@promptowl/contextnest-community 1.9.0 → 1.11.0

package/dist/{chunk-BYS4HDME.js → chunk-F7EKYNXG.js}

@@ -1,7 +1,12 @@
 import {
   ConflictError,
+  ForbiddenError,
+  NotFoundError,
   ValidationError
-} from "./chunk-3JTODC3Y.js";
+} from "./chunk-GUNJTORH.js";
+import {
+  normalizeEmail
+} from "./chunk-FRQJWGN3.js";
 import {
   insertOrReplace,
   nowExpr
@@ -9,18 +14,25 @@ import {
 import {
   config,
   getDb
-} from "./chunk-DPHV6Q26.js";
+} from "./chunk-3M7677XW.js";
 import {
   ANON_USER_ID
 } from "./chunk-SLTQACJW.js";
 
 // src/governance/stewardship-service.ts
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 
 // src/governance/access-service.ts
 import { readFileSync, existsSync } from "fs";
 import { join } from "path";
 var accessConfig = null;
+var grantedSuperAdmins = /* @__PURE__ */ new Set();
+async function loadGrantedSuperAdmins() {
+  const rows = await getDb().all(
+    "SELECT email FROM super_admins"
+  );
+  grantedSuperAdmins = new Set(rows.map((r) => r.email.toLowerCase()));
+}
 function loadAccessConfig() {
   const candidates = [
     join(config.DATA_ROOT, "access.yaml"),
@@ -36,7 +48,15 @@ function loadAccessConfig() {
   accessConfig = null;
   return null;
 }
+function getAccessConfig() {
+  return accessConfig;
+}
 function isSuperAdmin(email) {
+  const lower = email.toLowerCase();
+  if (grantedSuperAdmins.has(lower)) return true;
+  return isConfigSuperAdmin(lower);
+}
+function isConfigSuperAdmin(email) {
   if (!accessConfig?.super_admins) return false;
   return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
 }
@@ -126,7 +146,7 @@ import { NestStorage } from "@promptowl/contextnest-engine";
 import { mkdirSync, writeFileSync, rmSync } from "fs";
 import { join as join2, dirname, isAbsolute } from "path";
 function isSkippedSegment(segment) {
-  return segment.startsWith(".") || segment === "node_modules";
+  return segment.startsWith(".") || segment === "node_modules" || segment === "_suggestions";
 }
 function safeSegments(rel) {
   if (!rel || isAbsolute(rel)) return null;
@@ -140,14 +160,24 @@ function safeSegments(rel) {
 }
 function writeImportedFiles(dest, files) {
   let written = 0;
+  const skipped = [];
   for (const f of files) {
     const segs = safeSegments(f?.path || "");
-    if (!segs) continue;
+    if (!segs) {
+      skipped.push(f?.path || "(empty)");
+      continue;
+    }
     const full = join2(dest, ...segs);
     mkdirSync(dirname(full), { recursive: true });
     writeFileSync(full, f.content ?? "", "utf-8");
     written++;
   }
+  console.log(
+    `[import] writeImportedFiles: received=${files.length} written=${written} skipped=${skipped.length}`
+  );
+  if (skipped.length) {
+    console.log("[import] skipped (unsafe/hidden path):", skipped.join(", "));
+  }
   return written;
 }
 function discardImportDir(dest) {
@@ -235,7 +265,7 @@ async function flushTelemetry() {
   try {
     const res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: config.PROMPTOWL_FETCH_HEADERS,
       body: JSON.stringify(payload)
     });
     console.log(`[telemetry] response: ${res.status} ${res.statusText}`);
@@ -261,8 +291,53 @@ function startTelemetryLoop() {
   );
 }
 
+// src/db/settings.ts
+var deployBaseline = null;
+function norm(v) {
+  return v === void 0 || v === null ? null : v;
+}
+function baseline() {
+  if (!deployBaseline) deployBaseline = { ...process.env };
+  return deployBaseline;
+}
+async function persistSetting(name, value) {
+  const db = getDb();
+  const envAtWrite = norm(baseline()[name]);
+  await db.run(
+    insertOrReplace(
+      db,
+      `INSERT INTO server_settings (key, value, env_at_write, updated_at)
+       VALUES (?, ?, ?, ${nowExpr(db)})`,
+      ["key"],
+      `value = excluded.value, env_at_write = excluded.env_at_write, updated_at = ${nowExpr(db)}`
+    ),
+    [name, value, envAtWrite]
+  );
+}
+async function loadServerSettings() {
+  deployBaseline = { ...process.env };
+  const base = deployBaseline;
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT key, value, env_at_write FROM server_settings"
+  );
+  let applied = 0;
+  for (const row of rows) {
+    const envVal = norm(base[row.key]);
+    if (envVal !== norm(row.env_at_write)) {
+      await persistSetting(row.key, envVal);
+      if (envVal === null) delete process.env[row.key];
+      else process.env[row.key] = envVal;
+    } else {
+      if (row.value === null) delete process.env[row.key];
+      else process.env[row.key] = row.value;
+    }
+    applied++;
+  }
+  return applied;
+}
+
 // src/auth/license.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 var currentLicense = null;
 function getCurrentLicense() {
   return currentLicense;
@@ -284,21 +359,6 @@ async function isLicenseAdminUserId(userId) {
     return false;
   }
 }
-function upsertEnvVar(filePath, varName, value) {
-  const prefix = `${varName}=`;
-  let lines = [];
-  if (existsSync2(filePath)) {
-    lines = readFileSync2(filePath, "utf8").split(/\r?\n/);
-  }
-  const filtered = lines.filter((line) => !line.trimStart().startsWith(prefix));
-  if (value !== null) {
-    filtered.push(`${prefix}${value}`);
-  }
-  while (filtered.length && filtered[filtered.length - 1] === "") {
-    filtered.pop();
-  }
-  writeFileSync2(filePath, filtered.join("\n") + "\n", "utf8");
-}
 async function installLicenseKey(key) {
   const trimmed = key.trim();
   if (!trimmed.startsWith("pk_")) {
@@ -315,12 +375,12 @@ async function installLicenseKey(key) {
     return { ...info, persisted: false };
   }
   try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", trimmed);
+    await persistSetting("PROMPTOWL_KEY", trimmed);
     return { ...info, persisted: true };
   } catch (err) {
     const persistError = err instanceof Error ? err.message : String(err);
     console.warn(
-      `[license] validated but FAILED to persist to ${config.ENV_FILE_PATH}: ${persistError}`
+      `[license] validated but FAILED to persist to the database: ${persistError}`
     );
     return { ...info, persisted: false, persistError };
   }
@@ -360,12 +420,12 @@ async function handleLicenseRevoked() {
     console.warn("[license] failed to wipe sessions:", err);
   }
   try {
-    upsertEnvVar(config.ENV_FILE_PATH, "PROMPTOWL_KEY", null);
+    await persistSetting("PROMPTOWL_KEY", null);
     console.warn(
-      `[license] revoked \u2014 removed PROMPTOWL_KEY from ${config.ENV_FILE_PATH}`
+      "[license] revoked \u2014 cleared persisted PROMPTOWL_KEY from the database"
     );
   } catch (err) {
-    console.warn("[license] failed to strip key from .env:", err);
+    console.warn("[license] failed to clear persisted key:", err);
   }
   process.env.PROMPTOWL_KEY = "";
   currentLicense = {
@@ -430,7 +490,7 @@ async function _validateLicenseImpl(forceFresh) {
     const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
     const res = await fetch(`${promptowlUrl}/api/license/validate`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: config.PROMPTOWL_FETCH_HEADERS,
       body: JSON.stringify({ key })
     });
     if (!res.ok) {
@@ -742,6 +802,39 @@ async function listNests(userId) {
     [userId, ANON_USER_ID]
   );
 }
+async function nestsSharedViaTeams(userId) {
+  const db = getDb();
+  const teams = await db.all(
+    "SELECT id, members FROM teams WHERE members LIKE ?",
+    [`%${userId}%`]
+  );
+  const myTeamIds = /* @__PURE__ */ new Set();
+  for (const t of teams) {
+    try {
+      const members = JSON.parse(t.members || "[]");
+      if (Array.isArray(members) && members.some((m) => m?.userId === userId)) {
+        myTeamIds.add(t.id);
+      }
+    } catch {
+    }
+  }
+  if (myTeamIds.size === 0) return [];
+  const ids = [...myTeamIds];
+  const candidates = await db.all(
+    `SELECT * FROM nests
+       WHERE user_id != ?
+         AND (${ids.map(() => "shared_teams LIKE ?").join(" OR ")})`,
+    [userId, ...ids.map((id) => `%${id}%`)]
+  );
+  return candidates.filter((n) => {
+    try {
+      const refs = JSON.parse(n.shared_teams || "[]");
+      return Array.isArray(refs) && refs.some((r) => myTeamIds.has(r?.teamId));
+    } catch {
+      return false;
+    }
+  });
+}
 async function listSharedNests(userId) {
   const db = getDb();
   const caller = await db.get("SELECT email FROM users WHERE id = ?", [
@@ -754,7 +847,7 @@ async function listSharedNests(userId) {
       [userId]
     );
   }
-  return await db.all(
+  const direct = await db.all(
     `SELECT DISTINCT n.* FROM nests n
        LEFT JOIN nest_collaborators nc
          ON nc.nest_id = n.id AND nc.user_id = ?
@@ -767,6 +860,17 @@ async function listSharedNests(userId) {
        ORDER BY n.created_at DESC`,
     [userId, userId, userId]
   );
+  const seen = new Set(direct.map((n) => n.id));
+  for (const n of await nestsSharedViaTeams(userId)) {
+    if (!seen.has(n.id)) {
+      direct.push(n);
+      seen.add(n.id);
+    }
+  }
+  direct.sort(
+    (a, b) => a.created_at === b.created_at ? 0 : a.created_at < b.created_at ? 1 : -1
+  );
+  return direct;
 }
 async function listPublicNests(userId) {
   const db = getDb();
@@ -839,9 +943,7 @@ var FlatNestStorage = class extends NestStorage2 {
       if (META_FILES.has(e.name)) continue;
       const dir = e.parentPath ?? e.path ?? root;
       const rel = relative(root, join4(dir, e.name)).split(sep).join("/");
-      if (rel.split("/").some(isSkippedSegment)) {
-        continue;
-      }
+      if (rel.split("/").some(isSkippedSegment)) continue;
       ids.push(rel.replace(/\.md$/, ""));
     }
     const nodes = [];
@@ -890,6 +992,12 @@ async function buildTitleMap(nestId) {
 function folderForNode(nodeId) {
   return nodeId.replace(/^nodes\//, "").split("/").slice(0, -1).join("/");
 }
+async function describeNode(nestId, nodeId) {
+  const titles = await buildTitleMap(nestId);
+  const title = titles.get(nodeId) || nodeId;
+  const folder = folderForNode(nodeId);
+  return folder ? `${title} (in ${folder})` : title;
+}
 async function nestName(nestId) {
   try {
     const row = await getDb().get("SELECT name FROM nests WHERE id = ?", [
@@ -921,7 +1029,452 @@ async function buildDocContext(nestId, nodeId, baseUrl) {
   };
 }
 
+// src/governance/teams-service.ts
+import { v4 as uuid2 } from "uuid";
+var VALID_TEAM_ROLES = ["admin", "editor", "viewer"];
+function parseMembers(json) {
+  if (!json) return [];
+  try {
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function rowToTeam(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    owner_id: row.owner_id,
+    members: parseMembers(row.members),
+    source: row.source ?? null,
+    external_id: row.external_id ?? null,
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+async function enrichTeam(team) {
+  const db = getDb();
+  const ids = team.members.map((m) => m.userId);
+  const invited = /* @__PURE__ */ new Map();
+  if (ids.length) {
+    const rows = await db.all(
+      `SELECT id, is_invited FROM users WHERE id IN (${ids.map(() => "?").join(",")})`,
+      ids
+    );
+    for (const r of rows) invited.set(r.id, r.is_invited);
+  }
+  const owner = await db.get("SELECT email FROM users WHERE id = ?", [
+    team.owner_id
+  ]);
+  return {
+    ...team,
+    owner_email: owner?.email,
+    // Unknown id (deleted user) → treat as not registered.
+    members: team.members.map((m) => ({
+      ...m,
+      registered: (invited.get(m.userId) ?? 1) === 0
+    }))
+  };
+}
+function assertValidRole(role) {
+  if (!VALID_TEAM_ROLES.includes(role)) {
+    throw new ValidationError(
+      "role must be admin, editor, or viewer"
+    );
+  }
+}
+async function loadTeamRow(teamId) {
+  const db = getDb();
+  const row = await db.get("SELECT * FROM teams WHERE id = ?", [
+    teamId
+  ]);
+  if (!row) throw new NotFoundError("Team not found");
+  return row;
+}
+var ROLE_RANK = {
+  viewer: 1,
+  editor: 2,
+  admin: 3
+};
+var OWNER_RANK = 4;
+function managementRank(row, callerUserId, allowAdmin) {
+  if (row.owner_id === callerUserId || allowAdmin) return OWNER_RANK;
+  const m = parseMembers(row.members).find((x) => x.userId === callerUserId);
+  return m ? ROLE_RANK[m.role] ?? 0 : 0;
+}
+async function createTeam(params) {
+  const name = params.name?.trim();
+  if (!name) throw new ValidationError("Team name is required");
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = uuid2();
+  await db.run(
+    "INSERT INTO teams (id, name, owner_id, members, source, external_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+    [
+      id,
+      name,
+      params.ownerId,
+      "[]",
+      params.source ?? null,
+      params.externalId ?? null,
+      now,
+      now
+    ]
+  );
+  return enrichTeam(rowToTeam(await loadTeamRow(id)));
+}
+async function findTeamByExternalId(params) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT * FROM teams WHERE owner_id = ? AND source = ? AND external_id = ?",
+    [params.ownerId, params.source, params.externalId]
+  );
+  return row ? enrichTeam(rowToTeam(row)) : null;
+}
+async function listTeamsForUser(userId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT * FROM teams WHERE owner_id = ? OR members LIKE ? ORDER BY created_at",
+    [userId, `%${userId}%`]
+  );
+  const mine = rows.filter(
+    (r) => r.owner_id === userId || parseMembers(r.members).some((m) => m.userId === userId)
+  );
+  return Promise.all(mine.map((r) => enrichTeam(rowToTeam(r))));
+}
+async function getTeam(teamId) {
+  return enrichTeam(rowToTeam(await loadTeamRow(teamId)));
+}
+async function renameTeam(params) {
+  const name = params.name?.trim();
+  if (!name) throw new ValidationError("Team name is required");
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can rename this team.");
+  }
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await tx.run("UPDATE teams SET name = ?, updated_at = ? WHERE id = ?", [
+      name,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      params.teamId
+    ]);
+    await refreshTeamNameRefs(tx, params.teamId, name);
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function deleteTeam(params) {
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < OWNER_RANK) {
+    throw new ForbiddenError("Only the team owner can delete this team.");
+  }
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await tx.run("DELETE FROM teams WHERE id = ?", [params.teamId]);
+    await removeTeamRefs(tx, params.teamId);
+  });
+}
+async function addMember(params) {
+  assertValidRole(params.role);
+  const row = await loadTeamRow(params.teamId);
+  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
+  if (rank < ROLE_RANK.editor) {
+    throw new ForbiddenError(
+      "Only an editor or admin member (or the owner) can add people to this team."
+    );
+  }
+  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
+    throw new ForbiddenError("You can't give a member a higher role than your own.");
+  }
+  const { userId: resolvedId, email: resolvedEmail } = await resolveMemberIdentity(params);
+  await mutateMembers(params.teamId, (members) => {
+    if (members.some((m) => m.userId === resolvedId)) {
+      throw new ConflictError(
+        `${resolvedEmail || "This user"} is already a member of this team. Change their role instead of adding them again.`
+      );
+    }
+    return [
+      ...members,
+      { userId: resolvedId, email: resolvedEmail, role: params.role }
+    ];
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function resolveMemberIdentity(params) {
+  const db = getDb();
+  if (params.userId) {
+    const u = await db.get("SELECT email FROM users WHERE id = ?", [
+      params.userId
+    ]);
+    if (!u) throw new ValidationError("User not found");
+    return { userId: params.userId, email: normalizeEmail(u.email ?? "") };
+  }
+  const requested = params.email ? normalizeEmail(params.email) : void 0;
+  if (!requested) {
+    throw new ValidationError("user_id or email is required");
+  }
+  const existing = await db.get(
+    "SELECT id, email FROM users WHERE LOWER(email) = ?",
+    [requested]
+  );
+  if (existing) {
+    return {
+      userId: existing.id,
+      email: normalizeEmail(existing.email ?? requested)
+    };
+  }
+  const { hashPassword } = await import("./keys-73STFJJB.js");
+  const userId = uuid2();
+  await db.run(
+    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+    [userId, requested, null, await hashPassword(uuid2())]
+  );
+  return { userId, email: requested };
+}
+async function replaceTeamRoster(params) {
+  for (const m of params.members) assertValidRole(m.role);
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError(
+      "Only a team admin or the owner can replace this team's roster."
+    );
+  }
+  await mutateMembers(
+    params.teamId,
+    () => params.members.map((m) => ({
+      userId: m.userId,
+      email: m.email,
+      role: m.role
+    }))
+  );
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function updateMemberRole(params) {
+  assertValidRole(params.role);
+  const row = await loadTeamRow(params.teamId);
+  const rank = managementRank(row, params.callerUserId, !!params.allowAdmin);
+  if (rank < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can change roles.");
+  }
+  if (rank < OWNER_RANK && ROLE_RANK[params.role] > rank) {
+    throw new ForbiddenError("You can't set a role higher than your own.");
+  }
+  await mutateMembers(params.teamId, (members) => {
+    const member = members.find((m) => m.userId === params.userId);
+    if (!member) throw new NotFoundError("Team member not found");
+    member.role = params.role;
+    return members;
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function removeMember(params) {
+  const row = await loadTeamRow(params.teamId);
+  if (managementRank(row, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.admin) {
+    throw new ForbiddenError("Only a team admin or the owner can remove members.");
+  }
+  await mutateMembers(params.teamId, (members) => {
+    const next = members.filter((m) => m.userId !== params.userId);
+    if (next.length === members.length) {
+      throw new NotFoundError("Team member not found");
+    }
+    return next;
+  });
+  return enrichTeam(rowToTeam(await loadTeamRow(params.teamId)));
+}
+async function mutateMembers(teamId, mutate) {
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    const row = await tx.get("SELECT members FROM teams WHERE id = ?", [
+      teamId
+    ]);
+    if (!row) throw new NotFoundError("Team not found");
+    const next = mutate(parseMembers(row.members));
+    await tx.run("UPDATE teams SET members = ?, updated_at = ? WHERE id = ?", [
+      JSON.stringify(next),
+      (/* @__PURE__ */ new Date()).toISOString(),
+      teamId
+    ]);
+  });
+}
+function parseSharedTeams(json) {
+  if (!json) return [];
+  try {
+    const parsed = JSON.parse(json);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+async function listNestTeams(nestId) {
+  const db = getDb();
+  const row = await db.get("SELECT shared_teams FROM nests WHERE id = ?", [
+    nestId
+  ]);
+  if (!row) throw new NotFoundError("Nest not found");
+  return parseSharedTeams(row.shared_teams);
+}
+async function shareTeamWithNest(params) {
+  const db = getDb();
+  return db.transaction(async (tx) => {
+    const team = await tx.get(
+      "SELECT id, name, owner_id, members FROM teams WHERE id = ?",
+      [params.teamId]
+    );
+    if (!team) throw new NotFoundError("Team not found");
+    if (managementRank(team, params.callerUserId, !!params.allowAdmin) < ROLE_RANK.editor) {
+      throw new ForbiddenError(
+        "You need to be an editor, admin, or owner of a team to share it. View-only members can't."
+      );
+    }
+    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
+      params.nestId
+    ]);
+    if (!nest) throw new NotFoundError("Nest not found");
+    const refs = parseSharedTeams(nest.shared_teams);
+    if (refs.some((r) => r.teamId === params.teamId)) {
+      throw new ConflictError("This team is already shared with the nest.");
+    }
+    refs.push({ teamId: team.id, teamName: team.name });
+    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+      JSON.stringify(refs),
+      params.nestId
+    ]);
+    const hasGovernanceRole = parseMembers(team.members).some(
+      (m) => m.role === "viewer" || m.role === "editor"
+    );
+    if (hasGovernanceRole) {
+      await tx.run("UPDATE nests SET stewardship_enabled = 1 WHERE id = ?", [
+        params.nestId
+      ]);
+    }
+    return refs;
+  });
+}
+async function unshareTeamFromNest(params) {
+  const db = getDb();
+  return db.transaction(async (tx) => {
+    const nest = await tx.get("SELECT shared_teams FROM nests WHERE id = ?", [
+      params.nestId
+    ]);
+    if (!nest) throw new NotFoundError("Nest not found");
+    const refs = parseSharedTeams(nest.shared_teams);
+    const next = refs.filter((r) => r.teamId !== params.teamId);
+    if (next.length === refs.length) {
+      throw new NotFoundError("Team is not shared with this nest.");
+    }
+    await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+      JSON.stringify(next),
+      params.nestId
+    ]);
+    return next;
+  });
+}
+async function refreshTeamNameRefs(tx, teamId, newName) {
+  const nests = await tx.all(
+    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
+    [`%${teamId}%`]
+  );
+  for (const n of nests) {
+    const refs = parseSharedTeams(n.shared_teams);
+    let changed = false;
+    for (const r of refs) {
+      if (r.teamId === teamId && r.teamName !== newName) {
+        r.teamName = newName;
+        changed = true;
+      }
+    }
+    if (changed) {
+      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+        JSON.stringify(refs),
+        n.id
+      ]);
+    }
+  }
+}
+async function removeTeamRefs(tx, teamId) {
+  const nests = await tx.all(
+    "SELECT id, shared_teams FROM nests WHERE shared_teams LIKE ?",
+    [`%${teamId}%`]
+  );
+  for (const n of nests) {
+    const refs = parseSharedTeams(n.shared_teams);
+    const next = refs.filter((r) => r.teamId !== teamId);
+    if (next.length !== refs.length) {
+      await tx.run("UPDATE nests SET shared_teams = ? WHERE id = ?", [
+        JSON.stringify(next),
+        n.id
+      ]);
+    }
+  }
+}
+async function resolveTeamRolesForUser(nestId, userId) {
+  const refs = await listNestTeams(nestId).catch(() => []);
+  if (refs.length === 0) return [];
+  const db = getDb();
+  const roles = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const row = await db.get("SELECT members FROM teams WHERE id = ?", [
+      ref.teamId
+    ]);
+    if (!row) continue;
+    const member = parseMembers(row.members).find((m) => m.userId === userId);
+    if (member) roles.add(member.role);
+  }
+  return [...roles];
+}
+
+// src/governance/roles.ts
+function collabPermToRole(permission) {
+  switch (permission) {
+    case "owner":
+      return "owner";
+    case "admin":
+      return "admin";
+    case "write":
+      return "editor";
+    case "read":
+      return "viewer";
+    default:
+      return null;
+  }
+}
+function teamRoleToPermission(role) {
+  switch (role) {
+    case "admin":
+      return "admin";
+    case "editor":
+      return "write";
+    case "viewer":
+      return "read";
+    default:
+      return null;
+  }
+}
+var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
+var canViewWith = (roles) => roles.length > 0;
+var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
+var PRECEDENCE = [
+  "owner",
+  "admin",
+  "editor",
+  "reviewer",
+  "viewer"
+];
+function primaryRole(roles) {
+  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
+  return null;
+}
+
 // src/shared/access.ts
+async function isServerAdminUserId(userId) {
+  if (await isLicenseAdminUserId(userId)) return true;
+  const row = await getDb().get(
+    "SELECT email FROM users WHERE id = ?",
+    [userId]
+  );
+  return !!row?.email && isSuperAdmin(row.email);
+}
 var PERMISSION_LEVELS = {
   none: 0,
   read: 1,
@@ -942,11 +1495,18 @@ async function resolveNestPermission(nestId, userId) {
   if (caller?.email && isSuperAdmin(caller.email)) {
     return "admin";
   }
+  const higher = (a, b) => b && PERMISSION_LEVELS[b] > PERMISSION_LEVELS[a] ? b : a;
+  let best = "none";
   const directGrant = await db.get(
     "SELECT permission FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
     [nestId, userId]
   );
-  if (directGrant) return directGrant.permission;
+  if (directGrant) best = higher(best, directGrant.permission);
+  if (best === "admin") return best;
+  for (const role of await resolveTeamRolesForUser(nestId, userId)) {
+    best = higher(best, teamRoleToPermission(role));
+  }
+  if (best === "admin") return best;
   const stewardGrant = await db.get(
     `SELECT 1 FROM stewards s
          JOIN users u ON u.id = ?
@@ -955,9 +1515,9 @@ async function resolveNestPermission(nestId, userId) {
         LIMIT 1`,
     [userId, nestId]
   );
-  if (stewardGrant) return "read";
-  if (nest.visibility === "public") return "read";
-  return "none";
+  if (stewardGrant) best = higher(best, "read");
+  if (nest.visibility === "public") best = higher(best, "read");
+  return best;
 }
 function permissionLevel(p) {
   return PERMISSION_LEVELS[p] ?? 0;
@@ -985,43 +1545,14 @@ async function isPublicReader(nestId, userId) {
     [userId, nestId]
   );
   if (stewardGrant) return false;
+  if ((await resolveTeamRolesForUser(nestId, userId)).length > 0) return false;
   return true;
 }
 
-// src/governance/roles.ts
-function collabPermToRole(permission) {
-  switch (permission) {
-    case "owner":
-      return "owner";
-    case "admin":
-      return "admin";
-    case "write":
-      return "editor";
-    case "read":
-      return "viewer";
-    default:
-      return null;
-  }
-}
-var includesAny = (roles, wanted) => roles.some((r) => wanted.includes(r));
-var canViewWith = (roles) => roles.length > 0;
-var canEditWith = (roles) => includesAny(roles, ["owner", "admin", "editor"]);
-var PRECEDENCE = [
-  "owner",
-  "admin",
-  "editor",
-  "reviewer",
-  "viewer"
-];
-function primaryRole(roles) {
-  for (const r of PRECEDENCE) if (roles.includes(r)) return r;
-  return null;
-}
-
 // src/governance/stewardship-service.ts
 async function assignSteward(data) {
   const db = getDb();
-  const id = uuid2();
+  const id = uuid3();
   await db.run(
     `INSERT INTO stewards
      (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, assigned_by, is_active)
@@ -1219,13 +1750,22 @@ async function createStewardRecord(params) {
       "SELECT id FROM users WHERE email = ?",
       [email]
     );
+    let userId = userRow?.id;
+    if (!userId) {
+      const { hashPassword } = await import("./keys-73STFJJB.js");
+      userId = uuid3();
+      await db.run(
+        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+        [userId, email, null, await hashPassword(uuid3())]
+      );
+    }
     const created = await assignSteward({
       nestId: params.nestId,
       scope: params.scope,
       nodePattern,
       tagName,
       userEmail: email,
-      userId: userRow?.id,
+      userId,
       role: user.role ?? "reviewer",
       assignedBy: params.assignedBy,
       assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1343,6 +1883,9 @@ async function resolveUserRoles(nestId, userEmail, opts) {
   if (userId) {
     const collabRole = collabPermToRole(await resolveNestPermission(nestId, userId));
     if (collabRole) roles.add(collabRole);
+    for (const role of await resolveTeamRolesForUser(nestId, userId)) {
+      roles.add(role);
+    }
   }
   const stewardRoles = opts?.nodeId ? (await resolveStewardsForNode(nestId, opts.nodeId)).filter(
     (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
@@ -1541,17 +2084,38 @@ function rowToSteward(row) {
 export {
   trackEvent,
   startTelemetryLoop,
+  persistSetting,
+  loadServerSettings,
   getCurrentLicense,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
-  upsertEnvVar,
   installLicenseKey,
   startLicenseSafetyPoll,
   isSuspended,
   getSuspensionReason,
   validateLicense,
+  loadGrantedSuperAdmins,
   loadAccessConfig,
+  getAccessConfig,
   isSuperAdmin,
+  isConfigSuperAdmin,
+  createTeam,
+  findTeamByExternalId,
+  listTeamsForUser,
+  getTeam,
+  renameTeam,
+  deleteTeam,
+  addMember,
+  resolveMemberIdentity,
+  replaceTeamRoster,
+  updateMemberRole,
+  removeMember,
+  listNestTeams,
+  shareTeamWithNest,
+  unshareTeamFromNest,
+  resolveTeamRolesForUser,
+  collabPermToRole,
+  isServerAdminUserId,
   resolveNestPermission,
   permissionLevel,
   isPublicReader,
@@ -1573,10 +2137,10 @@ export {
   deleteNest,
   engineCache,
   buildTitleMap,
+  describeNode,
   nestName,
   docLink,
   buildDocContext,
-  collabPermToRole,
   assignSteward,
   removeSteward,
   updateSteward,