string" || !userId) return null;
     if (emailCache.has(userId)) return emailCache.get(userId) ?? null;
-    const row = emailStmt.get(userId);
+    const row = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
     const email = row?.email ?? null;
     emailCache.set(userId, email);
     return email;
   };
   const batchId = events.length > 0 ? computeBatchId(events.map((e) => e.id)) : null;
-  const payload = {
-    server_key: config.PROMPTOWL_KEY,
-    batch_id: batchId,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    stats: { users: userCount, nests: nestCount },
-    events: events.map((e) => {
+  const eventPayload = await Promise.all(
+    events.map(async (e) => {
       const data = e.data_json ? JSON.parse(e.data_json) : null;
       if (data && data.userId && !data.userEmail) {
-        const email = resolveEmail(data.userId);
+        const email = await resolveEmail(data.userId);
         if (email) data.userEmail = email;
       }
       return {
@@ -244,6 +252,13 @@ async function flushTelemetry() {
         at: e.created_at
       };
     })
+  );
+  const payload = {
+    server_key: config.PROMPTOWL_KEY,
+    batch_id: batchId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    stats: { users: userCount, nests: nestCount },
+    events: eventPayload
   };
   const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
   const url = `${promptowlUrl}/api/telemetry/ingest`;
@@ -260,9 +275,10 @@ async function flushTelemetry() {
     console.log(`[telemetry] response: ${res.status} ${res.statusText}`);
     if (res.ok && events.length > 0) {
       const ids = events.map((e) => e.id);
-      db.prepare(
-        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`
-      ).run(...ids);
+      await db.run(
+        `UPDATE telemetry_events SET sent = 1 WHERE id IN (${ids.map(() => "?").join(",")})`,
+        ids
+      );
       console.log(`[telemetry] marked ${ids.length} events as sent`);
     }
   } catch (err) {
@@ -291,9 +307,12 @@ function isLicenseAdminEmail(email) {
   if (!lic?.valid || !lic.ownerEmail) return false;
   return lic.ownerEmail.toLowerCase() === email.toLowerCase();
 }
-function isLicenseAdminUserId(userId) {
+async function isLicenseAdminUserId(userId) {
   try {
-    const row = getDb().prepare("SELECT email FROM users WHERE id = ?").get(userId);
+    const row = await getDb().get(
+      "SELECT email FROM users WHERE id = ?",
+      [userId]
+    );
     return isLicenseAdminEmail(row?.email);
   } catch {
     return false;
@@ -352,7 +371,7 @@ function startLicenseSafetyPoll() {
       const isValid = !!currentLicense?.valid;
       if (wasValid && !isValid) {
         console.log("[license] safety poll detected revocation");
-        handleLicenseRevoked();
+        await handleLicenseRevoked();
       }
     } catch (err) {
       console.warn(
@@ -364,10 +383,10 @@ function startLicenseSafetyPoll() {
     safetyPollHandle.unref();
   }
 }
-function handleLicenseRevoked() {
+async function handleLicenseRevoked() {
   try {
     const db = getDb();
-    const result = db.prepare("DELETE FROM sessions").run();
+    const result = await db.run("DELETE FROM sessions");
     console.warn(
       `[license] revoked \u2014 wiped ${result.changes} active session(s).`
     );
@@ -423,7 +442,10 @@ async function _validateLicenseImpl(forceFresh) {
     };
   }
   const db = getDb();
-  const cached = db.prepare("SELECT * FROM license_cache WHERE key = ?").get(key);
+  const cached = await db.get(
+    "SELECT * FROM license_cache WHERE key = ?",
+    [key]
+  );
   if (cached && !forceFresh) {
     const age = Date.now() - (/* @__PURE__ */ new Date(cached.validated_at + "Z")).getTime();
     if (age < CACHE_TTL_MS) {
@@ -513,7 +535,7 @@ async function _validateLicenseImpl(forceFresh) {
       suspensionReason = null;
     }
     if (!data.valid && !data.suspended) {
-      db.prepare("DELETE FROM license_cache WHERE key = ?").run(key);
+      await db.run("DELETE FROM license_cache WHERE key = ?", [key]);
       return {
         valid: false,
         tier: "none",
@@ -526,15 +548,21 @@ async function _validateLicenseImpl(forceFresh) {
     }
     if (data.valid) {
       const limitsJson = data.limits ? JSON.stringify(data.limits) : null;
-      db.prepare(
-        `INSERT OR REPLACE INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
-         VALUES (?, ?, ?, ?, ?, datetime('now'))`
-      ).run(
-        key,
-        data.tier || "community",
-        data.org || null,
-        limitsJson,
-        data.owner_email || null
+      await db.run(
+        insertOrReplace(
+          db,
+          `INSERT INTO license_cache (key, tier, org, limits_json, owner_email, validated_at)
+           VALUES (?, ?, ?, ?, ?, ${nowExpr(db)})`,
+          ["key"],
+          `tier = excluded.tier, org = excluded.org, limits_json = excluded.limits_json, owner_email = excluded.owner_email, validated_at = ${nowExpr(db)}`
+        ),
+        [
+          key,
+          data.tier || "community",
+          data.org || null,
+          limitsJson,
+          data.owner_email || null
+        ]
       );
     }
     return {
@@ -574,71 +602,80 @@ async function _validateLicenseImpl(forceFresh) {
 }
 
 // src/nests/service.ts
-function resolveNestPath(nestId) {
-  return join3(config.DATA_ROOT, "nests", nestId);
-}
-function isImportedNest(nestId) {
-  const row = getDb().prepare("SELECT is_imported FROM nests WHERE id = ?").get(nestId);
+async function isImportedNest(nestId) {
+  const row = await getDb().get(
+    "SELECT is_imported FROM nests WHERE id = ?",
+    [nestId]
+  );
   return !!row?.is_imported;
 }
 function toSlug(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
-function uniqueNestName(userId, baseName) {
+async function uniqueNestName(userId, baseName) {
   const db = getDb();
-  const slugTaken = db.prepare(
-    "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1"
-  );
   let candidate = baseName;
   let n = 0;
   while (n < 1e3) {
     const slug = toSlug(candidate);
-    const hit = slugTaken.get(userId, slug);
+    const hit = await db.get(
+      "SELECT 1 FROM nests WHERE user_id = ? AND slug = ? LIMIT 1",
+      [userId, slug]
+    );
     if (!hit) return candidate;
     n++;
     candidate = `${baseName} (${n})`;
   }
   return candidate;
 }
-function isStewardshipEnabled(nestId) {
+async function isStewardshipEnabled(nestId) {
   const db = getDb();
-  const row = db.prepare("SELECT stewardship_enabled FROM nests WHERE id = ?").get(nestId);
+  const row = await db.get(
+    "SELECT stewardship_enabled FROM nests WHERE id = ?",
+    [nestId]
+  );
   return !!row?.stewardship_enabled;
 }
-function setStewardshipEnabled(nestId, enabled) {
+async function setStewardshipEnabled(nestId, enabled) {
   const db = getDb();
-  db.prepare("UPDATE nests SET stewardship_enabled = ? WHERE id = ?").run(
+  await db.run("UPDATE nests SET stewardship_enabled = ? WHERE id = ?", [
     enabled ? 1 : 0,
     nestId
-  );
+  ]);
 }
-function nestAllowsSelfApprove(nestId) {
+async function nestAllowsSelfApprove(nestId) {
   const db = getDb();
-  const row = db.prepare("SELECT allow_self_approve FROM nests WHERE id = ?").get(nestId);
+  const row = await db.get(
+    "SELECT allow_self_approve FROM nests WHERE id = ?",
+    [nestId]
+  );
   return !!row?.allow_self_approve;
 }
-function setAllowSelfApprove(nestId, allow) {
+async function setAllowSelfApprove(nestId, allow) {
   const db = getDb();
-  db.prepare("UPDATE nests SET allow_self_approve = ? WHERE id = ?").run(
+  await db.run("UPDATE nests SET allow_self_approve = ? WHERE id = ?", [
     allow ? 1 : 0,
     nestId
-  );
+  ]);
 }
-function disableStewardshipAndWipeGovernance(nestId) {
+async function disableStewardshipAndWipeGovernance(nestId) {
   const db = getDb();
-  const wipe = db.transaction((id) => {
-    const stewards = db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id).changes;
-    const pendingReviews = db.prepare(
-      "DELETE FROM review_requests WHERE nest_id = ? AND status = 'pending'"
-    ).run(id).changes;
-    db.prepare("UPDATE nests SET stewardship_enabled = 0 WHERE id = ?").run(id);
+  return db.transaction(async (tx) => {
+    const id = nestId;
+    const stewards = (await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id])).changes;
+    const pendingReviews = (await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [id]
+    )).changes;
+    await tx.run("UPDATE nests SET stewardship_enabled = 0 WHERE id = ?", [id]);
     return { stewards, pendingReviews };
   });
-  return wipe(nestId);
 }
-function renameNest(nestId, patch) {
+async function renameNest(nestId, patch) {
   const db = getDb();
-  const existing = db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+  const existing = await db.get("SELECT * FROM nests WHERE id = ?", [
+    nestId
+  ]);
   if (!existing) {
     throw new ValidationError("Nest not found");
   }
@@ -649,9 +686,10 @@ function renameNest(nestId, patch) {
     if (!trimmed) throw new ValidationError("Name cannot be empty");
     const slug = toSlug(trimmed);
     if (!slug) throw new ValidationError("Name must contain at least one alphanumeric character");
-    const conflict = db.prepare(
-      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1"
-    ).get(existing.user_id, slug, nestId);
+    const conflict = await db.get(
+      "SELECT id FROM nests WHERE user_id = ? AND slug = ? AND id != ? LIMIT 1",
+      [existing.user_id, slug, nestId]
+    );
     if (conflict) {
       throw new ValidationError(
         `Another nest already uses this name. Pick a different one.`
@@ -668,25 +706,27 @@ function renameNest(nestId, patch) {
     return existing;
   }
   params.push(nestId);
-  db.prepare(`UPDATE nests SET ${updates.join(", ")} WHERE id = ?`).run(
-    ...params
+  await db.run(
+    `UPDATE nests SET ${updates.join(", ")} WHERE id = ?`,
+    params
   );
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId);
+  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]);
 }
 async function createNest(userId, name, description) {
   const id = uuid();
   const slug = toSlug(name);
   const db = getDb();
   const visibility = userId === ANON_USER_ID ? "public" : "private";
-  db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)"
-  ).run(id, userId, name, slug, description || null, visibility);
+  await db.run(
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility) VALUES (?, ?, ?, ?, ?, ?)",
+    [id, userId, name, slug, description || null, visibility]
+  );
   const path = resolveNestPath(id);
   mkdirSync2(path, { recursive: true });
   const storage = new NestStorage(path);
   await storage.init(name);
   trackEvent("nest.create", { nestId: id, userId });
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
 async function importNest(userId, name, files) {
   const nm = (name || "").trim();
@@ -709,35 +749,46 @@ async function importNest(userId, name, files) {
     discardImportDir(dest);
     throw new ValidationError("Failed to import folder");
   }
-  db.prepare(
-    "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)"
-  ).run(id, userId, nm, slug, null, visibility);
+  await db.run(
+    "INSERT INTO nests (id, user_id, name, slug, description, visibility, is_imported) VALUES (?, ?, ?, ?, ?, ?, 1)",
+    [id, userId, nm, slug, null, visibility]
+  );
   trackEvent("nest.import", { nestId: id, userId });
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(id);
+  return await db.get("SELECT * FROM nests WHERE id = ?", [id]);
 }
-function listNests(userId) {
+async function listNests(userId) {
   const db = getDb();
   if (userId === ANON_USER_ID) {
-    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(ANON_USER_ID);
+    return await db.all(
+      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      [ANON_USER_ID]
+    );
   }
-  const includeAnon = config.AUTH_MODE === "open" || isLicenseAdminUserId(userId);
+  const includeAnon = config.AUTH_MODE === "open" || await isLicenseAdminUserId(userId);
   if (!includeAnon) {
-    return db.prepare("SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC").all(userId);
+    return await db.all(
+      "SELECT * FROM nests WHERE user_id = ? ORDER BY created_at DESC",
+      [userId]
+    );
   }
-  return db.prepare(
-    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC"
-  ).all(userId, ANON_USER_ID);
+  return await db.all(
+    "SELECT * FROM nests WHERE user_id = ? OR user_id = ? ORDER BY created_at DESC",
+    [userId, ANON_USER_ID]
+  );
 }
-function listSharedNests(userId) {
+async function listSharedNests(userId) {
   const db = getDb();
-  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
-  const isServerAdmin = isLicenseAdminUserId(userId) || (caller?.email ? isSuperAdmin(caller.email) : false);
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+    userId
+  ]);
+  const isServerAdmin = await isLicenseAdminUserId(userId) || (caller?.email ? isSuperAdmin(caller.email) : false);
   if (isServerAdmin) {
-    return db.prepare(
-      "SELECT * FROM nests WHERE user_id != ? ORDER BY created_at DESC"
-    ).all(userId);
+    return await db.all(
+      "SELECT * FROM nests WHERE user_id != ? ORDER BY created_at DESC",
+      [userId]
+    );
   }
-  return db.prepare(
+  return await db.all(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
          ON nc.nest_id = n.id AND nc.user_id = ?
@@ -747,12 +798,13 @@ function listSharedNests(userId) {
         AND LOWER(s.user_email) = LOWER(u.email)
        WHERE n.user_id != ?
          AND (nc.user_id IS NOT NULL OR s.id IS NOT NULL)
-       ORDER BY n.created_at DESC`
-  ).all(userId, userId, userId);
+       ORDER BY n.created_at DESC`,
+    [userId, userId, userId]
+  );
 }
-function listPublicNests(userId) {
+async function listPublicNests(userId) {
   const db = getDb();
-  return db.prepare(
+  return await db.all(
     `SELECT n.* FROM nests n
        WHERE n.visibility = 'public'
          AND n.user_id != ?
@@ -760,29 +812,30 @@ function listPublicNests(userId) {
            SELECT 1 FROM nest_collaborators nc
            WHERE nc.nest_id = n.id AND nc.user_id = ?
          )
-       ORDER BY n.created_at DESC`
-  ).all(userId, userId);
+       ORDER BY n.created_at DESC`,
+    [userId, userId]
+  );
 }
-function getNest(nestId) {
+async function getNest(nestId) {
   const db = getDb();
-  return db.prepare("SELECT * FROM nests WHERE id = ?").get(nestId) || null;
+  return await db.get("SELECT * FROM nests WHERE id = ?", [nestId]) || null;
 }
 async function deleteNest(nestId) {
   const db = getDb();
-  const wipe = db.transaction((id) => {
-    db.prepare("DELETE FROM approved_versions WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM node_versions WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM review_requests WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM stewards WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM nest_collaborators WHERE nest_id = ?").run(id);
+  await db.transaction(async (tx) => {
+    const id = nestId;
+    await tx.run("DELETE FROM approved_versions WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM node_versions WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM review_requests WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM stewards WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM nest_collaborators WHERE nest_id = ?", [id]);
     try {
-      db.prepare("DELETE FROM node_tag_index WHERE nest_id = ?").run(id);
+      await tx.run("DELETE FROM node_tag_index WHERE nest_id = ?", [id]);
     } catch {
     }
-    db.prepare("DELETE FROM api_keys WHERE nest_id = ?").run(id);
-    db.prepare("DELETE FROM nests WHERE id = ?").run(id);
+    await tx.run("DELETE FROM api_keys WHERE nest_id = ?", [id]);
+    await tx.run("DELETE FROM nests WHERE id = ?", [id]);
   });
-  wipe(nestId);
   const path = resolveNestPath(nestId);
   try {
     rmSync2(path, { recursive: true, force: true });
@@ -840,11 +893,11 @@ var FlatNestStorage = class extends NestStorage2 {
 // src/nodes/engine.ts
 var NestEngineCache = class {
   cache = /* @__PURE__ */ new Map();
-  get(nestId) {
+  async get(nestId) {
     let engine = this.cache.get(nestId);
     if (!engine) {
       const nestPath = resolveNestPath(nestId);
-      const storage = isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
+      const storage = await isImportedNest(nestId) ? new FlatNestStorage(nestPath) : new NestStorage3(nestPath);
       const query = new GraphQueryEngine(storage);
       const versions = new VersionManager(storage);
       engine = { storage, query, versions };
@@ -861,7 +914,7 @@ var engineCache = new NestEngineCache();
 // src/governance/title-resolver.ts
 async function buildTitleMap(nestId) {
   try {
-    const { storage } = engineCache.get(nestId);
+    const { storage } = await engineCache.get(nestId);
     const docs = await storage.discoverDocuments();
     return new Map(docs.map((d) => [d.id, d.frontmatter.title]));
   } catch {
@@ -877,30 +930,32 @@ var PERMISSION_LEVELS = {
   admin: 3,
   owner: 4
 };
-function resolveNestPermission(nestId, userId) {
+async function resolveNestPermission(nestId, userId) {
   const db = getDb();
-  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
+  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
   if (!nest) return "none";
   if (nest.user_id === userId) return "owner";
-  if (nest.user_id === ANON_USER_ID && isLicenseAdminUserId(userId)) {
+  if (nest.user_id === ANON_USER_ID && await isLicenseAdminUserId(userId)) {
     return "owner";
   }
-  if (isLicenseAdminUserId(userId)) return "admin";
-  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (await isLicenseAdminUserId(userId)) return "admin";
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   if (caller?.email && isSuperAdmin(caller.email)) {
     return "admin";
   }
-  const directGrant = db.prepare(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
-  ).get(nestId, userId);
+  const directGrant = await db.get(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
   if (directGrant) return directGrant.permission;
-  const stewardGrant = db.prepare(
+  const stewardGrant = await db.get(
     `SELECT 1 FROM stewards s
          JOIN users u ON u.id = ?
         WHERE s.nest_id = ? AND s.is_active = 1
           AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`
-  ).get(userId, nestId);
+        LIMIT 1`,
+    [userId, nestId]
+  );
   if (stewardGrant) return "read";
   if (nest.visibility === "public") return "read";
   return "none";
@@ -908,26 +963,28 @@ function resolveNestPermission(nestId, userId) {
 function permissionLevel(p) {
   return PERMISSION_LEVELS[p] ?? 0;
 }
-function isPublicReader(nestId, userId) {
+async function isPublicReader(nestId, userId) {
   const db = getDb();
-  const nest = db.prepare("SELECT user_id, visibility FROM nests WHERE id = ?").get(nestId);
+  const nest = await db.get("SELECT user_id, visibility FROM nests WHERE id = ?", [nestId]);
   if (!nest) return false;
   if (nest.visibility !== "public") return false;
   if (nest.user_id === userId) return false;
-  const directGrant = db.prepare(
-    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
-  ).get(nestId, userId);
+  const directGrant = await db.get(
+    "SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
   if (directGrant) return false;
-  if (isLicenseAdminUserId(userId)) return false;
-  const caller = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  if (await isLicenseAdminUserId(userId)) return false;
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   if (caller?.email && isSuperAdmin(caller.email)) return false;
-  const stewardGrant = db.prepare(
+  const stewardGrant = await db.get(
     `SELECT 1 FROM stewards s
          JOIN users u ON u.id = ?
         WHERE s.nest_id = ? AND s.is_active = 1
           AND LOWER(s.user_email) = LOWER(u.email)
-        LIMIT 1`
-  ).get(userId, nestId);
+        LIMIT 1`,
+    [userId, nestId]
+  );
   if (stewardGrant) return false;
   return true;
 }
@@ -964,35 +1021,39 @@ function primaryRole(roles) {
 }
 
 // src/governance/stewardship-service.ts
-function assignSteward(data) {
+async function assignSteward(data) {
   const db = getDb();
   const id = uuid2();
-  db.prepare(
+  await db.run(
     `INSERT INTO stewards
      (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    id,
-    data.nestId,
-    data.scope,
-    data.nodePattern || null,
-    data.tagName || null,
-    data.userEmail,
-    data.userId || null,
-    data.role,
-    data.assignedBy,
-    data.isActive ? 1 : 0
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      id,
+      data.nestId,
+      data.scope,
+      data.nodePattern || null,
+      data.tagName || null,
+      data.userEmail,
+      data.userId || null,
+      data.role,
+      data.assignedBy,
+      data.isActive ? 1 : 0
+    ]
   );
   return { ...data, id };
 }
-function removeSteward(id) {
+async function removeSteward(id) {
   const db = getDb();
-  db.prepare("DELETE FROM stewards WHERE id = ?").run(id);
+  await db.run("DELETE FROM stewards WHERE id = ?", [id]);
 }
 var VALID_STEWARD_ROLES = ["editor", "reviewer", "viewer"];
-function updateSteward(id, update) {
+async function updateSteward(id, update) {
   const db = getDb();
-  const current = db.prepare("SELECT * FROM stewards WHERE id = ? AND is_active = 1").get(id);
+  const current = await db.get(
+    "SELECT * FROM stewards WHERE id = ? AND is_active = 1",
+    [id]
+  );
   if (!current) {
     throw new ValidationError("Steward not found");
   }
@@ -1023,13 +1084,14 @@ function updateSteward(id, update) {
       case "nest":
         break;
     }
-    const dup = db.prepare(
+    const dup = await db.get(
       `SELECT role FROM stewards
          WHERE nest_id = ? AND is_active = 1 AND id != ? AND scope = ?
            AND user_email = ?
            AND COALESCE(node_pattern, '') = COALESCE(?, '')
-           AND COALESCE(tag_name, '') = COALESCE(?, '')`
-    ).get(current.nest_id, id, scope, current.user_email, nodePattern, tagName);
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
+      [current.nest_id, id, scope, current.user_email, nodePattern, tagName]
+    );
     if (dup) {
       const scopeLabel = scope === "document" ? `document "${nodePattern}"` : scope === "tag" ? `tag "#${tagName}"` : "this nest";
       throw new ConflictError(
@@ -1037,26 +1099,30 @@ function updateSteward(id, update) {
       );
     }
   }
-  db.prepare(
-    "UPDATE stewards SET role = ?, scope = ?, node_pattern = ?, tag_name = ? WHERE id = ?"
-  ).run(role, scope, nodePattern, tagName, id);
-  const row = db.prepare("SELECT * FROM stewards WHERE id = ?").get(id);
+  await db.run(
+    "UPDATE stewards SET role = ?, scope = ?, node_pattern = ?, tag_name = ? WHERE id = ?",
+    [role, scope, nodePattern, tagName, id]
+  );
+  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
   return rowToSteward(row);
 }
-function updateStewardRole(id, role) {
+async function updateStewardRole(id, role) {
   return updateSteward(id, { role });
 }
-function getSteward(id) {
+async function getSteward(id) {
   const db = getDb();
-  const row = db.prepare("SELECT * FROM stewards WHERE id = ?").get(id);
+  const row = await db.get("SELECT * FROM stewards WHERE id = ?", [id]);
   return row ? rowToSteward(row) : null;
 }
 async function getStewardsForNest(nestId) {
   const db = getDb();
-  const rows = db.prepare("SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1").all(nestId);
+  const rows = await db.all(
+    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1",
+    [nestId]
+  );
   return enrichWithTitles(nestId, rows.map(rowToSteward));
 }
-function getStewardsForScope(params) {
+async function getStewardsForScope(params) {
   const db = getDb();
   let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
   const args = [params.nestId];
@@ -1068,7 +1134,7 @@ function getStewardsForScope(params) {
     sql += " AND (node_pattern = ? OR tag_name = ?)";
     args.push(params.scopeTarget, params.scopeTarget);
   }
-  return db.prepare(sql).all(...args).map(rowToSteward);
+  return (await db.all(sql, args)).map(rowToSteward);
 }
 async function listStewards(params) {
   const db = getDb();
@@ -1084,7 +1150,7 @@ async function listStewards(params) {
     args.push(like, like, like);
   }
   sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
-  const stewards = db.prepare(sql).all(...args).map(rowToSteward);
+  const stewards = (await db.all(sql, args)).map(rowToSteward);
   return enrichWithTitles(params.nestId, stewards);
 }
 async function enrichWithTitles(nestId, stewards) {
@@ -1118,7 +1184,7 @@ async function createStewardRecord(params) {
   const db = getDb();
   const results = [];
   const actor = (params.assignedBy || "").trim().toLowerCase();
-  const ownerEmail = (getNestOwnerEmail(params.nestId) || "").toLowerCase();
+  const ownerEmail = (await getNestOwnerEmail(params.nestId) || "").toLowerCase();
   for (const user of params.users) {
     const email = user.email.trim().toLowerCase();
     if (!email) continue;
@@ -1132,17 +1198,18 @@ async function createStewardRecord(params) {
         "The nest owner already has full access and doesn't need a steward role."
       );
     }
-    const existing = db.prepare(
+    const existing = await db.get(
       `SELECT * FROM stewards
          WHERE nest_id = ? AND is_active = 1 AND scope = ? AND user_email = ?
            AND COALESCE(node_pattern, '') = COALESCE(?, '')
-           AND COALESCE(tag_name, '') = COALESCE(?, '')`
-    ).get(
-      params.nestId,
-      params.scope,
-      email,
-      nodePattern ?? null,
-      tagName ?? null
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`,
+      [
+        params.nestId,
+        params.scope,
+        email,
+        nodePattern ?? null,
+        tagName ?? null
+      ]
     );
     if (existing) {
       const scopeLabel = params.scope === "document" ? `document "${nodePattern}"` : params.scope === "tag" ? `tag "#${tagName}"` : "this nest";
@@ -1150,8 +1217,11 @@ async function createStewardRecord(params) {
         `"${email}" is already a steward of ${scopeLabel} with the "${existing.role}" role. Remove the existing assignment first to change the role.`
       );
     }
-    const userRow = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
-    const created = assignSteward({
+    const userRow = await db.get(
+      "SELECT id FROM users WHERE email = ?",
+      [email]
+    );
+    const created = await assignSteward({
       nestId: params.nestId,
       scope: params.scope,
       nodePattern,
@@ -1165,20 +1235,21 @@ async function createStewardRecord(params) {
     });
     results.push(created);
   }
-  db.prepare(
-    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0"
-  ).run(params.nestId);
+  await db.run(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0",
+    [params.nestId]
+  );
   return results;
 }
-function resolveStewardsForNode(nestId, nodeId) {
-  return resolve(nestId, nodeId).stewards;
+async function resolveStewardsForNode(nestId, nodeId) {
+  return (await resolve(nestId, nodeId)).stewards;
 }
-function resolveStewardsWithFallback(nestId, nodeId) {
+async function resolveStewardsWithFallback(nestId, nodeId) {
   return resolve(nestId, nodeId);
 }
-function resolve(nestId, nodeId) {
+async function resolve(nestId, nodeId) {
   const db = getDb();
-  const rows = db.prepare(
+  const rows = await db.all(
     `
       SELECT s.*, 1 AS priority, ('document: ' || s.node_pattern) AS match_source
         FROM stewards s
@@ -1197,16 +1268,17 @@ function resolve(nestId, nodeId) {
         FROM stewards s
         WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
       ORDER BY priority ASC, user_email ASC
-      `
-  ).all(
-    nestId,
-    nodeId,
-    // document branch
-    nestId,
-    nodeId,
-    // tag branch
-    nestId
-    // nest branch
+      `,
+    [
+      nestId,
+      nodeId,
+      // document branch
+      nestId,
+      nodeId,
+      // tag branch
+      nestId
+      // nest branch
+    ]
   );
   const resolved = rows.map((row) => ({
     steward: rowToSteward(row),
@@ -1216,60 +1288,67 @@ function resolve(nestId, nodeId) {
   if (resolved.length > 0) {
     return { stewards: resolved, fallbackToOwner: false };
   }
-  const owner = db.prepare(
+  const owner = await db.get(
     `SELECT u.email FROM nests n
        JOIN users u ON u.id = n.user_id
-       WHERE n.id = ?`
-  ).get(nestId);
+       WHERE n.id = ?`,
+    [nestId]
+  );
   return {
     stewards: [],
     fallbackToOwner: true,
     ownerEmail: owner?.email
   };
 }
-function userIdForEmail(email) {
+async function userIdForEmail(email) {
   const db = getDb();
-  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  const row = await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+    [email]
+  );
   return row?.id;
 }
-function getStewardRolesForUser(nestId, userEmail) {
+async function getStewardRolesForUser(nestId, userEmail) {
   const db = getDb();
-  const rows = db.prepare(
-    "SELECT DISTINCT role FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)"
-  ).all(nestId, userEmail);
+  const rows = await db.all(
+    "SELECT DISTINCT role FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
+    [nestId, userEmail]
+  );
   return rows.map((r) => r.role);
 }
-function getStewardsForUser(nestId, userEmail) {
+async function getStewardsForUser(nestId, userEmail) {
   const db = getDb();
-  const rows = db.prepare(
-    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)"
-  ).all(nestId, userEmail);
+  const rows = await db.all(
+    "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)",
+    [nestId, userEmail]
+  );
   return rows.map(rowToSteward);
 }
-function getCollaboratorRole(nestId, userEmail) {
-  const userId = userIdForEmail(userEmail);
+async function getCollaboratorRole(nestId, userEmail) {
+  const userId = await userIdForEmail(userEmail);
   if (!userId) return null;
   const db = getDb();
-  const row = db.prepare(
-    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?"
-  ).get(nestId, userId);
+  const row = await db.get(
+    "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
   return row?.permission ?? null;
 }
-function resolveUserRoles(nestId, userEmail, opts) {
+async function resolveUserRoles(nestId, userEmail, opts) {
   const roles = /* @__PURE__ */ new Set();
   if (isSuperAdmin(userEmail)) roles.add("admin");
-  const owner = getNestOwnerEmail(nestId);
+  const owner = await getNestOwnerEmail(nestId);
   if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
     roles.add("owner");
   }
-  const userId = userIdForEmail(userEmail);
+  const userId = await userIdForEmail(userEmail);
   if (userId) {
-    const collabRole = collabPermToRole(resolveNestPermission(nestId, userId));
+    const collabRole = collabPermToRole(await resolveNestPermission(nestId, userId));
     if (collabRole) roles.add(collabRole);
   }
-  const stewardRoles = opts?.nodeId ? resolveStewardsForNode(nestId, opts.nodeId).filter(
+  const stewardRoles = opts?.nodeId ? (await resolveStewardsForNode(nestId, opts.nodeId)).filter(
     (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
-  ).map((r) => r.steward.role) : getStewardRolesForUser(nestId, userEmail);
+  ).map((r) => r.steward.role) : await getStewardRolesForUser(nestId, userEmail);
   for (const role of stewardRoles) roles.add(role);
   return [...roles];
 }
@@ -1277,28 +1356,29 @@ function canManageStewards(userEmail) {
   if (config.AUTH_MODE === "open") return true;
   return isLicenseAdminEmail(userEmail) || isSuperAdmin(userEmail);
 }
-function canCreateInNest(nestId, userEmail) {
+async function canCreateInNest(nestId, userEmail) {
   if (config.AUTH_MODE === "open" || isSuperAdmin(userEmail)) return true;
-  const userId = userIdForEmail(userEmail);
+  const userId = await userIdForEmail(userEmail);
   if (userId) {
-    const perm = resolveNestPermission(nestId, userId);
+    const perm = await resolveNestPermission(nestId, userId);
     if (perm === "owner" || perm === "admin" || perm === "write") return true;
   }
-  return getStewardsForUser(nestId, userEmail).some(
+  return (await getStewardsForUser(nestId, userEmail)).some(
     (s) => s.role === "editor" && s.scope === "nest"
   );
 }
-function getNestOwnerEmail(nestId) {
+async function getNestOwnerEmail(nestId) {
   const db = getDb();
-  const row = db.prepare(
+  const row = await db.get(
     `SELECT u.email FROM nests n
        JOIN users u ON u.id = n.user_id
-       WHERE n.id = ?`
-  ).get(nestId);
+       WHERE n.id = ?`,
+    [nestId]
+  );
   return row?.email ?? null;
 }
-function canUserEdit(nestId, nodeId, userEmail) {
-  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+async function canUserEdit(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
@@ -1314,31 +1394,33 @@ function canUserEdit(nestId, nodeId, userEmail) {
   }
   return { allowed: false, reason: "no editor role on this node", role: null };
 }
-function getCurrentVersionAuthor(nestId, nodeId) {
+async function getCurrentVersionAuthor(nestId, nodeId) {
   const db = getDb();
-  const row = db.prepare(
+  const row = await db.get(
     `SELECT author FROM node_versions
        WHERE nest_id = ? AND node_id = ?
-       ORDER BY version DESC LIMIT 1`
-  ).get(nestId, nodeId);
+       ORDER BY version DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
   return row?.author ?? null;
 }
-function getPendingReviewRequester(nestId, nodeId) {
+async function getPendingReviewRequester(nestId, nodeId) {
   const db = getDb();
-  const row = db.prepare(
+  const row = await db.get(
     `SELECT requested_by FROM review_requests
        WHERE nest_id = ? AND node_id = ? AND status = 'pending'
-       ORDER BY requested_at DESC LIMIT 1`
-  ).get(nestId, nodeId);
+       ORDER BY requested_at DESC LIMIT 1`,
+    [nestId, nodeId]
+  );
   return row?.requested_by ?? null;
 }
-function canUserApprove(nestId, nodeId, userEmail) {
-  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+async function canUserApprove(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
   const isOwner = roles.includes("owner");
   const isSuper = isSuperAdmin(userEmail);
-  const allowSelf = nestAllowsSelfApprove(nestId);
+  const allowSelf = await nestAllowsSelfApprove(nestId);
   const hasStewardApprove = roles.includes("admin") || roles.includes("reviewer");
-  const actor = getPendingReviewRequester(nestId, nodeId) ?? getCurrentVersionAuthor(nestId, nodeId);
+  const actor = await getPendingReviewRequester(nestId, nodeId) ?? await getCurrentVersionAuthor(nestId, nodeId);
   const isOwnSubmission = !!actor && actor.toLowerCase() === userEmail.toLowerCase();
   if (hasStewardApprove) {
     if (isOwnSubmission && !((isOwner || isSuper) && allowSelf)) {
@@ -1375,8 +1457,8 @@ function canUserApprove(nestId, nodeId, userEmail) {
     role: held
   };
 }
-function canUserAccess(nestId, nodeId, userEmail) {
-  const roles = resolveUserRoles(nestId, userEmail, { nodeId });
+async function canUserAccess(nestId, nodeId, userEmail) {
+  const roles = await resolveUserRoles(nestId, userEmail, { nodeId });
   if (roles.includes("owner")) {
     return { allowed: true, reason: "nest owner", role: "owner" };
   }
@@ -1392,21 +1474,26 @@ function canUserAccess(nestId, nodeId, userEmail) {
   }
   return { allowed: false, reason: "no collaborator or steward access", role: null };
 }
-function syncFromConfig(nestId, config2) {
+async function syncFromConfig(nestId, config2) {
   const db = getDb();
   let count = 0;
-  db.prepare(
-    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?"
-  ).run(nestId);
-  db.prepare(
-    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?"
-  ).run(nestId);
-  const addEntries = (scope, entries, target) => {
+  await db.run(
+    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?",
+    [nestId]
+  );
+  await db.run(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?",
+    [nestId]
+  );
+  const addEntries = async (scope, entries, target) => {
     for (const entry of entries) {
-      const user = db.prepare("SELECT id FROM users WHERE email = ?").get(entry.email);
+      const user = await db.get(
+        "SELECT id FROM users WHERE email = ?",
+        [entry.email]
+      );
       const rawRole = entry.role || "reviewer";
       const role = rawRole === "admin" ? "reviewer" : rawRole;
-      assignSteward({
+      await assignSteward({
         nestId,
         scope,
         nodePattern: target?.nodePattern,
@@ -1422,16 +1509,16 @@ function syncFromConfig(nestId, config2) {
     }
   };
   if (config2.nest) {
-    addEntries("nest", config2.nest);
+    await addEntries("nest", config2.nest);
   }
   if (config2.tags) {
     for (const [tagName, entries] of Object.entries(config2.tags)) {
-      addEntries("tag", entries, { tagName });
+      await addEntries("tag", entries, { tagName });
     }
   }
   if (config2.documents) {
     for (const [docPattern, entries] of Object.entries(config2.documents)) {
-      addEntries("document", entries, { nodePattern: docPattern });
+      await addEntries("document", entries, { nodePattern: docPattern });
     }
   }
   return count;
@@ -1464,6 +1551,7 @@ export {
   getCurrentLicense,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
+  upsertEnvVar,
   installLicenseKey,
   startLicenseSafetyPoll,
   isSuspended,
@@ -1474,6 +1562,8 @@ export {
   resolveNestPermission,
   permissionLevel,
   isPublicReader,
+  nestStorageRoot,
+  resolveNestPath,
   uniqueNestName,
   isStewardshipEnabled,
   setStewardshipEnabled,