@promptowl/contextnest-community 1.4.0 → 1.6.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-TTXTEUFT.js";
+} from "./chunk-MZGFKBOK.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +25,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-HIH7I232.js";
+} from "./chunk-T5L4LYU4.js";
 import {
   AppError,
   ConflictError,
@@ -65,9 +65,11 @@ import {
   listStewards,
   loadAccessConfig,
   nestAllowsSelfApprove,
+  nestStorageRoot,
   permissionLevel,
   removeSteward,
   renameNest,
+  resolveNestPath,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
@@ -80,14 +82,20 @@ import {
   trackEvent,
   uniqueNestName,
   updateSteward,
+  upsertEnvVar,
   validateLicense
-} from "./chunk-XNPD2Q6E.js";
+} from "./chunk-2TUMMVBG.js";
 import {
-  ANON_EMAIL,
-  ANON_USER_ID,
   config,
-  getDb
-} from "./chunk-RMU3LOPH.js";
+  getDb,
+  initDb,
+  insertOrIgnore,
+  nowExpr
+} from "./chunk-7V33Z6CS.js";
+import {
+  ANON_EMAIL,
+  ANON_USER_ID
+} from "./chunk-SLTQACJW.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
@@ -115,37 +123,40 @@ function newSessionId() {
 function expiryIso(ttlSeconds = SESSION_TTL_SECS) {
   return new Date(Date.now() + ttlSeconds * 1e3).toISOString();
 }
-function createSession(userId, userAgent) {
+async function createSession(userId, userAgent) {
   const db = getDb();
   const id = newSessionId();
-  db.prepare(
+  await db.run(
     `INSERT INTO sessions (id, user_id, expires_at, user_agent)
-     VALUES (?, ?, ?, ?)`
-  ).run(id, userId, expiryIso(), userAgent || null);
+     VALUES (?, ?, ?, ?)`,
+    [id, userId, expiryIso(), userAgent || null]
+  );
   return id;
 }
-function resolveSession(id) {
+async function resolveSession(id) {
   const db = getDb();
-  const row = db.prepare(
-    `SELECT user_id, expires_at FROM sessions WHERE id = ?`
-  ).get(id);
+  const row = await db.get(
+    `SELECT user_id, expires_at FROM sessions WHERE id = ?`,
+    [id]
+  );
   if (!row) return null;
   if (new Date(row.expires_at).getTime() <= Date.now()) {
-    db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+    await db.run("DELETE FROM sessions WHERE id = ?", [id]);
     return null;
   }
-  db.prepare(
-    "UPDATE sessions SET last_seen_at = datetime('now') WHERE id = ?"
-  ).run(id);
+  await db.run(
+    `UPDATE sessions SET last_seen_at = ${nowExpr(db)} WHERE id = ?`,
+    [id]
+  );
   return row.user_id;
 }
-function deleteSession(id) {
+async function deleteSession(id) {
   const db = getDb();
-  db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
+  await db.run("DELETE FROM sessions WHERE id = ?", [id]);
 }
-function deleteAllSessionsForUser(userId) {
+async function deleteAllSessionsForUser(userId) {
   const db = getDb();
-  db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+  await db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);
 }
 function getSessionIdFromRequest(c) {
   const cookieHeader = c.req.header("Cookie");
@@ -189,7 +200,7 @@ var authMiddleware = createMiddleware(async (c, next) => {
   const db = getDb();
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) {
-    const userId = resolveSession(sessionId);
+    const userId = await resolveSession(sessionId);
     if (userId) {
       c.set("userId", userId);
       c.set("nestScope", null);
@@ -199,11 +210,15 @@ var authMiddleware = createMiddleware(async (c, next) => {
   const key = parseBearerToken(c.req.header("Authorization"));
   if (key) {
     const keyHash = hashApiKey(key);
-    const record = db.prepare("SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?").get(keyHash);
+    const record = await db.get(
+      "SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?",
+      [keyHash]
+    );
     if (record) {
-      db.prepare(
-        "UPDATE api_keys SET last_used_at = datetime('now') WHERE key_hash = ?"
-      ).run(keyHash);
+      await db.run(
+        `UPDATE api_keys SET last_used_at = ${nowExpr(db)} WHERE key_hash = ?`,
+        [keyHash]
+      );
       c.set("userId", record.user_id);
       c.set("nestScope", record.nest_id);
       return next();
@@ -303,6 +318,17 @@ var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var warnedMissingSsoAudience = false;
+var MIN_PASSWORD_LENGTH = 8;
+function assertValidPassword(password, label = "password") {
+  if (password.trim().length === 0) {
+    throw new ValidationError(`${label} cannot be empty or only whitespace`);
+  }
+  if (password.length < MIN_PASSWORD_LENGTH) {
+    throw new ValidationError(
+      `${label} must be at least ${MIN_PASSWORD_LENGTH} characters`
+    );
+  }
+}
 function clientIp(c) {
   const xff = c.req.header("x-forwarded-for");
   if (xff) return xff.split(",")[0].trim();
@@ -315,27 +341,30 @@ function clientIp(c) {
   }
   return "unknown";
 }
-function resolveCallerUserId(c) {
+async function resolveCallerUserId(c) {
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) {
-    const uid = resolveSession(sessionId);
+    const uid = await resolveSession(sessionId);
     if (uid) return uid;
   }
   const key = parseBearerToken(c.req.header("Authorization"));
   if (key) {
     const db = getDb();
-    const row = db.prepare("SELECT user_id FROM api_keys WHERE key_hash = ?").get(hashApiKey(key));
+    const row = await db.get(
+      "SELECT user_id FROM api_keys WHERE key_hash = ?",
+      [hashApiKey(key)]
+    );
     if (row) return row.user_id;
   }
   return null;
 }
-function deviceGateBlocked(c) {
+async function deviceGateBlocked(c) {
   const gate = config.PROMPTOWL_SIGN_IN_GATE;
   if (gate === "open") return null;
   const error = "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.";
   if (gate === "disabled") return { error, gate };
-  const callerId = resolveCallerUserId(c);
-  if (callerId && !isLicenseAdminUserId(callerId)) return { error, gate };
+  const callerId = await resolveCallerUserId(c);
+  if (callerId && !await isLicenseAdminUserId(callerId)) return { error, gate };
   return null;
 }
 function setSessionCookie(c, sessionId) {
@@ -364,13 +393,17 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
   }
   const db = getDb();
   const meEmail = normalizeEmail(rawEmail);
-  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
+  let user = await db.get(
+    "SELECT id, email, name FROM users WHERE LOWER(email) = ?",
+    [meEmail]
+  );
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, meEmail, rawName || null, placeholderHash);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [userId, meEmail, rawName || null, placeholderHash]
+    );
     user = { id: userId, email: meEmail, name: rawName || null };
     trackEvent("user.register", {
       userId,
@@ -394,7 +427,7 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
       license_owner_email: lic.ownerEmail
     };
   }
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  const sessionId = await createSession(user.id, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return { ok: true, user, isAdmin, claimBlocked };
 }
@@ -404,31 +437,37 @@ authRoutes.post("/register", async (c) => {
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  assertValidPassword(body.password);
   const email = normalizeEmail(body.email);
   const ip = clientIp(c);
   if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id, is_invited FROM users WHERE LOWER(email) = ?").get(email);
+  const existing = await db.get(
+    "SELECT id, is_invited FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
   let userId;
   const passwordHash = await hashPassword(body.password);
   if (existing && existing.is_invited === 1) {
     userId = existing.id;
-    db.prepare(
-      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
-    ).run(passwordHash, body.name || null, userId);
+    await db.run(
+      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?",
+      [passwordHash, body.name || null, userId]
+    );
     trackEvent("user.register", { userId, email, claimed: true });
   } else if (existing) {
     throw new ValidationError("Email already registered");
   } else {
     userId = uuid();
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, email, body.name || null, passwordHash);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [userId, email, body.name || null, passwordHash]
+    );
     trackEvent("user.register", { userId, email });
   }
-  const sessionId = createSession(userId, c.req.header("User-Agent"));
+  const sessionId = await createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return c.json(
     {
@@ -456,9 +495,10 @@ authRoutes.post("/login", async (c) => {
     return c.json({ error: "Too many login attempts, try again later" }, 429);
   }
   const db = getDb();
-  const user = db.prepare(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?"
-  ).get(emailLower);
+  const user = await db.get(
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?",
+    [emailLower]
+  );
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
     if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
@@ -472,15 +512,15 @@ authRoutes.post("/login", async (c) => {
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
-      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+      await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
         newHash,
         user.id
-      );
+      ]);
     } catch {
     }
   }
   trackEvent("user.login", { userId: user.id });
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  const sessionId = await createSession(user.id, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return c.json({
     user: {
@@ -493,7 +533,7 @@ authRoutes.post("/login", async (c) => {
 });
 authRoutes.post("/logout", async (c) => {
   const sessionId = getSessionIdFromRequest(c);
-  if (sessionId) deleteSession(sessionId);
+  if (sessionId) await deleteSession(sessionId);
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
@@ -503,7 +543,10 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
   const db = getDb();
   const userId = c.get("userId");
-  const existing = db.prepare("SELECT key_prefix FROM api_keys WHERE user_id = ?").get(userId);
+  const existing = await db.get(
+    "SELECT key_prefix FROM api_keys WHERE user_id = ?",
+    [userId]
+  );
   if (existing) {
     return c.json(
       {
@@ -515,15 +558,16 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
-  db.prepare(
-    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
-  ).run(
-    keyId,
-    userId,
-    hashApiKey(apiKey),
-    getKeyPrefix(apiKey),
-    body.nest_id || null,
-    body.label || null
+  await db.run(
+    "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
+    [
+      keyId,
+      userId,
+      hashApiKey(apiKey),
+      getKeyPrefix(apiKey),
+      body.nest_id || null,
+      body.label || null
+    ]
   );
   return c.json(
     { api_key: apiKey, key_prefix: getKeyPrefix(apiKey) },
@@ -538,39 +582,47 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const userId = c.get("userId");
   const apiKey = generateApiKey();
   const keyId = uuid();
-  const prior = db.prepare("SELECT label, nest_id FROM api_keys WHERE user_id = ?").get(userId);
-  db.transaction(() => {
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(userId);
-    db.prepare(
-      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)"
-    ).run(
-      keyId,
-      userId,
-      hashApiKey(apiKey),
-      getKeyPrefix(apiKey),
-      body.nest_id ?? prior?.nest_id ?? null,
-      body.label ?? prior?.label ?? null
+  const prior = await db.get(
+    "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
+    [userId]
+  );
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
+    await tx.run(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
+      [
+        keyId,
+        userId,
+        hashApiKey(apiKey),
+        getKeyPrefix(apiKey),
+        body.nest_id ?? prior?.nest_id ?? null,
+        body.label ?? prior?.label ?? null
+      ]
     );
-  })();
+  });
   return c.json({ api_key: apiKey, key_prefix: getKeyPrefix(apiKey) });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
   const db = getDb();
-  const keys = db.prepare(
-    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?"
-  ).all(c.get("userId"));
+  const keys = await db.all(
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ?",
+    [c.get("userId")]
+  );
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
   const db = getDb();
-  const result = db.prepare("DELETE FROM api_keys WHERE id = ? AND user_id = ?").run(c.req.param("keyId"), c.get("userId"));
+  const result = await db.run(
+    "DELETE FROM api_keys WHERE id = ? AND user_id = ?",
+    [c.req.param("keyId"), c.get("userId")]
+  );
   if (result.changes === 0) {
     return c.json({ error: "Key not found" }, 404);
   }
   return c.json({ deleted: true });
 });
 authRoutes.post("/device", async (c) => {
-  const blocked = deviceGateBlocked(c);
+  const blocked = await deviceGateBlocked(c);
   if (blocked) return c.json(blocked, 403);
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
@@ -593,7 +645,7 @@ authRoutes.post("/device", async (c) => {
   return c.json(data);
 });
 authRoutes.get("/device/poll", async (c) => {
-  const blocked = deviceGateBlocked(c);
+  const blocked = await deviceGateBlocked(c);
   if (blocked) return c.json(blocked, 403);
   const code = c.req.query("code");
   const clientSecret = c.req.query("client_secret");
@@ -676,12 +728,13 @@ authRoutes.get("/sso", async (c) => {
   }
   if (!claims.jti) return ssoError("invalid_ticket");
   const db = getDb();
-  db.prepare("DELETE FROM sso_used_jti WHERE expires_at < datetime('now')").run();
+  await db.run(`DELETE FROM sso_used_jti WHERE expires_at < ${nowExpr(db)}`);
   const expiresAtIso = new Date((claims.exp ?? 0) * 1e3).toISOString();
   try {
-    db.prepare(
-      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)"
-    ).run(claims.jti, expiresAtIso);
+    await db.run(
+      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)",
+      [claims.jti, expiresAtIso]
+    );
   } catch (err) {
     if (err?.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
       return ssoError("ticket_used");
@@ -693,7 +746,7 @@ authRoutes.get("/sso", async (c) => {
   try {
     result = await provisionPromptowlUser(c, sub, claims.name);
   } catch (err) {
-    db.prepare("DELETE FROM sso_used_jti WHERE jti = ?").run(claims.jti);
+    await db.run("DELETE FROM sso_used_jti WHERE jti = ?", [claims.jti]);
     console.error("[sso] provisioning failed; released jti for retry:", err);
     return ssoError("service_error");
   }
@@ -706,13 +759,19 @@ authRoutes.get("/admin-status", async (c) => {
   const ownerEmail = lic?.valid ? lic.ownerEmail : null;
   let admin = null;
   if (ownerEmail) {
-    const ownerRow = db.prepare("SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1").get(ownerEmail);
+    const ownerRow = await db.get(
+      "SELECT name FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",
+      [ownerEmail]
+    );
     admin = { email: ownerEmail, name: ownerRow?.name ?? null };
   }
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   let me = null;
   if (callerId) {
-    const row = db.prepare("SELECT email, name FROM users WHERE id = ?").get(callerId);
+    const row = await db.get(
+      "SELECT email, name FROM users WHERE id = ?",
+      [callerId]
+    );
     if (row) {
       me = {
         email: row.email,
@@ -732,12 +791,13 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   if (!body.current || !body.next) {
     throw new ValidationError("current and next are required");
   }
-  if (body.next.length < 8) {
-    throw new ValidationError("new password must be at least 8 characters");
-  }
+  assertValidPassword(body.next, "new password");
   const db = getDb();
   const userId = c.get("userId");
-  const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
+  const user = await db.get(
+    "SELECT password_hash FROM users WHERE id = ?",
+    [userId]
+  );
   if (!user) throw new ValidationError("User not found");
   const check = await verifyPassword(body.current, user.password_hash);
   if (!check.ok) {
@@ -750,20 +810,20 @@ authRoutes.post("/password", authMiddleware, async (c) => {
     );
   }
   const newHash = await hashPassword(body.next);
-  db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+  await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
     newHash,
     userId
-  );
-  deleteAllSessionsForUser(userId);
+  ]);
+  await deleteAllSessionsForUser(userId);
   clearSessionCookie(c);
   return c.json({ ok: true });
 });
 authRoutes.post("/admin/reset-password/:userId", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       { error: "Only the license-admin user can reset passwords." },
       403
@@ -771,7 +831,10 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   }
   const targetId = c.req.param("userId");
   const db = getDb();
-  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  const target = await db.get(
+    "SELECT id, email FROM users WHERE id = ?",
+    [targetId]
+  );
   if (!target) return c.json({ error: "User not found" }, 404);
   let supplied;
   try {
@@ -779,20 +842,20 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   } catch {
     supplied = void 0;
   }
-  if (supplied && supplied.length < 8) {
-    throw new ValidationError("password must be at least 8 characters");
+  if (supplied !== void 0) {
+    assertValidPassword(supplied);
   }
   const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
-  db.transaction(() => {
-    db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(
+  await db.transaction(async (tx) => {
+    await tx.run("UPDATE users SET password_hash = ? WHERE id = ?", [
       newHash,
       target.id
-    );
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
-  })();
-  deleteAllSessionsForUser(target.id);
+    ]);
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [target.id]);
+  });
+  await deleteAllSessionsForUser(target.id);
   trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
   return c.json({
     ok: true,
@@ -803,11 +866,11 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   });
 });
 authRoutes.delete("/users/:userId", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       { error: "Only the license-admin user can remove users." },
       403
@@ -818,9 +881,15 @@ authRoutes.delete("/users/:userId", async (c) => {
     return c.json({ error: "You can't remove your own admin account." }, 400);
   }
   const db = getDb();
-  const target = db.prepare("SELECT id, email FROM users WHERE id = ?").get(targetId);
+  const target = await db.get(
+    "SELECT id, email FROM users WHERE id = ?",
+    [targetId]
+  );
   if (!target) return c.json({ error: "User not found" }, 404);
-  const ownedNests = db.prepare("SELECT COUNT(*) AS c FROM nests WHERE user_id = ?").get(target.id).c;
+  const ownedNests = (await db.get(
+    "SELECT COUNT(*) AS c FROM nests WHERE user_id = ?",
+    [target.id]
+  )).c;
   if (ownedNests > 0) {
     return c.json(
       {
@@ -830,17 +899,18 @@ authRoutes.delete("/users/:userId", async (c) => {
       409
     );
   }
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)"
-    ).run(target.id, target.email);
-    db.prepare("DELETE FROM nest_collaborators WHERE user_id = ?").run(
-      target.id
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM stewards WHERE user_id = ? OR lower(user_email) = lower(?)",
+      [target.id, target.email]
     );
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(target.id);
-    db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
-  })();
-  deleteAllSessionsForUser(target.id);
+    await tx.run("DELETE FROM nest_collaborators WHERE user_id = ?", [
+      target.id
+    ]);
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [target.id]);
+    await tx.run("DELETE FROM users WHERE id = ?", [target.id]);
+  });
+  await deleteAllSessionsForUser(target.id);
   trackEvent("admin.remove_user", { adminId: callerId, userId: target.id });
   return c.json({ ok: true, email: target.email });
 });
@@ -848,7 +918,7 @@ authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
   const email = normalizeEmail(body.email);
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
       {
@@ -858,7 +928,7 @@ authRoutes.post("/invite", async (c) => {
     );
   }
   const db = getDb();
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       {
         error: "Only the license-admin user can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
@@ -866,29 +936,34 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = db.prepare("SELECT id, email FROM users WHERE LOWER(email) = ?").get(email);
+  let user = await db.get(
+    "SELECT id, email FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-    ).run(userId, email, null, placeholderHash);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+      [userId, email, null, placeholderHash]
+    );
     user = { id: userId, email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
-  db.transaction(() => {
-    db.prepare("DELETE FROM api_keys WHERE user_id = ?").run(user.id);
-    db.prepare(
-      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)"
-    ).run(
-      keyId,
-      user.id,
-      hashApiKey(apiKey),
-      getKeyPrefix(apiKey),
-      body.label || "teammate"
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [user.id]);
+    await tx.run(
+      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)",
+      [
+        keyId,
+        user.id,
+        hashApiKey(apiKey),
+        getKeyPrefix(apiKey),
+        body.label || "teammate"
+      ]
     );
-  })();
+  });
   trackEvent("admin.invite", { adminId: callerId, email: body.email });
   return c.json(
     {
@@ -900,7 +975,7 @@ authRoutes.post("/invite", async (c) => {
   );
 });
 authRoutes.get("/teammates", async (c) => {
-  const callerId = resolveCallerUserId(c);
+  const callerId = await resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
       {
@@ -910,7 +985,7 @@ authRoutes.get("/teammates", async (c) => {
     );
   }
   const db = getDb();
-  if (!isLicenseAdminUserId(callerId)) {
+  if (!await isLicenseAdminUserId(callerId)) {
     return c.json(
       {
         error: "Only the license-admin user can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
@@ -918,15 +993,16 @@ authRoutes.get("/teammates", async (c) => {
       403
     );
   }
-  const teammates = db.prepare(
+  const teammates = await db.all(
     `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
          (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
        FROM users u
        WHERE u.id != ?
-       ORDER BY u.created_at DESC`
-  ).all(ANON_USER_ID);
-  const pendingStewards = db.prepare(
+       ORDER BY u.created_at DESC`,
+    [ANON_USER_ID]
+  );
+  const pendingStewards = await db.all(
     `SELECT DISTINCT s.user_email AS email
          FROM stewards s
         WHERE s.is_active = 1
@@ -941,7 +1017,7 @@ authRoutes.get("/teammates", async (c) => {
                )
           )
         ORDER BY s.user_email`
-  ).all();
+  );
   const enriched = teammates.map((t) => ({ ...t, is_admin: isLicenseAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
   return c.json({
     teammates: enriched,
@@ -959,52 +1035,70 @@ import { serializeDocument, parseDocument as parseDocument2 } from "@promptowl/c
 function normalizeTag(raw) {
   return raw.trim().replace(/^#+/, "").toLowerCase();
 }
-function syncNodeTags(nestId, nodeId, tags) {
+async function syncNodeTags(nestId, nodeId, tags) {
   const db = getDb();
   const normalized = Array.from(
     new Set(
       tags.filter((t) => typeof t === "string").map(normalizeTag).filter(Boolean)
     )
   );
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    const insert = db.prepare(
-      "INSERT OR IGNORE INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+  const insertSql = insertOrIgnore(
+    db,
+    "INSERT INTO node_tag_index (nest_id, node_id, tag_name) VALUES (?, ?, ?)"
+  );
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
     );
     for (const tag of normalized) {
-      insert.run(nestId, nodeId, tag);
+      await tx.run(insertSql, [nestId, nodeId, tag]);
     }
-  })();
+  });
 }
-function removeNodeFromTagIndex(nestId, nodeId) {
+async function removeNodeFromTagIndex(nestId, nodeId) {
   const db = getDb();
-  db.prepare(
-    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?"
-  ).run(nestId, nodeId);
+  await db.run(
+    "DELETE FROM node_tag_index WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  );
 }
 
 // src/governance/access-guard.ts
-function resolveCallerEmail(userId) {
+async function resolveCallerEmail(userId) {
   if (!userId) return "admin@localhost";
   const db = getDb();
-  const row = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const row = await db.get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
   return row?.email || "admin@localhost";
 }
-function canReadNode(nestId, nodeId, userId, userEmail) {
-  if (isPublicReader(nestId, userId)) {
-    return getApprovedVersion(nestId, nodeId) !== null;
+async function canReadNode(nestId, nodeId, userId, userEmail) {
+  if (await isPublicReader(nestId, userId)) {
+    return await getApprovedVersion(nestId, nodeId) !== null;
   }
-  if (!isStewardshipEnabled(nestId)) return true;
-  return canUserAccess(nestId, nodeId, userEmail).allowed;
+  if (!await isStewardshipEnabled(nestId)) return true;
+  return (await canUserAccess(nestId, nodeId, userEmail)).allowed;
 }
-function filterAccessible(nestId, userId, userEmail, nodes) {
-  if (isPublicReader(nestId, userId)) {
-    return nodes.filter((n) => getApprovedVersion(nestId, n.id) !== null);
+async function filterAccessible(nestId, userId, userEmail, nodes) {
+  if (await isPublicReader(nestId, userId)) {
+    const filtered = [];
+    for (const n of nodes) {
+      if (await getApprovedVersion(nestId, n.id) !== null) {
+        filtered.push(n);
+      }
+    }
+    return filtered;
   }
-  if (!isStewardshipEnabled(nestId)) return nodes;
-  return nodes.filter((n) => canUserAccess(nestId, n.id, userEmail).allowed);
+  if (!await isStewardshipEnabled(nestId)) return nodes;
+  const accessible = [];
+  for (const n of nodes) {
+    if ((await canUserAccess(nestId, n.id, userEmail)).allowed) {
+      accessible.push(n);
+    }
+  }
+  return accessible;
 }
 
 // src/governance/external-edit-service.ts
@@ -1028,7 +1122,7 @@ var communityRbac = {
   isDocOwner: () => true
 };
 function docPath(nestId, documentId) {
-  return join(config.DATA_ROOT, "nests", nestId, `${documentId}.md`);
+  return join(resolveNestPath(nestId), `${documentId}.md`);
 }
 async function readRaw(nestId, documentId) {
   try {
@@ -1052,7 +1146,7 @@ async function loadChainHead(storage, documentId) {
   }
 }
 async function loadLatestApprovedNode(nestId, documentId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const head = await loadChainHead(storage, documentId);
   if (!head) return null;
   return parseDocument(docPath(nestId, documentId), head.content, documentId);
@@ -1068,7 +1162,7 @@ async function scanDocumentForDrift(nestId, documentId, actor = "system:scanner"
   return res?.meta ?? null;
 }
 async function scanDocumentForDriftInternal(nestId, documentId, actor) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const node = await storage.readDocument(documentId).catch(() => null);
   if (!node) return null;
   const raw = await readRaw(nestId, documentId);
@@ -1095,7 +1189,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   return { meta: result.meta, created: true };
 }
 async function scanNestForDrift(nestId, actor = "system:scanner") {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
   const results = await Promise.all(
     docs.map((doc) => scanDocumentForDriftInternal(nestId, doc.id, actor))
@@ -1104,7 +1198,7 @@ async function scanNestForDrift(nestId, actor = "system:scanner") {
   return { scanned: docs.length, staged };
 }
 async function getPendingChange(nestId, documentId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const list = await listSuggestions(storage, documentId);
   for (let i = list.length - 1; i >= 0; i--) {
     const meta = list[i];
@@ -1121,7 +1215,7 @@ async function getPendingChange(nestId, documentId) {
   return null;
 }
 async function listNestExternalEdits(nestId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
   const lists = await Promise.all(
     docs.map(async (doc) => {
@@ -1150,7 +1244,7 @@ async function listNestExternalEdits(nestId) {
   return entries.sort((a, b) => b.detected_at.localeCompare(a.detected_at));
 }
 async function getExternalEditDetail(nestId, documentId, suggestionId) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const found = await readSuggestion(storage, documentId, suggestionId);
   if (!found) return null;
   return {
@@ -1167,7 +1261,7 @@ async function getExternalEditDetail(nestId, documentId, suggestionId) {
   };
 }
 async function approveExternalEdit(input) {
-  const { storage } = engineCache.get(input.nestId);
+  const { storage } = await engineCache.get(input.nestId);
   let result;
   try {
     result = await approveSuggestion({
@@ -1190,8 +1284,8 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
-    createVersion2({
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-MUZYTYMW.js");
+    await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
       version: versionNum,
@@ -1201,7 +1295,12 @@ async function approveExternalEdit(input) {
       tags,
       changeNote: input.comment || "External edit approved"
     });
-    setApprovedVersion2(input.nestId, input.documentId, versionNum, input.actor);
+    await setApprovedVersion2(
+      input.nestId,
+      input.documentId,
+      versionNum,
+      input.actor
+    );
   } catch (err) {
     console.error(
       `[external-edit] failed to mirror approved version into node_versions for ${input.nestId}/${input.documentId}:`,
@@ -1211,7 +1310,7 @@ async function approveExternalEdit(input) {
   return result;
 }
 async function rejectExternalEdit(input) {
-  const { storage } = engineCache.get(input.nestId);
+  const { storage } = await engineCache.get(input.nestId);
   const result = await rejectSuggestion({
     storage,
     rbac: communityRbac,
@@ -1237,7 +1336,7 @@ async function rejectExternalEdit(input) {
 var scannerTimer = null;
 async function scanAllNests() {
   const db = getDb();
-  const rows = db.prepare("SELECT id FROM nests").all();
+  const rows = await db.all("SELECT id FROM nests");
   await Promise.all(
     rows.map(
       ({ id }) => scanNestForDrift(id).catch(
@@ -1257,9 +1356,9 @@ function startDriftScanner(intervalMs = 3e4) {
 }
 
 // src/nodes/service.ts
-function userIdFromEmail(email) {
+async function userIdFromEmail(email) {
   const db = getDb();
-  const row = db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(email);
+  const row = await db.get("SELECT id FROM users WHERE LOWER(email) = LOWER(?)", [email]);
   return row?.id ?? ANON_USER_ID;
 }
 var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
@@ -1291,7 +1390,7 @@ function toNodeResponse(node) {
   };
 }
 async function listNodesForCaller(nestId, userId, filters = {}) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   let documents = await storage.discoverDocuments();
   if (filters.type) {
     documents = documents.filter((n) => n.frontmatter.type === filters.type);
@@ -1302,14 +1401,14 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
       (n) => (n.frontmatter.tags || []).includes(tag)
     );
   }
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
-  const publicReader = isPublicReader(nestId, userId);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
+  const publicReader = await isPublicReader(nestId, userId);
   const enriched = await Promise.all(
     accessible.map(async (doc) => {
       const r = toNodeResponse(doc);
       if (publicReader) {
-        const approved = getApprovedVersion(nestId, doc.id);
+        const approved = await getApprovedVersion(nestId, doc.id);
         if (approved != null) {
           try {
             const raw = await versionManager.reconstructVersion(doc.id, approved);
@@ -1333,7 +1432,7 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.pendingChange = pending;
         r.status = "external_edit_pending";
       } else {
-        r.status = getDisplayStatus(nestId, r.id);
+        r.status = await getDisplayStatus(nestId, r.id);
       }
       return r;
     })
@@ -1341,15 +1440,15 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
   return filters.limit ? enriched.slice(0, filters.limit) : enriched;
 }
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
-  return listNodesForCaller(nestId, userIdFromEmail(userEmail), filters);
+  return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
 }
 async function createNode(nestId, input, userEmail) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   const id = input.id ?? `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
-  const hasStewards = isStewardshipEnabled(nestId);
+  const hasStewards = await isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "published";
   const initialVersion = hasStewards ? 1 : 0;
   let node = {
@@ -1369,7 +1468,7 @@ async function createNode(nestId, input, userEmail) {
     rawContent: ""
   };
   await storage.writeDocument(id, serializeDocument(node));
-  syncNodeTags(nestId, id, tags);
+  await syncNodeTags(nestId, id, tags);
   let savedVersion = 1;
   if (hasStewards) {
     try {
@@ -1377,7 +1476,7 @@ async function createNode(nestId, input, userEmail) {
     } catch (err) {
       console.error("VersionManager.createVersion failed (node create)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId: id,
       version: 1,
@@ -1393,7 +1492,7 @@ async function createNode(nestId, input, userEmail) {
         note: "Auto-published on create (no stewards configured)"
       });
       savedVersion = result.node.frontmatter.version || 1;
-      createVersion({
+      await createVersion({
         nestId,
         nodeId: id,
         version: savedVersion,
@@ -1402,11 +1501,11 @@ async function createNode(nestId, input, userEmail) {
         status: "published",
         tags
       });
-      setApprovedVersion(nestId, id, savedVersion, userEmail);
+      await setApprovedVersion(nestId, id, savedVersion, userEmail);
       node = result.node;
     } catch (err) {
       console.error("publishDocument failed (node create auto-publish)", err);
-      createVersion({
+      await createVersion({
         nestId,
         nodeId: id,
         version: 1,
@@ -1417,11 +1516,11 @@ async function createNode(nestId, input, userEmail) {
       });
     }
   }
-  trackEvent("node.create", { nestId, nodeId: id });
+  await trackEvent("node.create", { nestId, nodeId: id });
   return { node, version: savedVersion };
 }
 async function registerImportedDocuments(nestId, userEmail) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   let docs;
   try {
     docs = await storage.discoverDocuments();
@@ -1432,7 +1531,7 @@ async function registerImportedDocuments(nestId, userEmail) {
   let registered = 0;
   for (const doc of docs) {
     const nodeId = doc.id;
-    if (getCurrentVersion(nestId, nodeId) > 0) continue;
+    if (await getCurrentVersion(nestId, nodeId) > 0) continue;
     const rawTags = Array.isArray(doc.frontmatter?.tags) ? doc.frontmatter.tags : [];
     const tags = rawTags.map((t) => normalizeTag2(String(t)));
     const fmVersion = Number(doc.frontmatter?.version);
@@ -1448,7 +1547,7 @@ async function registerImportedDocuments(nestId, userEmail) {
     } catch (err) {
       console.error("safePublishDocument failed (import register)", nodeId, err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version,
@@ -1458,15 +1557,15 @@ async function registerImportedDocuments(nestId, userEmail) {
       changeNote: "Imported from existing folder",
       tags
     });
-    setApprovedVersion(nestId, nodeId, version, userEmail);
-    syncNodeTags(nestId, nodeId, tags);
+    await setApprovedVersion(nestId, nodeId, version, userEmail);
+    await syncNodeTags(nestId, nodeId, tags);
     registered++;
   }
-  trackEvent("nest.import.documents", { nestId, registered });
+  await trackEvent("nest.import.documents", { nestId, registered });
   return registered;
 }
 async function updateNode(nestId, nodeId, patch, userEmail) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   let node;
   try {
     node = await storage.readDocument(nodeId);
@@ -1490,16 +1589,16 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   if (patch.title) {
     node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
   }
-  const hasStewards = isStewardshipEnabled(nestId);
+  const hasStewards = await isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
-  if (hasStewards && getPendingReview(nestId, nodeId)) {
+  if (hasStewards && await getPendingReview(nestId, nodeId)) {
     throw new LockedError(
       "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
     );
   }
   let responseVersion;
   if (hasStewards) {
-    const currentVersion = getCurrentVersion(nestId, nodeId);
+    const currentVersion = await getCurrentVersion(nestId, nodeId);
     const newVersion = currentVersion + 1;
     node = {
       ...node,
@@ -1514,13 +1613,13 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     };
     node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
     await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
+    await syncNodeTags(nestId, nodeId, currentTags);
     try {
       await versionManager.createVersion(node, userEmail, { note: patch.changeNote });
     } catch (err) {
       console.error("VersionManager.createVersion failed (node patch)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version: newVersion,
@@ -1542,7 +1641,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     };
     node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
     await storage.writeDocument(nodeId, serializeDocument(node));
-    syncNodeTags(nestId, nodeId, currentTags);
+    await syncNodeTags(nestId, nodeId, currentTags);
     let publishedVersion = (node.frontmatter.version || 0) + 1;
     try {
       const result = await safePublishDocument(storage, nodeId, {
@@ -1554,7 +1653,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
     } catch (err) {
       console.error("publishDocument failed (node patch auto-publish)", err);
     }
-    createVersion({
+    await createVersion({
       nestId,
       nodeId,
       version: publishedVersion,
@@ -1564,7 +1663,7 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
       tags: currentTags,
       changeNote: patch.changeNote
     });
-    setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
+    await setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
     responseVersion = publishedVersion;
   }
   return { node, version: responseVersion };
@@ -1572,8 +1671,11 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
 
 // src/nests/unsynced-service.ts
 import { readdirSync, readFileSync, rmSync, statSync } from "fs";
-import { join as join2, relative } from "path";
+import { join as join2, relative, resolve } from "path";
 var RESERVED = /* @__PURE__ */ new Set(["nests"]);
+function isNestStorageRoot(absPath) {
+  return resolve(absPath) === resolve(nestStorageRoot());
+}
 function scanMarkdown(dir) {
   let count = 0;
   let size = 0;
@@ -1653,7 +1755,9 @@ function listUnsyncedFolders() {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".")) continue;
     if (RESERVED.has(e.name)) continue;
-    out.push(...collectLeafFolders(e.name, join2(root, e.name)));
+    const abs = join2(root, e.name);
+    if (isNestStorageRoot(abs)) continue;
+    out.push(...collectLeafFolders(e.name, abs));
   }
   out.sort((a, b) => a.name.localeCompare(b.name));
   console.log(
@@ -1707,6 +1811,9 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   );
   assertSafeFolderName(folderName);
   const src = join2(config.DATA_ROOT, folderName);
+  if (isNestStorageRoot(src)) {
+    throw new ValidationError("Folder is not eligible for sync");
+  }
   let stat;
   try {
     stat = statSync(src);
@@ -1726,7 +1833,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   }
   const segments = folderName.split("/").filter(Boolean);
   const baseName = segments[segments.length - 1] || folderName;
-  const nestName = uniqueNestName(userId, baseName);
+  const nestName = await uniqueNestName(userId, baseName);
   if (nestName !== baseName) {
     console.log(
       `[unsynced] name "${baseName}" already in use, using "${nestName}" instead`
@@ -1750,10 +1857,13 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
 }
 
 // src/nests/routes.ts
-function effectivePermission(nestId, userId) {
+async function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
     const db = getDb();
-    const nest = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+    const nest = await db.get(
+      "SELECT user_id FROM nests WHERE id = ?",
+      [nestId]
+    );
     if (nest && nest.user_id === ANON_USER_ID) return "owner";
   }
   return resolveNestPermission(nestId, userId);
@@ -1761,21 +1871,19 @@ function effectivePermission(nestId, userId) {
 var nestRoutes = new Hono2();
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
-  const owned = listNests(userId);
-  const shared = listSharedNests(userId);
-  const publicExtras = listPublicNests(userId);
+  const owned = await listNests(userId);
+  const shared = await listSharedNests(userId);
+  const publicExtras = await listPublicNests(userId);
   const db = getDb();
-  const ownerEmailStmt = db.prepare(
-    "SELECT email FROM users WHERE id = ?"
-  );
-  const callerEmail = resolveCallerEmail(userId);
-  const annotate = (n) => {
-    const permission = effectivePermission(n.id, userId);
+  const ownerEmailSql = "SELECT email FROM users WHERE id = ?";
+  const callerEmail = await resolveCallerEmail(userId);
+  const annotate = async (n) => {
+    const permission = await effectivePermission(n.id, userId);
     const is_owner = permission === "owner";
     let owner_email = null;
-    const roles = is_owner ? ["owner"] : resolveUserRoles(n.id, callerEmail);
+    const roles = is_owner ? ["owner"] : await resolveUserRoles(n.id, callerEmail);
     if (!is_owner && n.user_id !== ANON_USER_ID) {
-      const row = ownerEmailStmt.get(n.user_id);
+      const row = await db.get(ownerEmailSql, [n.user_id]);
       owner_email = row?.email ?? null;
     }
     return { ...n, permission, is_owner, owner_email, roles };
@@ -1785,7 +1893,7 @@ nestRoutes.get("/", async (c) => {
   for (const n of [...owned, ...shared, ...publicExtras]) {
     if (seen.has(n.id)) continue;
     seen.add(n.id);
-    out.push(annotate(n));
+    out.push(await annotate(n));
   }
   return c.json({ nests: out });
 });
@@ -1807,20 +1915,20 @@ nestRoutes.post("/import", async (c) => {
   const nest = await importNest(userId, body.name, files);
   const documents = await registerImportedDocuments(
     nest.id,
-    resolveCallerEmail(userId)
+    await resolveCallerEmail(userId)
   );
   return c.json({ nest, documents }, 201);
 });
 nestRoutes.get("/unsynced", async (c) => {
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can list unsynced folders");
   }
   return c.json({ folders: listUnsyncedFolders() });
 });
 nestRoutes.post("/unsynced/sync", async (c) => {
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can sync folders");
   }
   const body = await c.req.json();
@@ -1830,30 +1938,30 @@ nestRoutes.post("/unsynced/sync", async (c) => {
   const result = await syncUnsyncedFolder(
     userId,
     body.name,
-    resolveCallerEmail(userId)
+    await resolveCallerEmail(userId)
   );
   return c.json(result, 201);
 });
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
-  const email = resolveCallerEmail(userId);
-  let roles = resolveUserRoles(nestId, email);
+  const email = await resolveCallerEmail(userId);
+  let roles = await resolveUserRoles(nestId, email);
   if (permission === "owner" && !roles.includes("owner")) {
     roles = ["owner", ...roles];
   }
-  const myStewards = getStewardsForUser(nestId, email);
-  const nest = getNest(nestId);
+  const myStewards = await getStewardsForUser(nestId, email);
+  const nest = await getNest(nestId);
   return c.json({ nest, permission, roles, myStewards });
 });
 nestRoutes.patch("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
@@ -1863,7 +1971,7 @@ nestRoutes.patch("/:nestId", async (c) => {
     );
   }
   const body = await c.req.json();
-  const nest = renameNest(nestId, {
+  const nest = await renameNest(nestId, {
     name: body.name,
     description: body.description
   });
@@ -1872,13 +1980,13 @@ nestRoutes.patch("/:nestId", async (c) => {
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const nest = getNest(nestId);
+  const nest = await getNest(nestId);
   if (!nest) {
     throw new NotFoundError("Nest not found");
   }
-  const permission = effectivePermission(nestId, userId);
+  const permission = await effectivePermission(nestId, userId);
   const isAnonOwned = nest.user_id === ANON_USER_ID;
-  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && isLicenseAdminUserId(userId);
+  const adminCaretaker = config.AUTH_MODE !== "open" && isAnonOwned && await isLicenseAdminUserId(userId);
   if (permission !== "owner" && !adminCaretaker) {
     throw new ForbiddenError(
       "You don't have permission to delete this nest. Only the nest owner can delete it."
@@ -1889,20 +1997,20 @@ nestRoutes.delete("/:nestId", async (c) => {
 });
 nestRoutes.get("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
-  const permission = effectivePermission(nestId, c.get("userId"));
+  const permission = await effectivePermission(nestId, c.get("userId"));
   if (permission === "none") {
     throw new NotFoundError("Nest not found");
   }
   return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId),
-    allow_self_approve: nestAllowsSelfApprove(nestId)
+    stewardship_enabled: await isStewardshipEnabled(nestId),
+    allow_self_approve: await nestAllowsSelfApprove(nestId)
   });
 });
 nestRoutes.patch("/:nestId/settings", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const isServerAdmin = isLicenseAdminUserId(userId);
-  const permission = effectivePermission(nestId, userId);
+  const isServerAdmin = await isLicenseAdminUserId(userId);
+  const permission = await effectivePermission(nestId, userId);
   if (!isServerAdmin && permission !== "owner") {
     return c.json(
       {
@@ -1915,17 +2023,17 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
   let wiped = null;
   if (typeof body.stewardship_enabled === "boolean") {
     if (body.stewardship_enabled) {
-      setStewardshipEnabled(nestId, true);
+      await setStewardshipEnabled(nestId, true);
     } else {
-      wiped = disableStewardshipAndWipeGovernance(nestId);
+      wiped = await disableStewardshipAndWipeGovernance(nestId);
     }
   }
   if (typeof body.allow_self_approve === "boolean") {
-    setAllowSelfApprove(nestId, body.allow_self_approve);
+    await setAllowSelfApprove(nestId, body.allow_self_approve);
   }
   return c.json({
-    stewardship_enabled: isStewardshipEnabled(nestId),
-    allow_self_approve: nestAllowsSelfApprove(nestId),
+    stewardship_enabled: await isStewardshipEnabled(nestId),
+    allow_self_approve: await nestAllowsSelfApprove(nestId),
     wiped
   });
 });
@@ -1950,21 +2058,28 @@ async function addCollaborator(params) {
   let userId = params.userId;
   if (!userId && params.email) {
     const email = normalizeEmail(params.email);
-    const existing = db.prepare("SELECT id FROM users WHERE LOWER(email) = ?").get(email);
+    const existing = await db.get(
+      "SELECT id FROM users WHERE LOWER(email) = ?",
+      [email]
+    );
     if (existing) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
       userId = uuid2();
-      db.prepare(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, email, null, await hashPassword2(uuid2()));
+      await db.run(
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+        [userId, email, null, await hashPassword2(uuid2())]
+      );
     }
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
   }
-  const ownerRow = db.prepare("SELECT user_id FROM nests WHERE id = ?").get(nestId);
+  const ownerRow = await db.get(
+    "SELECT user_id FROM nests WHERE id = ?",
+    [nestId]
+  );
   if (!ownerRow) {
     throw new ValidationError("Nest not found");
   }
@@ -1978,19 +2093,29 @@ async function addCollaborator(params) {
   if (selfByEmail || selfById) {
     throw new ValidationError("You can't add yourself as a collaborator.");
   }
-  const dupe = db.prepare("SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?").get(nestId, userId);
+  const dupe = await db.get(
+    "SELECT id FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+    [nestId, userId]
+  );
   if (dupe) {
     throw new ConflictError(
       `${params.email || "This user"} already has access to this nest. Change their permission instead of adding them again.`
     );
   }
-  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? db.prepare("SELECT id FROM users WHERE LOWER(email) = LOWER(?)").get(params.grantedByEmail)?.id : void 0;
+  const granterByEmail = !params.grantedByUserId && params.grantedByEmail ? (await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+    [params.grantedByEmail]
+  ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
   const collabId = uuid2();
-  db.prepare(
-    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)"
-  ).run(collabId, nestId, userId, params.permission, granterId);
-  return db.prepare("SELECT * FROM nest_collaborators WHERE id = ?").get(collabId);
+  await db.run(
+    "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
+    [collabId, nestId, userId, params.permission, granterId]
+  );
+  return await db.get(
+    "SELECT * FROM nest_collaborators WHERE id = ?",
+    [collabId]
+  );
 }
 
 // src/nests/sharing-routes.ts
@@ -1998,20 +2123,25 @@ var sharingRoutes = new Hono3();
 sharingRoutes.get("/collaborators", async (c) => {
   const db = getDb();
   const nestId = c.req.param("nestId");
-  const collabs = db.prepare(
+  const collabs = await db.all(
     `SELECT nc.*, u.email FROM nest_collaborators nc
        LEFT JOIN users u ON nc.user_id = u.id
        WHERE nc.nest_id = ?
-       ORDER BY nc.granted_at`
-  ).all(nestId);
-  const enriched = collabs.map((collab) => {
-    if (!collab.email) return { ...collab, stewardRoles: [], roles: [] };
-    return {
+       ORDER BY nc.granted_at`,
+    [nestId]
+  );
+  const enriched = [];
+  for (const collab of collabs) {
+    if (!collab.email) {
+      enriched.push({ ...collab, stewardRoles: [], roles: [] });
+      continue;
+    }
+    enriched.push({
       ...collab,
-      stewardRoles: getStewardRolesForUser(nestId, collab.email),
-      roles: resolveUserRoles(nestId, collab.email)
-    };
-  });
+      stewardRoles: await getStewardRolesForUser(nestId, collab.email),
+      roles: await resolveUserRoles(nestId, collab.email)
+    });
+  }
   return c.json({ collaborators: enriched });
 });
 sharingRoutes.post("/collaborators", async (c) => {
@@ -2034,9 +2164,10 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
     throw new ValidationError("permission must be read, write, or admin");
   }
   const db = getDb();
-  const info = db.prepare(
-    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?"
-  ).run(body.permission, c.req.param("collabId"), c.req.param("nestId"));
+  const info = await db.run(
+    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?",
+    [body.permission, c.req.param("collabId"), c.req.param("nestId")]
+  );
   if (info.changes === 0) {
     throw new NotFoundError("Collaborator not found");
   }
@@ -2044,9 +2175,10 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
 });
 sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   const db = getDb();
-  const info = db.prepare(
-    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?"
-  ).run(c.req.param("collabId"), c.req.param("nestId"));
+  const info = await db.run(
+    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?",
+    [c.req.param("collabId"), c.req.param("nestId")]
+  );
   if (info.changes === 0) {
     throw new NotFoundError("Collaborator not found");
   }
@@ -2058,10 +2190,10 @@ sharingRoutes.patch("/visibility", async (c) => {
     throw new ValidationError("visibility must be private or public");
   }
   const db = getDb();
-  db.prepare("UPDATE nests SET visibility = ? WHERE id = ?").run(
+  await db.run("UPDATE nests SET visibility = ? WHERE id = ?", [
     body.visibility,
     c.req.param("nestId")
-  );
+  ]);
   return c.json({ visibility: body.visibility });
 });
 
@@ -2111,7 +2243,7 @@ nodeRoutes.post("/", async (c) => {
     throw new ValidationError("title and content are required");
   }
   const nestId = c.req.param("nestId");
-  const authorEmail = getUserEmail(c);
+  const authorEmail = await getUserEmail(c);
   const { node } = await createNode(
     nestId,
     {
@@ -2124,7 +2256,7 @@ nodeRoutes.post("/", async (c) => {
     },
     authorEmail
   );
-  const resolved = resolveStewardsForNode(nestId, node.id);
+  const resolved = await resolveStewardsForNode(nestId, node.id);
   return c.json({
     node: toNodeResponse(node),
     stewards: resolved.length > 0 ? resolved.map((r) => ({
@@ -2137,8 +2269,8 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-HFQPGASU.js");
-  const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VIKF3VZB.js");
+  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
   );
@@ -2158,18 +2290,19 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
-  const allVersions = getVersions2(nestId, nodeId);
-  const approved = getApprovedVersion2(nestId, nodeId);
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-MUZYTYMW.js");
+  const allVersions = await getVersions2(nestId, nodeId);
+  const approved = await getApprovedVersion2(nestId, nodeId);
   const db = getDb();
-  const resolutions = db.prepare(
+  const resolutions = await db.all(
     `SELECT version, status, resolved_by, resolved_at
          FROM review_requests
         WHERE nest_id = ? AND node_id = ?
           AND status IN ('approved', 'rejected')
           AND resolved_by IS NOT NULL
-        ORDER BY resolved_at DESC`
-  ).all(nestId, nodeId);
+        ORDER BY resolved_at DESC`,
+    [nestId, nodeId]
+  );
   const byVersion = /* @__PURE__ */ new Map();
   for (const r of resolutions) {
     if (!byVersion.has(r.version)) {
@@ -2189,17 +2322,17 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-ZBYZYH5H.js");
-  const history = getReviewHistory2(nestId, nodeId);
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-QJ3FBOML.js");
+  const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
 nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { versions: versionManager } = engineCache.get(nestId);
+  const { versions: versionManager } = await engineCache.get(nestId);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json(
       { error: "Access denied \u2014 no steward assignment for this node" },
       403
@@ -2225,16 +2358,16 @@ nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
     { content, changeNote: `Restored from version ${targetVersion}` },
     userEmail
   );
-  trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
   return c.json({ ok: true, version, node: toNodeResponse(node) });
 });
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json(
       { error: "Access denied \u2014 no steward assignment for this node" },
       403
@@ -2264,8 +2397,8 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     }
   }
   const response = toNodeResponse(node);
-  if (isPublicReader(nestId, userId)) {
-    const approved = getApprovedVersion(nestId, nodeId);
+  if (await isPublicReader(nestId, userId)) {
+    const approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
       try {
         const raw = await versionManager.reconstructVersion(
@@ -2292,9 +2425,9 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       return c.json({ node: response });
     }
   }
-  response.status = node.pendingChange ? "external_edit_pending" : getDisplayStatus(nestId, nodeId);
+  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
   if (response.status === "pending_review") {
-    const pending = getPendingReview(nestId, nodeId);
+    const pending = await getPendingReview(nestId, nodeId);
     response.pendingReviewBy = pending?.requestedBy ?? null;
   }
   if (isMarkdownFormat(c)) {
@@ -2311,7 +2444,7 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
   const baseVersionHeader = c.req.header("X-Base-Version");
   if (baseVersionHeader) {
     const baseVersion = parseInt(baseVersionHeader, 10);
-    const conflict = checkConflict(nestId, nodeId, baseVersion);
+    const conflict = await checkConflict(nestId, nodeId, baseVersion);
     if (conflict.conflict) {
       return c.json(
         {
@@ -2326,7 +2459,7 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       );
     }
   }
-  const authorEmail = getUserEmail(c);
+  const authorEmail = await getUserEmail(c);
   const { node, version: responseVersion } = await updateNode(
     nestId,
     nodeId,
@@ -2345,8 +2478,8 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
 nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { storage } = engineCache.get(nestId);
-  if (isStewardshipEnabled(nestId) && getPendingReview(nestId, nodeId)) {
+  const { storage } = await engineCache.get(nestId);
+  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
     throw new LockedError(
       "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
     );
@@ -2356,30 +2489,34 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
-  removeNodeFromTagIndex(nestId, nodeId);
+  await removeNodeFromTagIndex(nestId, nodeId);
   const db = getDb();
-  db.transaction(() => {
-    db.prepare(
-      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
-      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
-      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?"
-    ).run(nestId, nodeId);
-    db.prepare(
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
       `DELETE FROM stewards
-       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`
-    ).run(nestId, nodeId);
-  })();
-  trackEvent("node.delete", { nestId, nodeId });
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+      [nestId, nodeId]
+    );
+  });
+  await trackEvent("node.delete", { nestId, nodeId });
   return c.json({ deleted: true });
 });
-function getUserEmail(c) {
+async function getUserEmail(c) {
   const userId = c.get("userId");
   const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   return user?.email || "anonymous@localhost";
 }
 
@@ -2473,11 +2610,12 @@ function projectThreadsToMarkdown(artifactTitle, threads) {
 }
 
 // src/annotations/service.ts
-function loadComments(threadId) {
+async function loadComments(threadId) {
   const db = getDb();
-  const rows = db.prepare(
-    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC"
-  ).all(threadId);
+  const rows = await db.all(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC",
+    [threadId]
+  );
   return rows.map((r) => ({
     id: r.id,
     author: r.author,
@@ -2485,7 +2623,7 @@ function loadComments(threadId) {
     createdAt: r.created_at
   }));
 }
-function rowToThread(row) {
+async function rowToThread(row) {
   let anchor = null;
   if (row.anchor_json) {
     try {
@@ -2505,19 +2643,20 @@ function rowToThread(row) {
     createdAt: row.created_at,
     resolvedBy: row.resolved_by,
     resolvedAt: row.resolved_at,
-    comments: loadComments(row.id)
+    comments: await loadComments(row.id)
   };
 }
-function getThreadRow(threadId) {
-  return getDb().prepare("SELECT * FROM annotation_threads WHERE id = ?").get(threadId);
+async function getThreadRow(threadId) {
+  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
 }
-function listThreads(nestId, nodeId) {
-  const rows = getDb().prepare(
-    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC"
-  ).all(nestId, nodeId);
-  return rows.map(rowToThread);
+async function listThreads(nestId, nodeId) {
+  const rows = await getDb().all(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC",
+    [nestId, nodeId]
+  );
+  return Promise.all(rows.map(rowToThread));
 }
-function createThread(nestId, nodeId, input, authorEmail) {
+async function createThread(nestId, nodeId, input, authorEmail) {
   const body = (input.body ?? "").trim();
   if (!body) {
     throw new Error("comment body is required");
@@ -2525,61 +2664,66 @@ function createThread(nestId, nodeId, input, authorEmail) {
   const db = getDb();
   const id = uuid3();
   const anchor = clampAnchor(input.anchor);
-  const snapshot = input.snapshotVersion ?? getApprovedVersion(nestId, nodeId) ?? null;
-  const tx = db.transaction(() => {
-    db.prepare(
+  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  await db.transaction(async (tx) => {
+    await tx.run(
       `INSERT INTO annotation_threads
          (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`
-    ).run(
-      id,
-      nestId,
-      nodeId,
-      snapshot,
-      anchor ? JSON.stringify(anchor) : null,
-      authorEmail
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+      [
+        id,
+        nestId,
+        nodeId,
+        snapshot,
+        anchor ? JSON.stringify(anchor) : null,
+        authorEmail
+      ]
+    );
+    await tx.run(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+      [uuid3(), id, authorEmail, body]
     );
-    db.prepare(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
-    ).run(uuid3(), id, authorEmail, body);
   });
-  tx();
-  return rowToThread(getThreadRow(id));
+  return rowToThread(await getThreadRow(id));
 }
-function getScopedThreadRow(threadId, nestId, nodeId) {
-  const row = getThreadRow(threadId);
+async function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = await getThreadRow(threadId);
   if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
     throw new NotFoundError(`Thread not found: ${threadId}`);
   }
   return row;
 }
-function addComment(nestId, nodeId, threadId, authorEmail, body) {
+async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   const trimmed = (body ?? "").trim();
   if (!trimmed) {
     throw new Error("comment body is required");
   }
-  getScopedThreadRow(threadId, nestId, nodeId);
-  getDb().prepare(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
-  ).run(uuid3(), threadId, authorEmail, trimmed);
-  return rowToThread(getThreadRow(threadId));
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  await getDb().run(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+    [uuid3(), threadId, authorEmail, trimmed]
+  );
+  return rowToThread(await getThreadRow(threadId));
 }
-function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
-  getScopedThreadRow(threadId, nestId, nodeId);
+async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  const db = getDb();
   if (status === "resolved") {
-    getDb().prepare(
-      "UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now') WHERE id = ?"
-    ).run(byEmail, threadId);
+    await db.run(
+      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
+      [byEmail, threadId]
+    );
   } else {
-    getDb().prepare(
-      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?"
-    ).run(threadId);
+    await db.run(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
+      [threadId]
+    );
   }
-  return rowToThread(getThreadRow(threadId));
+  return rowToThread(await getThreadRow(threadId));
 }
 async function readArtifact(nestId, nodeId, version) {
-  const { storage, versions: versionManager } = engineCache.get(nestId);
-  const target = version ?? getApprovedVersion(nestId, nodeId) ?? null;
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
   let title = nodeId;
   let type = null;
   let liveHtml = "";
@@ -2616,12 +2760,12 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
   try {
     let title = nodeId;
     try {
-      const { storage } = engineCache.get(nestId);
+      const { storage } = await engineCache.get(nestId);
       const node = await storage.readDocument(nodeId);
       title = node.frontmatter?.title || nodeId;
     } catch {
     }
-    const threads = listThreads(nestId, nodeId);
+    const threads = await listThreads(nestId, nodeId);
     const derivedTitle = `${title} \u2014 Annotations`;
     const markdown = projectThreadsToMarkdown(title, threads);
     const derivedId = derivedAnnotationsId(nodeId);
@@ -2669,25 +2813,25 @@ annotationRoutes.get("/:nodeId{.+}/annotations", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  return c.json({ threads: listThreads(nestId, nodeId) });
+  return c.json({ threads: await listThreads(nestId, nodeId) });
 });
 annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const input = await c.req.json();
   if (!input.body || !input.body.trim()) {
     throw new ValidationError("body is required");
   }
-  const thread = createThread(
+  const thread = await createThread(
     nestId,
     nodeId,
     {
@@ -2705,15 +2849,15 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) =
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const input = await c.req.json();
   if (!input.body || !input.body.trim()) {
     throw new ValidationError("body is required");
   }
-  const thread = addComment(nestId, nodeId, threadId, userEmail, input.body);
+  const thread = await addComment(nestId, nodeId, threadId, userEmail, input.body);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2722,11 +2866,11 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/resolve", async (c) =>
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  const thread = setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
+  const thread = await setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2735,11 +2879,11 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/reopen", async (c) =>
   const nodeId = getNodeId(c);
   const threadId = c.req.param("threadId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
-  const thread = setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
+  const thread = await setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 });
@@ -2747,8 +2891,8 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
     return c.json({ error: "Access denied" }, 403);
   }
   const vRaw = c.req.query("v");
@@ -2939,15 +3083,16 @@ function tokenizePrompt(prompt) {
   const words = prompt.toLowerCase().split(/[^a-z0-9_-]+/).filter(Boolean).filter((w) => w.length >= 3 && !STOPWORDS.has(w));
   return Array.from(new Set(words));
 }
-function compilePrompt(prompt, nestId, titles) {
+async function compilePrompt(prompt, nestId, titles) {
   const tokens = tokenizePrompt(prompt);
   if (tokens.length === 0) {
     return { selector: null, matchedTags: [], matchedTitles: [], unmatched: [] };
   }
   const db = getDb();
-  const tagRows = db.prepare(
-    "SELECT DISTINCT tag_name FROM node_tag_index WHERE nest_id = ?"
-  ).all(nestId);
+  const tagRows = await db.all(
+    "SELECT DISTINCT tag_name FROM node_tag_index WHERE nest_id = ?",
+    [nestId]
+  );
   const knownTags = new Set(tagRows.map((r) => r.tag_name));
   const matchedTags = /* @__PURE__ */ new Set();
   for (const token of tokens) {
@@ -2977,11 +3122,11 @@ function compilePrompt(prompt, nestId, titles) {
 
 // src/nodes/readable-body.ts
 async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
-  if (!isPublicReader(nestId, userId)) return workingBody;
-  const approved = getApprovedVersion(nestId, nodeId);
+  if (!await isPublicReader(nestId, userId)) return workingBody;
+  const approved = await getApprovedVersion(nestId, nodeId);
   if (approved == null) return "";
   try {
-    const { versions } = engineCache.get(nestId);
+    const { versions } = await engineCache.get(nestId);
     const raw = await versions.reconstructVersion(nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
@@ -2989,11 +3134,11 @@ async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
   }
 }
 async function resolveExportBody(nestId, nodeId, workingBody) {
-  if (!isStewardshipEnabled(nestId)) return workingBody;
-  const approved = getApprovedVersion(nestId, nodeId);
+  if (!await isStewardshipEnabled(nestId)) return workingBody;
+  const approved = await getApprovedVersion(nestId, nodeId);
   if (approved == null) return null;
   try {
-    const { versions } = engineCache.get(nestId);
+    const { versions } = await engineCache.get(nestId);
     const raw = await versions.reconstructVersion(nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
@@ -3016,9 +3161,9 @@ function extractWikiTargets(body) {
   return out;
 }
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const docs = await storage.discoverDocuments();
-  const accessible = filterAccessible(nestId, userId, userEmail, docs);
+  const accessible = await filterAccessible(nestId, userId, userEmail, docs);
   const idSet = new Set(accessible.map((d) => d.id));
   const titleToId = /* @__PURE__ */ new Map();
   for (const d of accessible) {
@@ -3054,7 +3199,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
     }
   }
   const tags = [...tagCounts.entries()].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count);
-  const exposeStewards = isStewardshipEnabled(nestId) && !isPublicReader(nestId, userId);
+  const exposeStewards = await isStewardshipEnabled(nestId) && !await isPublicReader(nestId, userId);
   const stewardRows = exposeStewards ? (await listStewards({ nestId })).filter(
     // Drop document-scoped rows whose node the caller can't see.
     (s) => s.scope !== "document" || idSet.has(s.nodePattern || "")
@@ -3148,7 +3293,7 @@ var queryRoutes = new Hono6();
 queryRoutes.get("/graph", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
+  const userEmail = await resolveCallerEmail(userId);
   const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
   const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
   return c.json(graph);
@@ -3173,7 +3318,7 @@ queryRoutes.post("/context", async (c) => {
     throw new ValidationError("prompt or selector is required");
   }
   const nestId = c.req.param("nestId");
-  const { query: queryEngine, storage } = engineCache.get(nestId);
+  const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const hops = body.hops ?? 2;
   const includeDrafts = body.include_drafts === true;
@@ -3183,7 +3328,7 @@ queryRoutes.post("/context", async (c) => {
   const allDocs = await storage.discoverDocuments();
   if (!selector && body.prompt) {
     const titles = allDocs.map((d) => d.frontmatter.title);
-    compileDetail = compilePrompt(body.prompt, nestId, titles);
+    compileDetail = await compilePrompt(body.prompt, nestId, titles);
     selector = compileDetail.selector;
     if (compileDetail.matchedTitles.length > 0) {
       const matchedLower = new Set(
@@ -3217,9 +3362,9 @@ queryRoutes.post("/context", async (c) => {
     }
   }
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
+  const userEmail = await resolveCallerEmail(userId);
   const beforePermission = documents.length;
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
   const permissionFiltered = beforePermission - accessible.length;
   const readable = await Promise.all(
     accessible.map(async (doc) => ({
@@ -3278,13 +3423,13 @@ queryRoutes.post("/query", async (c) => {
     throw new ValidationError("query is required");
   }
   const nestId = c.req.param("nestId");
-  const { query: queryEngine } = engineCache.get(nestId);
+  const { query: queryEngine } = await engineCache.get(nestId);
   const result = await queryEngine.query(body.query, {
     hops: body.hops ?? 2
   });
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, result.documents);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, result.documents);
   return c.json({
     query: body.query,
     count: accessible.length,
@@ -3303,7 +3448,7 @@ queryRoutes.get("/search", async (c) => {
     throw new ValidationError("q query parameter is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const documents = await storage.discoverDocuments();
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   const matches = documents.filter((node) => {
@@ -3316,8 +3461,8 @@ queryRoutes.get("/search", async (c) => {
     return terms.every((term) => haystack.includes(term));
   });
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, matches);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, matches);
   return c.json({
     query: q,
     count: accessible.length,
@@ -3331,7 +3476,7 @@ queryRoutes.get("/search", async (c) => {
   });
 });
 queryRoutes.get("/overview", async (c) => {
-  const { storage } = engineCache.get(c.req.param("nestId"));
+  const { storage } = await engineCache.get(c.req.param("nestId"));
   const documents = await storage.discoverDocuments();
   const types = {};
   const tags = {};
@@ -3356,7 +3501,7 @@ queryRoutes.get("/overview", async (c) => {
   });
 });
 queryRoutes.get("/context", async (c) => {
-  const { storage } = engineCache.get(c.req.param("nestId"));
+  const { storage } = await engineCache.get(c.req.param("nestId"));
   const content = await storage.readContextMd();
   return c.json({ content: content || "" });
 });
@@ -3365,7 +3510,7 @@ queryRoutes.get("/export", async (c) => {
     throw new ValidationError("format=markdown is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage, query: queryEngine } = engineCache.get(nestId);
+  const { storage, query: queryEngine } = await engineCache.get(nestId);
   const selector = c.req.query("selector")?.trim() || null;
   let documents;
   if (selector) {
@@ -3375,9 +3520,9 @@ queryRoutes.get("/export", async (c) => {
     documents = await storage.discoverDocuments();
   }
   const userId = c.get("userId");
-  const userEmail = resolveCallerEmail(userId);
-  const accessible = filterAccessible(nestId, userId, userEmail, documents);
-  const governed = isStewardshipEnabled(nestId);
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, documents);
+  const governed = await isStewardshipEnabled(nestId);
   const resolved = await Promise.all(
     accessible.map(async (n) => {
       const body = await resolveExportBody(nestId, n.id, n.body || "");
@@ -3424,7 +3569,7 @@ queryRoutes.post("/publish", async (c) => {
     throw new ValidationError("documents array or context_md is required");
   }
   const nestId = c.req.param("nestId");
-  const { storage } = engineCache.get(nestId);
+  const { storage } = await engineCache.get(nestId);
   const created = [];
   if (body.context_md) {
     await storage.writeContextMd(body.context_md);
@@ -3456,7 +3601,7 @@ queryRoutes.post("/publish", async (c) => {
     };
     const serialized = serializeDocument2(node);
     await storage.writeDocument(id, serialized);
-    syncNodeTags(nestId, id, tags);
+    await syncNodeTags(nestId, id, tags);
     created.push(id);
   }
   trackEvent("nest.publish", { nestId, count: created.length });
@@ -3726,8 +3871,8 @@ var TOOL_DEFINITIONS = [
   }
 ];
 async function resolveLlmBody(ctx, node) {
-  if (!isStewardshipEnabled(ctx.nestId)) return node.body || "";
-  const approved = getApprovedVersion(ctx.nestId, node.id);
+  if (!await isStewardshipEnabled(ctx.nestId)) return node.body || "";
+  const approved = await getApprovedVersion(ctx.nestId, node.id);
   if (approved == null) return null;
   try {
     return await ctx.versionManager.reconstructVersion(node.id, approved);
@@ -3866,7 +4011,7 @@ ${n.body || ""}`;
       return resolved.join("\n\n---\n\n") || "No nodes resolved.";
     }
     case "context_create": {
-      if (!canCreateInNest(nestId, userEmail)) {
+      if (!await canCreateInNest(nestId, userEmail)) {
         return "You don't have permission to create documents in this nest.";
       }
       const { node } = await createNode(
@@ -3888,7 +4033,7 @@ ${n.body || ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const editCheck = canUserEdit(nestId, node.id, userEmail);
+      const editCheck = await canUserEdit(nestId, node.id, userEmail);
       if (!editCheck.allowed) {
         return `You don't have permission to edit "${args.title}": ${editCheck.reason}`;
       }
@@ -3912,7 +4057,7 @@ ${n.body || ""}`;
           (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
         );
         const nodeId = node?.id || "";
-        const resolved = resolveStewardsForNode(ctx.nestId, nodeId);
+        const resolved = await resolveStewardsForNode(ctx.nestId, nodeId);
         if (resolved.length === 0) {
           return `No stewards configured for "${args.title}". Changes are auto-approved.`;
         }
@@ -3968,14 +4113,14 @@ ${list}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const submitCheck = canUserEdit(ctx.nestId, node.id, userEmail);
+      const submitCheck = await canUserEdit(ctx.nestId, node.id, userEmail);
       if (!submitCheck.allowed) {
         return `You don't have permission to submit "${args.title}" for review: ${submitCheck.reason}`;
       }
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       if (currentVersion === 0) return `No versions found for "${args.title}"`;
       try {
-        const request = submitForReview({
+        const request = await submitForReview({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -3983,7 +4128,7 @@ ${list}`;
           note: args.note,
           priority: args.priority
         });
-        const resolved = resolveStewardsForNode(
+        const resolved = await resolveStewardsForNode(
           ctx.nestId,
           node.id
         );
@@ -4002,7 +4147,7 @@ ${resolved.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` : "
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
         const request = await approve({
           nestId: ctx.nestId,
@@ -4023,9 +4168,9 @@ Note: ${args.note}` : ""}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const currentVersion = getCurrentVersion(ctx.nestId, node.id);
+      const currentVersion = await getCurrentVersion(ctx.nestId, node.id);
       try {
-        const request = reject({
+        const request = await reject({
           nestId: ctx.nestId,
           nodeId: node.id,
           version: currentVersion,
@@ -4044,8 +4189,8 @@ Reason: ${args.note}`;
         (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
       );
       if (!node) return `Node not found: ${args.title}`;
-      const allVersions = getVersions(ctx.nestId, node.id);
-      const approved = getApprovedVersion(ctx.nestId, node.id);
+      const allVersions = await getVersions(ctx.nestId, node.id);
+      const approved = await getApprovedVersion(ctx.nestId, node.id);
       if (allVersions.length === 0) {
         return `No version history for "${args.title}".`;
       }
@@ -4081,7 +4226,7 @@ ${list}`;
       }
     }
     case "context_share_nest": {
-      const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
+      const roles = await resolveUserRoles(ctx.nestId, ctx.userEmail);
       if (!canManageWith(roles)) {
         return "You don't have permission to share this nest via this tool (admin only). You can still invite from the UI with write access, or ask a nest admin.";
       }
@@ -4100,7 +4245,7 @@ ${list}`;
       }
     }
     case "context_unsynced_list": {
-      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
         return "You don't have permission to list unsynced folders. Server admin only.";
       }
       const folders = listUnsyncedFolders();
@@ -4113,7 +4258,7 @@ ${list}`;
 ${list}`;
     }
     case "context_sync_folder": {
-      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
         return "You don't have permission to sync folders. Server admin only.";
       }
       try {
@@ -4135,9 +4280,9 @@ ${list}`;
 // src/mcp/routes.ts
 import { z } from "zod";
 var mcpRoutes = new Hono7();
-function getUserEmail2(userId) {
+async function getUserEmail2(userId) {
   const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   return user?.email || "anonymous@localhost";
 }
 function createMcpServerForNest(nestId, userId, userEmail) {
@@ -4145,7 +4290,6 @@ function createMcpServerForNest(nestId, userId, userEmail) {
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
   );
-  const engine = engineCache.get(nestId);
   for (const tool of TOOL_DEFINITIONS) {
     const props = tool.inputSchema.properties || {};
     const required = tool.inputSchema.required || [];
@@ -4160,6 +4304,7 @@ function createMcpServerForNest(nestId, userId, userEmail) {
       shape[key] = field;
     }
     server.tool(tool.name, tool.description, shape, async (args) => {
+      const engine = await engineCache.get(nestId);
       const text = await handleToolCall(tool.name, args, {
         storage: engine.storage,
         queryEngine: engine.query,
@@ -4176,7 +4321,7 @@ function createMcpServerForNest(nestId, userId, userEmail) {
 mcpRoutes.all("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
-  const userEmail = getUserEmail2(userId);
+  const userEmail = await getUserEmail2(userId);
   const server = createMcpServerForNest(nestId, userId, userEmail);
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
@@ -4197,41 +4342,43 @@ import { Hono as Hono8 } from "hono";
 
 // src/governance/comment-service.ts
 import { v4 as uuid4 } from "uuid";
-function createComment(params) {
+async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
   if (!body) {
     throw new Error("Comment body is required");
   }
   if (params.parentId) {
-    const parent = db.prepare(
-      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
-    ).get(params.parentId, params.nestId, params.nodeId);
+    const parent = await db.get(
+      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?",
+      [params.parentId, params.nestId, params.nodeId]
+    );
     if (!parent) {
       throw new Error("Parent comment not found on this node");
     }
   }
   const id = uuid4();
-  db.prepare(
+  await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
         parent_id, author, body)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    id,
-    params.nestId,
-    params.nodeId,
-    params.version ?? null,
-    params.anchor?.start ?? null,
-    params.anchor?.end ?? null,
-    params.anchor?.text ?? null,
-    params.parentId ?? null,
-    params.author,
-    body
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      id,
+      params.nestId,
+      params.nodeId,
+      params.version ?? null,
+      params.anchor?.start ?? null,
+      params.anchor?.end ?? null,
+      params.anchor?.text ?? null,
+      params.parentId ?? null,
+      params.author,
+      body
+    ]
   );
-  return getComment(id);
+  return await getComment(id);
 }
-function listComments(nestId, nodeId, opts = {}) {
+async function listComments(nestId, nodeId, opts = {}) {
   const db = getDb();
   const args = [nestId, nodeId];
   let statusClause = "";
@@ -4239,35 +4386,38 @@ function listComments(nestId, nodeId, opts = {}) {
     statusClause = " AND status = ?";
     args.push(opts.status);
   }
-  const rows = db.prepare(
+  const rows = await db.all(
     `SELECT * FROM comments
         WHERE nest_id = ? AND node_id = ?${statusClause}
-        ORDER BY created_at ASC`
-  ).all(...args);
+        ORDER BY created_at ASC`,
+    args
+  );
   return rows.map(rowToComment);
 }
-function getComment(id) {
+async function getComment(id) {
   const db = getDb();
-  const row = db.prepare("SELECT * FROM comments WHERE id = ?").get(id);
+  const row = await db.get("SELECT * FROM comments WHERE id = ?", [id]);
   return row ? rowToComment(row) : null;
 }
-function resolveComment(params) {
+async function resolveComment(params) {
   const db = getDb();
-  const existing = db.prepare(
-    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
-  ).get(params.commentId, params.nestId, params.nodeId);
+  const existing = await db.get(
+    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?",
+    [params.commentId, params.nestId, params.nodeId]
+  );
   if (!existing) {
     throw new Error("Comment not found");
   }
   if (existing.status === "resolved") {
     throw new Error("Comment is already resolved");
   }
-  db.prepare(
+  await db.run(
     `UPDATE comments
-        SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now')
-      WHERE id = ?`
-  ).run(params.resolvedBy, params.commentId);
-  return getComment(params.commentId);
+        SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)}
+      WHERE id = ?`,
+    [params.resolvedBy, params.commentId]
+  );
+  return await getComment(params.commentId);
 }
 async function getActivity(params) {
   const db = getDb();
@@ -4275,13 +4425,14 @@ async function getActivity(params) {
   const entries = [];
   const nodeFilter = params.nodeId ? " AND node_id = ?" : "";
   const baseArgs = params.nodeId ? [params.nestId, params.nodeId] : [params.nestId];
-  const commentRows = db.prepare(
+  const commentRows = await db.all(
     `SELECT id, node_id, author, body, status, created_at, resolved_by, resolved_at
          FROM comments
         WHERE nest_id = ?${nodeFilter}
         ORDER BY COALESCE(resolved_at, created_at) DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of commentRows) {
     entries.push({
       type: "comment",
@@ -4302,13 +4453,14 @@ async function getActivity(params) {
       });
     }
   }
-  const versionRows = db.prepare(
+  const versionRows = await db.all(
     `SELECT node_id, version, author, change_note, created_at
          FROM node_versions
         WHERE nest_id = ?${nodeFilter}
         ORDER BY created_at DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of versionRows) {
     entries.push({
       type: "edit",
@@ -4319,13 +4471,14 @@ async function getActivity(params) {
       refId: String(r.version)
     });
   }
-  const reviewRows = db.prepare(
+  const reviewRows = await db.all(
     `SELECT id, node_id, requested_by, requested_at, status, resolved_by, resolved_at
          FROM review_requests
         WHERE nest_id = ?${nodeFilter}
         ORDER BY COALESCE(resolved_at, requested_at) DESC
-        LIMIT ?`
-  ).all(...baseArgs, limit);
+        LIMIT ?`,
+    [...baseArgs, limit]
+  );
   for (const r of reviewRows) {
     entries.push({
       type: "review_requested",
@@ -4468,8 +4621,7 @@ function parseEntry(str) {
   return entry;
 }
 function loadStewardsConfig(nestId) {
-  const dataRoot = config.DATA_ROOT;
-  const nestPath = join3(dataRoot, "nests", nestId);
+  const nestPath = resolveNestPath(nestId);
   const candidates = [
     join3(nestPath, "stewards.yaml"),
     join3(nestPath, "stewards.yml"),
@@ -4501,24 +4653,25 @@ governanceRoutes.get("/stewards", async (c) => {
     search: search || void 0
   });
   const cache = /* @__PURE__ */ new Map();
-  const enriched = stewards.map((s) => {
+  const enriched = [];
+  for (const s of stewards) {
     const key = s.userEmail.toLowerCase();
     let merged = cache.get(key);
     if (!merged) {
       merged = {
-        collaboratorRole: getCollaboratorRole(nestId, s.userEmail),
-        roles: resolveUserRoles(nestId, s.userEmail)
+        collaboratorRole: await getCollaboratorRole(nestId, s.userEmail),
+        roles: await resolveUserRoles(nestId, s.userEmail)
       };
       cache.set(key, merged);
     }
-    return { ...s, ...merged };
-  });
+    enriched.push({ ...s, ...merged });
+  }
   return c.json({ stewards: enriched });
 });
 governanceRoutes.post("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const body = await c.req.json();
-  const assignedBy = getUserEmail3(c);
+  const assignedBy = await getUserEmail3(c);
   if (!body.scope) throw new ValidationError("scope is required");
   if (body.scope === "folder") {
     throw new ValidationError(
@@ -4560,7 +4713,7 @@ governanceRoutes.patch("/stewards/:stewardId", async (c) => {
   if (!body.role && !body.scope) {
     throw new ValidationError("role or scope is required");
   }
-  const steward = updateSteward(stewardId, {
+  const steward = await updateSteward(stewardId, {
     role: body.role,
     scope: body.scope,
     documentId: body.nodePattern,
@@ -4570,7 +4723,7 @@ governanceRoutes.patch("/stewards/:stewardId", async (c) => {
 });
 governanceRoutes.delete("/stewards/:stewardId", async (c) => {
   const stewardId = c.req.param("stewardId");
-  removeSteward(stewardId);
+  await removeSteward(stewardId);
   return c.json({ removed: true });
 });
 governanceRoutes.post("/stewards/sync", async (c) => {
@@ -4579,7 +4732,7 @@ governanceRoutes.post("/stewards/sync", async (c) => {
   if (!stewardsConfig) {
     return c.json({ synced: 0, message: "No stewards.yaml found" });
   }
-  const count = syncFromConfig(nestId, stewardsConfig);
+  const count = await syncFromConfig(nestId, stewardsConfig);
   return c.json({ synced: count });
 });
 governanceRoutes.get("/review-queue", async (c) => {
@@ -4593,16 +4746,17 @@ governanceRoutes.get("/review-queue", async (c) => {
     limit,
     offset
   });
-  const email = getUserEmail3(c);
+  const email = await getUserEmail3(c);
   const canReviewCache = /* @__PURE__ */ new Map();
-  const requests = result.requests.map((r) => {
+  const requests = [];
+  for (const r of result.requests) {
     let canReview = canReviewCache.get(r.nodeId);
     if (canReview === void 0) {
-      canReview = canUserApprove(nestId, r.nodeId, email).allowed;
+      canReview = (await canUserApprove(nestId, r.nodeId, email)).allowed;
       canReviewCache.set(r.nodeId, canReview);
     }
-    return { ...r, canReview };
-  });
+    requests.push({ ...r, canReview });
+  }
   return c.json({ ...result, requests });
 });
 governanceRoutes.get("/external-edits", async (c) => {
@@ -4616,7 +4770,7 @@ governanceRoutes.get("/external-edits", async (c) => {
 });
 governanceRoutes.post("/external-edits/scan", async (c) => {
   const nestId = c.req.param("nestId");
-  const actor = getUserEmail3(c);
+  const actor = await getUserEmail3(c);
   const result = await scanNestForDrift(nestId, actor);
   return c.json(result);
 });
@@ -4630,7 +4784,7 @@ var governanceNodeRoutes = new Hono8();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { stewards: resolved, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback(nestId, nodeId);
+  const { stewards: resolved, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback(nestId, nodeId);
   return c.json({
     nodeId,
     stewards: resolved.map((r) => ({
@@ -4647,9 +4801,9 @@ governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const allVersions = getVersions(nestId, nodeId);
-  const approved = getApprovedVersion(nestId, nodeId);
-  const { versions: versionManager } = engineCache.get(nestId);
+  const allVersions = await getVersions(nestId, nodeId);
+  const approved = await getApprovedVersion(nestId, nodeId);
+  const { versions: versionManager } = await engineCache.get(nestId);
   const withContent = await Promise.all(
     allVersions.map(async (v) => {
       try {
@@ -4669,14 +4823,14 @@ governanceNodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const history = getReviewHistory(nestId, nodeId);
+  const history = await getReviewHistory(nestId, nodeId);
   return c.json({ reviews: history });
 });
 governanceNodeRoutes.get("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const status = c.req.query("status");
-  const list = listComments(nestId, nodeId, {
+  const list = await listComments(nestId, nodeId, {
     status: status === "open" || status === "resolved" ? status : void 0
   });
   return c.json({ comments: list });
@@ -4685,9 +4839,9 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const author = getUserEmail3(c);
+  const author = await getUserEmail3(c);
   try {
-    const comment = createComment({
+    const comment = await createComment({
       nestId,
       nodeId,
       author,
@@ -4709,9 +4863,9 @@ governanceNodeRoutes.post(
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
     const commentId = c.req.param("commentId");
-    const resolvedBy = getUserEmail3(c);
+    const resolvedBy = await getUserEmail3(c);
     try {
-      const comment = resolveComment({
+      const comment = await resolveComment({
         nestId,
         nodeId,
         commentId,
@@ -4738,14 +4892,14 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const currentVersion = getCurrentVersion(nestId, nodeId);
+  const currentVersion = await getCurrentVersion(nestId, nodeId);
   if (currentVersion === 0) {
     throw new ValidationError("Node has no versions to review");
   }
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   let request;
   try {
-    request = submitForReview({
+    request = await submitForReview({
       nestId,
       nodeId,
       version: currentVersion,
@@ -4760,7 +4914,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     }
     throw err;
   }
-  const resolved = resolveStewardsForNode(nestId, nodeId);
+  const resolved = await resolveStewardsForNode(nestId, nodeId);
   return c.json(
     {
       review: request,
@@ -4777,13 +4931,13 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
     const request = await approve({
       nestId,
       nodeId,
-      version: getCurrentVersion(nestId, nodeId),
+      version: await getCurrentVersion(nestId, nodeId),
       approvedBy: userEmail,
       note: body.note,
       override: body.override && isAdmin
@@ -4800,12 +4954,12 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
   if (!body.note) {
     throw new ValidationError("Rejection note is required");
   }
-  const userEmail = getUserEmail3(c);
+  const userEmail = await getUserEmail3(c);
   try {
-    const request = reject({
+    const request = await reject({
       nestId,
       nodeId,
-      version: getCurrentVersion(nestId, nodeId),
+      version: await getCurrentVersion(nestId, nodeId),
       rejectedBy: userEmail,
       note: body.note
     });
@@ -4817,20 +4971,20 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/can-access", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserAccess(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserAccess(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserApprove(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserApprove(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  return c.json(canUserEdit(nestId, nodeId, userEmail));
+  const userEmail = await getUserEmail3(c);
+  return c.json(await canUserEdit(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4862,7 +5016,7 @@ governanceNodeRoutes.post(
     const nodeId = c.req.param("nodeId");
     const suggestionId = c.req.param("suggestionId");
     const body = await c.req.json().catch(() => ({}));
-    const actor = getUserEmail3(c);
+    const actor = await getUserEmail3(c);
     try {
       const result = await approveExternalEdit({
         nestId,
@@ -4898,7 +5052,7 @@ governanceNodeRoutes.post(
     if (!body.reason) {
       throw new ValidationError("Rejection reason is required");
     }
-    const actor = getUserEmail3(c);
+    const actor = await getUserEmail3(c);
     try {
       const result = await rejectExternalEdit({
         nestId,
@@ -4919,31 +5073,38 @@ governanceNodeRoutes.post(
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = getUserEmail3(c);
-  const request = cancelReview({
+  const userEmail = await getUserEmail3(c);
+  const request = await cancelReview({
     nestId,
     nodeId,
     cancelledBy: userEmail
   });
   return c.json({ review: request });
 });
-function getUserEmail3(c) {
+async function getUserEmail3(c) {
   const userId = c.get("userId");
   const db = getDb();
-  const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
+  const user = await db.get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
   return user?.email || "anonymous@localhost";
 }
 
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
-function ensureAnonymousUser() {
+async function ensureAnonymousUser() {
   const db = getDb();
-  const exists = db.prepare("SELECT id FROM users WHERE id = ?").get(ANON_USER_ID);
+  const exists = await db.get(
+    "SELECT id FROM users WHERE id = ?",
+    [ANON_USER_ID]
+  );
   if (!exists) {
     const placeholder = bcrypt.hashSync("anon-no-login", 4);
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(ANON_USER_ID, ANON_EMAIL, "Admin", placeholder);
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [ANON_USER_ID, ANON_EMAIL, "Admin", placeholder]
+    );
   }
   return ANON_USER_ID;
 }
@@ -4961,7 +5122,7 @@ var UI_DIR_CANDIDATES = [
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
-  const anonId = ensureAnonymousUser();
+  const anonId = await ensureAnonymousUser();
   c.set("userId", anonId);
   c.set("nestScope", null);
   await next();
@@ -4978,13 +5139,13 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     return authMiddleware(c, next);
   }
   if (config.AUTH_MODE === "open") {
-    const anonId = ensureAnonymousUser();
+    const anonId = await ensureAnonymousUser();
     c.set("userId", anonId);
     c.set("nestScope", null);
     return next();
   }
   if (isPublicReadEligiblePath(c.req.method, c.req.path)) {
-    const anonId = ensureAnonymousUser();
+    const anonId = await ensureAnonymousUser();
     c.set("userId", anonId);
     c.set("nestScope", null);
     return next();
@@ -5105,22 +5266,93 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
+  app.use("/admin/settings", flexAuthMiddleware);
+  const adminSettingsAllowed = async (c) => config.AUTH_MODE === "open" || await isLicenseAdminUserId(c.get("userId"));
+  const currentServerSettings = () => ({
+    promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
+    logo_url: config.LOGO_URL,
+    telemetry_enabled: config.TELEMETRY_ENABLED,
+    public_base_url: config.PUBLIC_BASE_URL,
+    max_body_bytes: config.MAX_BODY_BYTES
+  });
+  app.get("/admin/settings", async (c) => {
+    if (!await adminSettingsAllowed(c))
+      return c.json({ error: "Only the server admin can view this." }, 403);
+    return c.json(currentServerSettings());
+  });
+  app.patch("/admin/settings", async (c) => {
+    if (!await adminSettingsAllowed(c))
+      return c.json({ error: "Only the server admin can change this." }, 403);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const errors = [];
+    const pending = [];
+    if ("promptowl_sign_in_gate" in body) {
+      const v = String(body.promptowl_sign_in_gate ?? "").trim().toLowerCase();
+      if (!["open", "admin-only", "disabled"].includes(v))
+        errors.push("promptowl_sign_in_gate must be open | admin-only | disabled");
+      else pending.push({ name: "PROMPTOWL_SIGN_IN_GATE", value: v });
+    }
+    if ("logo_url" in body) {
+      const v = String(body.logo_url ?? "").trim();
+      pending.push({ name: "LOGO_URL", value: v || null });
+    }
+    if ("public_base_url" in body) {
+      const v = String(body.public_base_url ?? "").trim().replace(/\/$/, "");
+      pending.push({ name: "PUBLIC_BASE_URL", value: v || null });
+    }
+    if ("telemetry_enabled" in body) {
+      pending.push({ name: "TELEMETRY_ENABLED", value: body.telemetry_enabled ? "true" : "false" });
+    }
+    if ("max_body_bytes" in body) {
+      const n = Number(body.max_body_bytes);
+      if (!Number.isFinite(n) || n < 1024 * 1024 || n > 500 * 1024 * 1024)
+        errors.push("max_body_bytes must be between 1MB and 500MB");
+      else pending.push({ name: "MAX_BODY_BYTES", value: String(Math.floor(n)) });
+    }
+    if (errors.length)
+      return c.json({ error: errors.join("; "), settings: currentServerSettings() }, 400);
+    for (const { name, value } of pending) {
+      try {
+        upsertEnvVar(config.ENV_FILE_PATH, name, value);
+      } catch (e) {
+        return c.json(
+          {
+            error: `Could not persist ${name}: ${e instanceof Error ? e.message : String(e)}`,
+            settings: currentServerSettings()
+          },
+          500
+        );
+      }
+      if (value === null) delete process.env[name];
+      else process.env[name] = value;
+    }
+    return c.json({ settings: currentServerSettings() });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
     const userId = c.get("userId");
-    const userEmail = resolveCallerEmail(userId);
-    const visibleNests = [...listNests(userId), ...listSharedNests(userId)];
+    const userEmail = await resolveCallerEmail(userId);
+    const owned = await listNests(userId);
+    const sharedNests = await listSharedNests(userId);
+    const visibleNests = [...owned, ...sharedNests];
     let documents = 0;
     for (const nest of visibleNests) {
       try {
-        const { storage } = engineCache.get(nest.id);
+        const { storage } = await engineCache.get(nest.id);
         const docs = await storage.discoverDocuments();
-        documents += filterAccessible(nest.id, userId, userEmail, docs).length;
+        documents += (await filterAccessible(nest.id, userId, userEmail, docs)).length;
       } catch {
       }
     }
-    const usersRow = db.prepare("SELECT COUNT(*) as c FROM users").get();
+    const usersRow = await db.get(
+      "SELECT COUNT(*) as c FROM users"
+    );
     return c.json({
       nests: visibleNests.length,
       documents,
@@ -5174,7 +5406,7 @@ function createApp() {
       c.set("nestPermission", "owner");
       return next();
     }
-    const permission = resolveNestPermission(nestId, userId);
+    const permission = await resolveNestPermission(nestId, userId);
     if (permission === "none") {
       return c.json({ error: "Nest not found" }, 404);
     }
@@ -5184,7 +5416,7 @@ function createApp() {
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
-    if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
+    if (isStewardRoster && !canManageStewards(await resolveCallerEmail(userId))) {
       return c.json(
         {
           error: "You don't have permission to manage stewards. Only the super admin can do this."
@@ -5203,7 +5435,7 @@ function createApp() {
     const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
     let stewardEditorBypass = false;
     if (required === "write" && permission === "read" && parts[1] === "nodes") {
-      const userEmail = resolveCallerEmail(userId);
+      const userEmail = await resolveCallerEmail(userId);
       if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
         const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
         const rawNodeId = idParts.join("/");
@@ -5212,12 +5444,12 @@ function createApp() {
           nodeId = decodeURIComponent(rawNodeId);
         } catch {
         }
-        const resolved = resolveStewardsForNode(nestId, nodeId);
+        const resolved = await resolveStewardsForNode(nestId, nodeId);
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor"
         );
       } else if (parts.length === 2 && c.req.method === "POST") {
-        const resolved = resolveStewardsForNode(nestId, "");
+        const resolved = await resolveStewardsForNode(nestId, "");
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && r.steward.scope === "nest"
         );
@@ -5325,28 +5557,30 @@ function createApp() {
 
 // src/db/backfill.ts
 import { NestStorage } from "@promptowl/contextnest-engine";
-import { join as join5 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
-  const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
+  const already = await db.get(
+    "SELECT id FROM schema_migrations WHERE id = ?",
+    [MIGRATION_ID]
+  );
   if (already) return;
-  const nests = db.prepare("SELECT id FROM nests").all();
-  const insert = db.prepare(
-    `INSERT OR IGNORE INTO node_versions
+  const nests = await db.all("SELECT id FROM nests");
+  const insertSql = insertOrIgnore(
+    db,
+    `INSERT INTO node_versions
        (nest_id, node_id, version, content_hash, author, status, change_note, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
   );
-  const approvedPin = db.prepare(
-    `INSERT OR REPLACE INTO approved_versions
+  const approvedPinSql = `INSERT INTO approved_versions
        (nest_id, node_id, approved_version, approved_by, approved_at)
-     VALUES (?, ?, ?, ?, COALESCE(
-       (SELECT approved_at FROM approved_versions WHERE nest_id = ? AND node_id = ?),
-       datetime('now')))`
-  );
+     VALUES (?, ?, ?, ?, ${nowExpr(db)})
+     ON CONFLICT (nest_id, node_id) DO UPDATE SET
+       approved_version = excluded.approved_version,
+       approved_by = excluded.approved_by`;
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath = join5(config.DATA_ROOT, "nests", nestId);
+    const nestPath = resolveNestPath(nestId);
     const storage = new NestStorage(nestPath);
     let docs;
     try {
@@ -5367,15 +5601,16 @@ async function backfillNodeVersionsFromHistory(db) {
         history = null;
       }
       if (!history || history.versions.length === 0) continue;
-      const existing = db.prepare(
-        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`
-      ).all(nestId, doc.id);
+      const existing = await db.all(
+        `SELECT version FROM node_versions WHERE nest_id = ? AND node_id = ?`,
+        [nestId, doc.id]
+      );
       const known = new Set(existing.map((r) => r.version));
       const tagsJson = doc.frontmatter.tags ? JSON.stringify(doc.frontmatter.tags) : null;
       const latestVersion = history.versions[history.versions.length - 1].version;
       for (const entry of history.versions) {
         if (known.has(entry.version)) continue;
-        insert.run(
+        await db.run(insertSql, [
           nestId,
           doc.id,
           entry.version,
@@ -5384,33 +5619,33 @@ async function backfillNodeVersionsFromHistory(db) {
           "approved",
           entry.note || null,
           entry.edited_at || (/* @__PURE__ */ new Date()).toISOString()
-        );
+        ]);
         totalInserted += 1;
       }
-      const pin = db.prepare(
-        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`
-      ).get(nestId, doc.id);
+      const pin = await db.get(
+        `SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?`,
+        [nestId, doc.id]
+      );
       if (!pin || pin.approved_version < latestVersion) {
-        approvedPin.run(
+        await db.run(approvedPinSql, [
           nestId,
           doc.id,
           latestVersion,
-          history.versions[history.versions.length - 1].edited_by || "system:backfill",
-          nestId,
-          doc.id
-        );
+          history.versions[history.versions.length - 1].edited_by || "system:backfill"
+        ]);
       }
       if (tagsJson) {
-        const updateTags = db.prepare(
+        await db.run(
           `UPDATE node_versions SET tags_json = ?
-           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`
+           WHERE nest_id = ? AND node_id = ? AND version = ? AND tags_json IS NULL`,
+          [tagsJson, nestId, doc.id, latestVersion]
         );
-        updateTags.run(tagsJson, nestId, doc.id, latestVersion);
       }
     }
   }
-  db.prepare("INSERT OR IGNORE INTO schema_migrations (id) VALUES (?)").run(
-    MIGRATION_ID
+  await db.run(
+    insertOrIgnore(db, "INSERT INTO schema_migrations (id) VALUES (?)"),
+    [MIGRATION_ID]
   );
   console.log(
     `[backfill] node_versions: scanned ${totalDocs} docs across ${nests.length} nests, inserted ${totalInserted} rows`
@@ -5419,7 +5654,7 @@ async function backfillNodeVersionsFromHistory(db) {
 
 // src/index.ts
 async function main() {
-  const db = getDb();
+  const db = await initDb();
   try {
     await backfillNodeVersionsFromHistory(db);
   } catch (err) {
@@ -5453,7 +5688,8 @@ async function main() {
   }
   const app = createApp();
   startLicenseSafetyPoll();
-  const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;
+  const driftRaw = process.env.DRIFT_SCAN_INTERVAL_MS;
+  const driftScanIntervalMs = driftRaw != null && driftRaw !== "" && Number.isFinite(Number(driftRaw)) ? Number(driftRaw) : 3e4;
   if (driftScanIntervalMs > 0) {
     startDriftScanner(driftScanIntervalMs);
   }
@@ -5464,11 +5700,13 @@ async function main() {
     licensed: license.valid
   });
   const authDesc = config.AUTH_MODE === "open" ? "open (no auth \u2014 single-user / LAN only)" : "key (API key required on every request)";
+  const dbDesc = db.dialect === "postgres" ? `postgres (${config.CLOUD_SQL_CONNECTION_NAME ? `cloudsql ${config.CLOUD_SQL_CONNECTION_NAME}` : config.DATABASE_URL ? "DATABASE_URL" : `${config.DB_HOST || "localhost"}:${config.DB_PORT}/${config.DB_NAME}`})` : `sqlite (${config.DATABASE_PATH})`;
   console.log(`
   ContextNest Community Server v0.1.0
   \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
   Port:      ${config.PORT}
   Data:      ${config.DATA_ROOT}
+  Database:  ${dbDesc}
   License:   ${license.valid ? `${license.tier}${license.org ? ` (${license.org})` : ""}` : "unlicensed (register at promptowl.ai)"}
   Auth:      ${authDesc}
   Telemetry: ${config.TELEMETRY_ENABLED ? "on" : "off"}