@promptowl/contextnest-community 1.10.0 → 1.12.0

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   seedDefaultEdgeTypes,
   submitForReview,
   verifySmtp
-} from "./chunk-ZM4F7MY7.js";
+} from "./chunk-XB7T3THE.js";
 import {
   createGrant,
   deleteGrant,
@@ -37,7 +37,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-7PQREKSM.js";
+} from "./chunk-ZMSU7BCC.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -46,9 +46,6 @@ import {
   parseBearerToken,
   verifyPassword
 } from "./chunk-XRK6SQSC.js";
-import {
-  normalizeEmail
-} from "./chunk-FRQJWGN3.js";
 import {
   checkConflict,
   createVersion,
@@ -57,8 +54,10 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-UHUU3VAK.js";
+} from "./chunk-JHIU6RZU.js";
 import {
+  addMember,
+  buildTitleMap,
   canCreateInNest,
   canManageStewards,
   canUserAccess,
@@ -67,10 +66,14 @@ import {
   collabPermToRole,
   createNest,
   createStewardRecord,
+  createTeam,
   deleteNest,
+  deleteTeam,
   disableStewardshipAndWipeGovernance,
   docLink,
   engineCache,
+  findTeamByExternalId,
+  getAccessConfig,
   getCollaboratorRole,
   getCurrentLicense,
   getNest,
@@ -78,50 +81,68 @@ import {
   getStewardsForNest,
   getStewardsForUser,
   getSuspensionReason,
+  getTeam,
   importNest,
   installLicenseKey,
+  isConfigSuperAdmin,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
   isPublicReader,
+  isServerAdminUserId,
   isStewardshipEnabled,
   isSuperAdmin,
   isSuspended,
+  listNestTeams,
   listNests,
   listPublicNests,
   listSharedNests,
   listStewards,
+  listTeamsForUser,
   loadAccessConfig,
+  loadGrantedSuperAdmins,
   loadServerSettings,
   nestAllowsSelfApprove,
   nestName,
   nestStorageRoot,
   permissionLevel,
   persistSetting,
+  removeMember,
   removeSteward,
   renameNest,
+  renameTeam,
+  replaceTeamRoster,
+  resolveMemberIdentity,
   resolveNestPath,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
+  resolveTeamRolesForUser,
   resolveUserRoles,
   setAllowSelfApprove,
   setStewardshipEnabled,
+  shareTeamWithNest,
   startLicenseSafetyPoll,
   startTelemetryLoop,
   syncFromConfig,
   trackEvent,
   uniqueNestName,
+  unshareTeamFromNest,
+  updateMemberRole,
   updateSteward,
   validateLicense
-} from "./chunk-KFGZIECB.js";
+} from "./chunk-F7EKYNXG.js";
 import {
   AppError,
   ConflictError,
   ForbiddenError,
   LockedError,
   NotFoundError,
+  UnauthorizedError,
   ValidationError
-} from "./chunk-3JTODC3Y.js";
+} from "./chunk-GUNJTORH.js";
+import {
+  normalizeEmail
+} from "./chunk-FRQJWGN3.js";
 import {
   insertOrIgnore,
   nowExpr
@@ -132,7 +153,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-BC6KFUZH.js";
+} from "./chunk-3M7677XW.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
@@ -142,14 +163,14 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono21 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
 
 // src/auth/routes.ts
-import { Hono } from "hono";
-import { v4 as uuid } from "uuid";
+import { Hono as Hono2 } from "hono";
+import { v4 as uuid2 } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
@@ -173,6 +194,12 @@ async function createSession(userId, userAgent) {
      VALUES (?, ?, ?, ?)`,
     [id, userId, expiryIso(), userAgent || null]
   );
+  try {
+    await db.run("UPDATE users SET is_invited = 0 WHERE id = ? AND is_invited = 1", [
+      userId
+    ]);
+  } catch {
+  }
   return id;
 }
 async function resolveSession(id) {
@@ -227,6 +254,53 @@ function buildSessionCookie(id, opts = {}) {
 function buildClearSessionCookie(opts = {}) {
   return buildSessionCookie("", { secure: opts.secure, maxAgeSeconds: 0 });
 }
+var OIDC_SESSION_MARKER_COOKIE = "cnst_sso_session";
+var PROMPTOWL_TOKEN_COOKIE = "cnst_po_token";
+var PROMPTOWL_TOKEN_COOKIE_PATH = "/teams";
+function buildPromptowlTokenCookie(token, opts = {}) {
+  const parts = [
+    `${PROMPTOWL_TOKEN_COOKIE}=${opts.clear ? "" : encodeURIComponent(token)}`,
+    "HttpOnly",
+    `Path=${PROMPTOWL_TOKEN_COOKIE_PATH}`,
+    "SameSite=Lax",
+    `Max-Age=${opts.clear ? 0 : SESSION_TTL_SECS}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+var PROMPTOWL_MARKER_COOKIE = "cnst_po_session";
+function buildPromptowlMarkerCookie(opts = {}) {
+  const parts = [
+    `${PROMPTOWL_MARKER_COOKIE}=${opts.clear ? "" : "1"}`,
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${opts.clear ? 0 : SESSION_TTL_SECS}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function getPromptowlTokenFromRequest(c) {
+  const header = c.req.header("Cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === PROMPTOWL_TOKEN_COOKIE) {
+      const v = decodeURIComponent(rest.join("="));
+      return /^po_device_[A-Za-z0-9_-]+$/.test(v) ? v : null;
+    }
+  }
+  return null;
+}
+function buildOidcMarkerCookie(opts = {}) {
+  const parts = [
+    `${OIDC_SESSION_MARKER_COOKIE}=${opts.clear ? "" : "1"}`,
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${opts.clear ? 0 : SESSION_TTL_SECS}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
 function isSecureRequest(c) {
   const proto = c.req.header("x-forwarded-proto");
   if (proto) return proto.split(",")[0].trim() === "https";
@@ -357,11 +431,349 @@ function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
   return claims;
 }
 
-// src/auth/routes.ts
+// src/auth/oidc.ts
+import { Hono } from "hono";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { v4 as uuid } from "uuid";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/shared/base-url.ts
+function requestBaseUrl(reqUrl) {
+  if (config.PUBLIC_BASE_URL) return config.PUBLIC_BASE_URL;
+  try {
+    return new URL(reqUrl).origin;
+  } catch {
+    return "";
+  }
+}
+
+// src/shared/request-ip.ts
 import { getConnInfo } from "@hono/node-server/conninfo";
+function clientIp(c) {
+  const xff = c.req.header("x-forwarded-for");
+  if (xff) return xff.split(",")[0].trim();
+  const realIp = c.req.header("x-real-ip");
+  if (realIp) return realIp.trim();
+  try {
+    const addr = getConnInfo(c).remote.address;
+    if (addr) return addr;
+  } catch {
+  }
+  return "unknown";
+}
+
+// src/auth/oidc.ts
+var OIDC_LIMIT = { max: 100, windowMs: 15 * 6e4 };
+var IDP_FETCH_TIMEOUT_MS = 1e4;
+var STATE_COOKIE = "cnst_oidc_state";
+var NONCE_COOKIE = "cnst_oidc_nonce";
+var VERIFIER_COOKIE = "cnst_oidc_verifier";
+var FLOW_COOKIE_TTL_SECS = 10 * 60;
+var DISCOVERY_TTL_MS = 5 * 6e4;
+var discoveryCache = null;
+function isOidcReady() {
+  return config.OIDC_ENABLED && !!config.OIDC_ISSUER && !!config.OIDC_CLIENT_ID && !!config.OIDC_CLIENT_SECRET;
+}
+async function discover(issuer) {
+  const now = Date.now();
+  if (discoveryCache && discoveryCache.issuer === issuer && now - discoveryCache.fetchedAt < DISCOVERY_TTL_MS) {
+    return { doc: discoveryCache.doc, jwks: discoveryCache.jwks };
+  }
+  const res = await fetch(`${issuer}/.well-known/openid-configuration`, {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(IDP_FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`discovery fetch failed with status ${res.status}`);
+  }
+  const doc = await res.json();
+  if (!doc.issuer || !doc.authorization_endpoint || !doc.token_endpoint || !doc.jwks_uri) {
+    throw new Error("discovery document is missing required fields");
+  }
+  if (doc.issuer.replace(/\/$/, "") !== issuer.replace(/\/$/, "")) {
+    throw new Error(
+      `discovery issuer mismatch: expected ${issuer}, got ${doc.issuer}`
+    );
+  }
+  const jwks = createRemoteJWKSet(new URL(doc.jwks_uri));
+  discoveryCache = {
+    issuer,
+    doc,
+    jwks,
+    fetchedAt: now
+  };
+  return { doc, jwks };
+}
+function base64url(buf) {
+  return buf.toString("base64url");
+}
+function pkceChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+var DEPARTMENT_MAX_LENGTH = 120;
+function normalizeDepartment(claim) {
+  if (typeof claim !== "string") return null;
+  const collapsed = claim.replace(/\s+/g, " ").trim();
+  if (!collapsed) return null;
+  return collapsed.slice(0, DEPARTMENT_MAX_LENGTH).trim();
+}
+function buildFlowCookie(name, value, opts) {
+  const parts = [
+    `${name}=${value}`,
+    "HttpOnly",
+    "Path=/auth/oidc",
+    "SameSite=Lax",
+    `Max-Age=${opts.clear ? 0 : FLOW_COOKIE_TTL_SECS}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function readCookie(c, name) {
+  const header = c.req.header("Cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === name) {
+      const v = rest.join("=").trim();
+      return /^[A-Za-z0-9_-]{16,256}$/.test(v) ? v : null;
+    }
+  }
+  return null;
+}
+function oidcRedirectUri(reqUrl) {
+  return `${requestBaseUrl(reqUrl)}/auth/oidc/callback`;
+}
+var oidcRoutes = new Hono();
+oidcRoutes.get("/login", async (c) => {
+  const bounce = (code) => c.redirect(`/?sso_error=${code}`, 302);
+  if (!config.OIDC_ENABLED) return bounce("disabled");
+  if (!isOidcReady()) return bounce("not_configured");
+  if (!tryConsume(`oidc-login:ip:${clientIp(c)}`, OIDC_LIMIT)) {
+    return bounce("rate_limited");
+  }
+  let doc;
+  try {
+    ({ doc } = await discover(config.OIDC_ISSUER));
+  } catch (err) {
+    console.error("[oidc] discovery failed:", err);
+    return bounce("discovery_failed");
+  }
+  const state = base64url(randomBytes2(24));
+  const nonce = base64url(randomBytes2(24));
+  const verifier = base64url(randomBytes2(32));
+  const secure = isSecureRequest(c);
+  c.header("Set-Cookie", buildFlowCookie(STATE_COOKIE, state, { secure }), {
+    append: true
+  });
+  c.header("Set-Cookie", buildFlowCookie(NONCE_COOKIE, nonce, { secure }), {
+    append: true
+  });
+  c.header(
+    "Set-Cookie",
+    buildFlowCookie(VERIFIER_COOKIE, verifier, { secure }),
+    { append: true }
+  );
+  const authorizeUrl = new URL(doc.authorization_endpoint);
+  authorizeUrl.searchParams.set("client_id", config.OIDC_CLIENT_ID);
+  authorizeUrl.searchParams.set("redirect_uri", oidcRedirectUri(c.req.url));
+  authorizeUrl.searchParams.set("response_type", "code");
+  authorizeUrl.searchParams.set("scope", "openid email profile");
+  authorizeUrl.searchParams.set("state", state);
+  authorizeUrl.searchParams.set("nonce", nonce);
+  authorizeUrl.searchParams.set("code_challenge", pkceChallenge(verifier));
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  return c.redirect(authorizeUrl.toString(), 302);
+});
+oidcRoutes.get("/callback", async (c) => {
+  const secure = isSecureRequest(c);
+  const clearFlowCookies = () => {
+    for (const name2 of [STATE_COOKIE, NONCE_COOKIE, VERIFIER_COOKIE]) {
+      c.header("Set-Cookie", buildFlowCookie(name2, "", { secure, clear: true }), {
+        append: true
+      });
+    }
+  };
+  const bounce = (code2) => {
+    clearFlowCookies();
+    return c.redirect(`/?sso_error=${code2}`, 302);
+  };
+  if (!config.OIDC_ENABLED) return bounce("disabled");
+  if (!isOidcReady()) return bounce("not_configured");
+  if (!tryConsume(`oidc-cb:ip:${clientIp(c)}`, OIDC_LIMIT)) {
+    return bounce("rate_limited");
+  }
+  if (c.req.query("error")) return bounce("provider_error");
+  const stateParam = c.req.query("state") || "";
+  const stateCookie = readCookie(c, STATE_COOKIE);
+  if (!stateCookie || !stateParam || stateParam !== stateCookie) {
+    return bounce("state_mismatch");
+  }
+  const code = c.req.query("code");
+  if (!code) return bounce("exchange_failed");
+  const nonceCookie = readCookie(c, NONCE_COOKIE);
+  const verifierCookie = readCookie(c, VERIFIER_COOKIE);
+  if (!nonceCookie || !verifierCookie) return bounce("state_mismatch");
+  let doc;
+  let jwks;
+  try {
+    ({ doc, jwks } = await discover(config.OIDC_ISSUER));
+  } catch (err) {
+    console.error("[oidc] discovery failed:", err);
+    return bounce("discovery_failed");
+  }
+  let idToken;
+  try {
+    const tokenRes = await fetch(doc.token_endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: oidcRedirectUri(c.req.url),
+        client_id: config.OIDC_CLIENT_ID,
+        client_secret: config.OIDC_CLIENT_SECRET,
+        code_verifier: verifierCookie
+      }).toString(),
+      signal: AbortSignal.timeout(IDP_FETCH_TIMEOUT_MS)
+    });
+    if (!tokenRes.ok) {
+      console.error(
+        `[oidc] token exchange failed with status ${tokenRes.status}`
+      );
+      return bounce("exchange_failed");
+    }
+    const tokens = await tokenRes.json();
+    if (!tokens.id_token || typeof tokens.id_token !== "string") {
+      return bounce("exchange_failed");
+    }
+    idToken = tokens.id_token;
+  } catch (err) {
+    console.error("[oidc] token exchange failed:", err);
+    return bounce("exchange_failed");
+  }
+  let claims;
+  try {
+    const { payload } = await jwtVerify(idToken, jwks, {
+      issuer: doc.issuer,
+      audience: config.OIDC_CLIENT_ID,
+      // Explicit allowlist on top of the JWKS constraint. createRemoteJWKSet
+      // already refuses keys the issuer doesn't publish, so alg-confusion is
+      // blocked either way; this pins the header alg so a JWKS that ever
+      // starts publishing an unexpected key type can't shift us onto it.
+      // RS256 is what every supported preset emits (Entra v2, Google, Okta,
+      // Keycloak default) and is the OIDC-mandated baseline.
+      algorithms: ["RS256"]
+    });
+    claims = payload;
+  } catch (err) {
+    console.error("[oidc] ID token validation failed:", err);
+    return bounce("invalid_token");
+  }
+  if (claims.nonce !== nonceCookie) return bounce("invalid_token");
+  if (claims.email_verified === false || claims.email_verified === "false") {
+    return bounce("email_not_verified");
+  }
+  const rawEmail = typeof claims.email === "string" && claims.email || typeof claims.preferred_username === "string" && claims.preferred_username || "";
+  const email = normalizeEmail(rawEmail);
+  if (!email || !isEmailish(email)) return bounce("invalid_token");
+  const allowed = config.OIDC_ALLOWED_DOMAINS;
+  if (allowed.length > 0) {
+    const domain = email.slice(email.lastIndexOf("@") + 1);
+    if (!allowed.includes(domain)) return bounce("domain_not_allowed");
+  }
+  const name = typeof claims.name === "string" && claims.name.trim() ? claims.name.trim() : null;
+  const department = normalizeDepartment(claims.department);
+  try {
+    const db = getDb();
+    let user = await db.get(
+      "SELECT id, email, name FROM users WHERE LOWER(email) = ?",
+      [email]
+    );
+    if (!user) {
+      if (!config.OIDC_AUTO_PROVISION) return bounce("not_invited");
+      const userId = uuid();
+      const placeholderHash = await hashPassword(uuid());
+      try {
+        await db.run(
+          "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+          [userId, email, name, placeholderHash]
+        );
+        user = { id: userId, email, name };
+        trackEvent("user.register", { userId, email, method: "oidc" });
+      } catch (insErr) {
+        const raced = await db.get(
+          "SELECT id, email, name FROM users WHERE LOWER(email) = ?",
+          [email]
+        );
+        if (!raced) throw insErr;
+        user = raced;
+        trackEvent("user.login", { userId: user.id, method: "oidc" });
+      }
+    } else {
+      trackEvent("user.login", { userId: user.id, method: "oidc" });
+    }
+    try {
+      await db.run("UPDATE users SET department = ? WHERE id = ?", [
+        department,
+        user.id
+      ]);
+    } catch (err) {
+      console.error("[oidc] department upsert failed (login continues):", err);
+    }
+    const sessionId = await createSession(user.id, c.req.header("User-Agent"));
+    clearFlowCookies();
+    c.header("Set-Cookie", buildSessionCookie(sessionId, { secure }), {
+      append: true
+    });
+    c.header("Set-Cookie", buildOidcMarkerCookie({ secure }), { append: true });
+    return c.redirect("/", 302);
+  } catch (err) {
+    console.error("[oidc] provisioning/session failed:", err);
+    return bounce("service_error");
+  }
+});
+oidcRoutes.get("/logout", async (c) => {
+  const secure = isSecureRequest(c);
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId) {
+    try {
+      await deleteSession(sessionId);
+    } catch (err) {
+      console.error("[oidc] logout: failed to delete session:", err);
+    }
+  }
+  c.header("Set-Cookie", buildClearSessionCookie({ secure }), { append: true });
+  c.header("Set-Cookie", buildOidcMarkerCookie({ secure, clear: true }), {
+    append: true
+  });
+  const home = `${requestBaseUrl(c.req.url)}/`;
+  if (isOidcReady()) {
+    try {
+      const { doc } = await discover(config.OIDC_ISSUER);
+      if (doc.end_session_endpoint) {
+        const url = new URL(doc.end_session_endpoint);
+        url.searchParams.set("post_logout_redirect_uri", home);
+        url.searchParams.set("client_id", config.OIDC_CLIENT_ID);
+        return c.redirect(url.toString(), 302);
+      }
+    } catch (err) {
+      console.error("[oidc] logout: discovery failed, local-only:", err);
+    }
+  }
+  return c.redirect(home, 302);
+});
+
+// src/auth/routes.ts
+function isServerAdminEmail(email) {
+  return isLicenseAdminEmail(email) || isSuperAdmin(email);
+}
 var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+var PROMPTOWL_SCOPES = ["user:read", "teams:read"];
 var warnedMissingSsoAudience = false;
 var MIN_PASSWORD_LENGTH = 8;
 function assertValidPassword(password, label = "password") {
@@ -374,18 +786,6 @@ function assertValidPassword(password, label = "password") {
     );
   }
 }
-function clientIp(c) {
-  const xff = c.req.header("x-forwarded-for");
-  if (xff) return xff.split(",")[0].trim();
-  const realIp = c.req.header("x-real-ip");
-  if (realIp) return realIp.trim();
-  try {
-    const addr = getConnInfo(c).remote.address;
-    if (addr) return addr;
-  } catch {
-  }
-  return "unknown";
-}
 async function resolveCallerUserId(c) {
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) {
@@ -423,6 +823,16 @@ function clearSessionCookie(c) {
     "Set-Cookie",
     buildClearSessionCookie({ secure: isSecureRequest(c) })
   );
+  c.header(
+    "Set-Cookie",
+    buildPromptowlTokenCookie("", { secure: isSecureRequest(c), clear: true }),
+    { append: true }
+  );
+  c.header(
+    "Set-Cookie",
+    buildPromptowlMarkerCookie({ secure: isSecureRequest(c), clear: true }),
+    { append: true }
+  );
 }
 async function provisionPromptowlUser(c, rawEmail, rawName) {
   const gate = config.PROMPTOWL_SIGN_IN_GATE;
@@ -443,8 +853,8 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
     [meEmail]
   );
   if (!user) {
-    const userId = uuid();
-    const placeholderHash = await hashPassword(uuid());
+    const userId = uuid2();
+    const placeholderHash = await hashPassword(uuid2());
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
       [userId, meEmail, rawName || null, placeholderHash]
@@ -476,7 +886,8 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
   setSessionCookie(c, sessionId);
   return { ok: true, user, isAdmin, claimBlocked };
 }
-var authRoutes = new Hono();
+var authRoutes = new Hono2();
+authRoutes.route("/oidc", oidcRoutes);
 authRoutes.post("/register", async (c) => {
   if (config.MANUAL_SIGN_IN !== "open") {
     return c.json(
@@ -512,7 +923,7 @@ authRoutes.post("/register", async (c) => {
     }
     throw new ValidationError("Email already registered");
   }
-  const userId = uuid();
+  const userId = uuid2();
   const passwordHash = await hashPassword(body.password);
   await db.run(
     "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -527,7 +938,7 @@ authRoutes.post("/register", async (c) => {
         id: userId,
         email,
         name: body.name || null,
-        is_admin: isLicenseAdminEmail(email)
+        is_admin: isServerAdminEmail(email)
       }
     },
     201
@@ -569,12 +980,6 @@ authRoutes.post("/login", async (c) => {
   console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
   if (hasIp) clear(ipKey);
   clear(emailKey);
-  if (user.is_invited === 1) {
-    try {
-      await db.run("UPDATE users SET is_invited = 0 WHERE id = ?", [user.id]);
-    } catch {
-    }
-  }
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -593,7 +998,7 @@ authRoutes.post("/login", async (c) => {
       id: user.id,
       email: user.email,
       name: user.name,
-      is_admin: isLicenseAdminEmail(user.email)
+      is_admin: isServerAdminEmail(user.email)
     }
   });
 });
@@ -601,6 +1006,11 @@ authRoutes.post("/logout", async (c) => {
   const sessionId = getSessionIdFromRequest(c);
   if (sessionId) await deleteSession(sessionId);
   clearSessionCookie(c);
+  c.header(
+    "Set-Cookie",
+    buildOidcMarkerCookie({ secure: isSecureRequest(c), clear: true }),
+    { append: true }
+  );
   return c.json({ ok: true });
 });
 authRoutes.post("/keys", authMiddleware, async (c) => {
@@ -623,7 +1033,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     );
   }
   const apiKey = generateApiKey();
-  const keyId = uuid();
+  const keyId = uuid2();
   await db.run(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
     [
@@ -641,17 +1051,16 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
-  const body = await c.req.json().catch(
-    () => ({})
-  );
+  const body = await c.req.json().catch(() => ({}));
   const db = getDb();
   const userId = c.get("userId");
   const apiKey = generateApiKey();
-  const keyId = uuid();
+  const keyId = uuid2();
   const prior = await db.get(
     "SELECT label, nest_id FROM api_keys WHERE user_id = ?",
     [userId]
   );
+  const nestScope = "nest_id" in body ? body.nest_id || null : prior?.nest_id ?? null;
   await db.transaction(async (tx) => {
     await tx.run("DELETE FROM api_keys WHERE user_id = ?", [userId]);
     await tx.run(
@@ -661,7 +1070,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
         userId,
         hashApiKey(apiKey),
         getKeyPrefix(apiKey),
-        body.nest_id ?? prior?.nest_id ?? null,
+        nestScope,
         body.label ?? prior?.label ?? null
       ]
     );
@@ -693,14 +1102,21 @@ authRoutes.post("/device", async (c) => {
   if (!tryConsume(`device:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return c.json({ error: "Too many device auth attempts, try again later" }, 429);
   }
-  const body = await c.req.json();
+  const body = await c.req.json().catch(() => ({}));
   const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
   const res = await fetch(`${promptowlUrl}/api/auth/device`, {
     method: "POST",
     headers: config.PROMPTOWL_FETCH_HEADERS,
     body: JSON.stringify({
       deviceName: body.deviceName || "ContextNest Community",
-      deviceType: body.deviceType || "webapp"
+      deviceType: body.deviceType || "webapp",
+      // Ask for the least this server can work with: read the profile (to
+      // identify who signed in) and read teams (to import them). The token we
+      // then hold — and park in the user's cookie — is refused by every other
+      // PromptOwl endpoint, so it can't chat as the user or spend their
+      // credits even if it leaks. An older PromptOwl ignores the field and
+      // returns an unscoped token, which still works.
+      scopes: PROMPTOWL_SCOPES
     })
   });
   const data = await res.json();
@@ -753,6 +1169,16 @@ authRoutes.post("/promptowl", async (c) => {
   if (!result.ok) {
     return c.json({ error: result.error, gate: result.gate }, result.status);
   }
+  c.header(
+    "Set-Cookie",
+    buildPromptowlTokenCookie(body.token, { secure: isSecureRequest(c) }),
+    { append: true }
+  );
+  c.header(
+    "Set-Cookie",
+    buildPromptowlMarkerCookie({ secure: isSecureRequest(c) }),
+    { append: true }
+  );
   return c.json({
     user: {
       id: result.user.id,
@@ -843,7 +1269,7 @@ authRoutes.get("/admin-status", async (c) => {
       me = {
         email: row.email,
         name: row.name,
-        is_admin: isLicenseAdminEmail(row.email)
+        is_admin: isServerAdminEmail(row.email)
       };
     }
   }
@@ -890,9 +1316,9 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!await isLicenseAdminUserId(callerId)) {
+  if (!await isServerAdminUserId(callerId)) {
     return c.json(
-      { error: "Only the license-admin user can reset passwords." },
+      { error: "Only a server admin can reset passwords." },
       403
     );
   }
@@ -903,6 +1329,12 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
     [targetId]
   );
   if (!target) return c.json({ error: "User not found" }, 404);
+  if (target.id !== callerId && isServerAdminEmail(target.email)) {
+    return c.json(
+      { error: "This user is a server admin \u2014 admins can't reset each other's passwords. They can change their own via their account." },
+      403
+    );
+  }
   let supplied;
   try {
     supplied = (await c.req.json()).password;
@@ -912,7 +1344,7 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   if (supplied !== void 0) {
     assertValidPassword(supplied);
   }
-  const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
+  const generated = supplied ? null : uuid2().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
   await db.transaction(async (tx) => {
@@ -936,9 +1368,9 @@ authRoutes.delete("/users/:userId", async (c) => {
   if (!callerId) {
     return c.json({ error: "Authentication required." }, 401);
   }
-  if (!await isLicenseAdminUserId(callerId)) {
+  if (!await isServerAdminUserId(callerId)) {
     return c.json(
-      { error: "Only the license-admin user can remove users." },
+      { error: "Only a server admin can remove users." },
       403
     );
   }
@@ -952,6 +1384,12 @@ authRoutes.delete("/users/:userId", async (c) => {
     [targetId]
   );
   if (!target) return c.json({ error: "User not found" }, 404);
+  if (isServerAdminEmail(target.email)) {
+    return c.json(
+      { error: "This user is a server admin \u2014 admins can't remove each other. Revoke their superadmin access first." },
+      403
+    );
+  }
   const ownedNests = (await db.get(
     "SELECT COUNT(*) AS c FROM nests WHERE user_id = ?",
     [target.id]
@@ -994,10 +1432,10 @@ authRoutes.post("/invite", async (c) => {
     );
   }
   const db = getDb();
-  if (!await isLicenseAdminUserId(callerId)) {
+  if (!await isServerAdminUserId(callerId)) {
     return c.json(
       {
-        error: "Only the license-admin user can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
+        error: "Only a server admin can invite teammates. Contact the admin who installed the PromptOwl license on this server to issue invitations."
       },
       403
     );
@@ -1014,7 +1452,7 @@ authRoutes.post("/invite", async (c) => {
       409
     );
   }
-  const tempPassword = uuid().replace(/-/g, "").slice(0, 16);
+  const tempPassword = uuid2().replace(/-/g, "").slice(0, 16);
   const passwordHash = await hashPassword(tempPassword);
   let userId;
   if (existing) {
@@ -1024,7 +1462,7 @@ authRoutes.post("/invite", async (c) => {
       userId
     ]);
   } else {
-    userId = uuid();
+    userId = uuid2();
     await db.run(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
       [userId, email, null, passwordHash]
@@ -1051,10 +1489,10 @@ authRoutes.get("/teammates", async (c) => {
     );
   }
   const db = getDb();
-  if (!await isLicenseAdminUserId(callerId)) {
+  if (!await isServerAdminUserId(callerId)) {
     return c.json(
       {
-        error: "Only the license-admin user can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
+        error: "Only a server admin can view the teammates list. Contact the admin who installed the PromptOwl license on this server."
       },
       403
     );
@@ -1084,7 +1522,7 @@ authRoutes.get("/teammates", async (c) => {
           )
         ORDER BY s.user_email`
   );
-  const enriched = teammates.map((t) => ({ ...t, is_admin: isLicenseAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
+  const enriched = teammates.map((t) => ({ ...t, is_admin: isServerAdminEmail(t.email) })).sort((a, b) => Number(b.is_admin) - Number(a.is_admin));
   return c.json({
     teammates: enriched,
     pending_stewards: pendingStewards.map((p) => p.email)
@@ -1092,15 +1530,17 @@ authRoutes.get("/teammates", async (c) => {
 });
 
 // src/nests/routes.ts
-import { Hono as Hono2 } from "hono";
+import { Hono as Hono3 } from "hono";
+import { streamText } from "hono/streaming";
 
 // src/nodes/service.ts
 import {
   serializeDocument,
-  parseDocument as parseDocument2
+  parseDocument as parseDocument2,
+  normalizeStatus
 } from "@promptowl/contextnest-engine";
-import { rename, mkdir } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { rename, mkdir, rm } from "fs/promises";
+import { dirname, join as join2, basename } from "path";
 
 // src/governance/tag-index-service.ts
 function normalizeTag(raw) {
@@ -1318,7 +1758,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-A2YAKYQW.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1413,6 +1853,20 @@ function folderToSegments(folder) {
   return segments;
 }
 var stripUndefined = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+async function departmentTagFor(userEmail) {
+  if (!config.OIDC_DEPARTMENT_TAGGING) return null;
+  try {
+    const row = await getDb().get(
+      "SELECT department FROM users WHERE LOWER(email) = LOWER(?)",
+      [userEmail]
+    );
+    const slug = slugify(String(row?.department ?? ""));
+    return slug ? normalizeTag2(`dept:${slug}`) : null;
+  } catch (err) {
+    console.error("[dept-tag] department lookup failed (tag skipped):", err);
+    return null;
+  }
+}
 var nodeWriteChains = /* @__PURE__ */ new Map();
 function withNodeWriteLock(key, fn) {
   const prev = (nodeWriteChains.get(key) ?? Promise.resolve()).catch(() => {
@@ -1463,6 +1917,59 @@ function toNodeResponse(node) {
     schedule: fm.metadata?.schedule != null ? String(fm.metadata.schedule) : void 0
   };
 }
+async function resolveAuthorship(nestId, nodes) {
+  const result = /* @__PURE__ */ new Map();
+  if (nodes.length === 0) return result;
+  const db = getDb();
+  const single = nodes.length === 1 ? nodes[0].id : null;
+  const versionRows = await db.all(
+    `SELECT node_id, author, MIN(version) AS first_version
+       FROM node_versions
+      WHERE nest_id = ?${single ? " AND node_id = ?" : ""}
+        AND author IS NOT NULL AND author NOT LIKE 'system:%'
+      GROUP BY node_id, author`,
+    single ? [nestId, single] : [nestId]
+  );
+  const grantRows = await db.all(
+    `SELECT g.target AS node_id, u.email AS email
+       FROM grants g
+       JOIN users u ON u.id = g.user_id
+      WHERE g.nest_id = ? AND g.target_type = 'document'${single ? " AND g.target = ?" : ""}`,
+    single ? [nestId, single] : [nestId]
+  );
+  const editorsByNode = /* @__PURE__ */ new Map();
+  for (const r of versionRows) {
+    let list = editorsByNode.get(r.node_id);
+    if (!list) editorsByNode.set(r.node_id, list = []);
+    list.push({ author: r.author, first: Number(r.first_version) });
+  }
+  const granteesByNode = /* @__PURE__ */ new Map();
+  for (const g of grantRows) {
+    let list = granteesByNode.get(g.node_id);
+    if (!list) granteesByNode.set(g.node_id, list = []);
+    list.push(g.email);
+  }
+  for (const n of nodes) {
+    const editors = editorsByNode.get(n.id) ?? [];
+    const firstAuthor = editors.length ? editors.reduce((a, b) => b.first < a.first ? b : a).author : null;
+    const author = n.frontmatterAuthor || firstAuthor;
+    const authorKey = author ? author.toLowerCase() : null;
+    const seen = /* @__PURE__ */ new Set();
+    const collaborators = [];
+    for (const email of [
+      ...editors.map((e) => e.author),
+      ...granteesByNode.get(n.id) ?? []
+    ]) {
+      const key = email.toLowerCase();
+      if (key === authorKey || seen.has(key)) continue;
+      seen.add(key);
+      collaborators.push(email);
+    }
+    collaborators.sort((a, b) => a.localeCompare(b));
+    result.set(n.id, { author: author ?? null, collaborators });
+  }
+  return result;
+}
 async function listNodesForCaller(nestId, userId, filters = {}) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
   let documents = await storage.discoverDocuments();
@@ -1485,9 +1992,21 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
     accessible = grants.length ? documents.filter((d) => grantCoversNode(grants, d.id)) : accessible;
   }
   const publicReader = await isPublicReader(nestId, userId);
+  const authorship = publicReader ? null : await resolveAuthorship(
+    nestId,
+    accessible.map((d) => ({
+      id: d.id,
+      frontmatterAuthor: d.frontmatter.author ?? null
+    }))
+  );
   const enriched = await Promise.all(
     accessible.map(async (doc) => {
       const r = toNodeResponse(doc);
+      const people = authorship?.get(doc.id);
+      if (people) {
+        r.author = people.author;
+        r.collaborators = people.collaborators;
+      }
       if (publicReader) {
         const approved = await getApprovedVersion(nestId, doc.id);
         if (approved != null) {
@@ -1546,6 +2065,13 @@ async function createNode(nestId, input, userEmail) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
+  const requestedType = input.type || "document";
+  if (requestedType === "artifact" && !config.TYPE_ARTIFACT_ENABLED) {
+    throw new ValidationError("Artifact nodes are disabled on this server");
+  }
+  if (requestedType === "table" && !config.TYPE_TABLE_ENABLED) {
+    throw new ValidationError("Table nodes are disabled on this server");
+  }
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
       `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
@@ -1553,6 +2079,10 @@ async function createNode(nestId, input, userEmail) {
       )})`
     );
   }
+  const deptTag = await departmentTagFor(userEmail);
+  if (deptTag && !tags.some((t) => t.toLowerCase() === deptTag)) {
+    tags.push(deptTag);
+  }
   const hasStewards = await isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "published";
   const initialVersion = hasStewards ? 1 : 0;
@@ -1561,7 +2091,7 @@ async function createNode(nestId, input, userEmail) {
     filePath: "",
     frontmatter: {
       title: input.title,
-      type: input.type || "document",
+      type: requestedType,
       tags,
       status: input.status || initialStatus,
       version: initialVersion,
@@ -1628,7 +2158,27 @@ async function createNode(nestId, input, userEmail) {
   await trackEvent("node.create", { nestId, nodeId: id });
   return { node, version: savedVersion };
 }
-async function registerImportedDocuments(nestId, userEmail) {
+function explicitFrontmatterStatus(raw) {
+  const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fm) return null;
+  const m = fm[1].match(/^status:[ \t]*["']?([A-Za-z_-]+)["']?[ \t]*$/m);
+  return m ? normalizeStatus(m[1]) : null;
+}
+async function resetImportedDocForPublish(storage, nestId, nodeId) {
+  const versionsDir = join2(
+    resolveNestPath(nestId),
+    dirname(nodeId),
+    ".versions",
+    basename(nodeId)
+  );
+  await rm(versionsDir, { recursive: true, force: true });
+  const node = await storage.readDocument(nodeId);
+  const fm = { ...node.frontmatter };
+  delete fm.version;
+  delete fm.checksum;
+  await storage.writeDocument(nodeId, serializeDocument({ ...node, frontmatter: fm }));
+}
+async function registerImportedDocuments(nestId, userEmail, onProgress) {
   const { storage } = await engineCache.get(nestId);
   let docs;
   try {
@@ -1637,24 +2187,52 @@ async function registerImportedDocuments(nestId, userEmail) {
     console.error("registerImportedDocuments: discovery failed", nestId, err);
     return 0;
   }
+  const startedAt = Date.now();
+  console.log(`[import] register: discovered=${docs.length} nest=${nestId}`);
+  await onProgress?.(0, docs.length);
   let registered = 0;
+  let alreadyTracked = 0;
+  let publishFailed = 0;
+  let publishRecovered = 0;
+  let keptUnpublished = 0;
+  let processed = 0;
   for (let doc of docs) {
     const nodeId = doc.id;
-    if (await getCurrentVersion(nestId, nodeId) > 0) continue;
-    if (!doc.frontmatter?.title) {
-      const title = nodeId.split("/").pop() || nodeId;
-      doc = { ...doc, frontmatter: { ...doc.frontmatter, title } };
-      try {
-        await storage.writeDocument(nodeId, serializeDocument(doc));
-      } catch (err) {
-        console.error("import: failed to persist filename title", nodeId, err);
-      }
+    await onProgress?.(++processed, docs.length);
+    if (await getCurrentVersion(nestId, nodeId) > 0) {
+      alreadyTracked++;
+      continue;
+    }
+    const title = doc.frontmatter?.title ?? (nodeId.split("/").pop() || nodeId);
+    doc = { ...doc, frontmatter: { ...doc.frontmatter, title, author: userEmail } };
+    try {
+      await storage.writeDocument(nodeId, serializeDocument(doc));
+    } catch (err) {
+      console.error("import: failed to persist import metadata", nodeId, err);
     }
     const rawTags = Array.isArray(doc.frontmatter?.tags) ? doc.frontmatter.tags : [];
     const tags = rawTags.map((t) => normalizeTag2(String(t)));
     const fmVersion = Number(doc.frontmatter?.version);
-    let version = Number.isFinite(fmVersion) && fmVersion > 0 ? fmVersion : 1;
+    let version = Number.isInteger(fmVersion) && fmVersion > 0 ? fmVersion : 1;
     let content = doc.body || "";
+    const status = explicitFrontmatterStatus(doc.rawContent);
+    if (status && status !== "published" && status !== "approved") {
+      await createVersion({
+        nestId,
+        nodeId,
+        version,
+        content,
+        author: userEmail,
+        status: "draft",
+        changeNote: "Imported from existing folder (kept unpublished)",
+        tags
+      });
+      await syncNodeTags(nestId, nodeId, tags);
+      keptUnpublished++;
+      registered++;
+      continue;
+    }
+    let published = false;
     try {
       const result = await safePublishDocument(storage, nodeId, {
         editedBy: userEmail,
@@ -1662,12 +2240,29 @@ async function registerImportedDocuments(nestId, userEmail) {
       });
       version = result.node.frontmatter.version || version;
       content = result.node.body || content;
+      published = true;
     } catch (err) {
-      console.error(
-        "safePublishDocument failed (import register)",
-        nodeId,
-        err
+      console.warn(
+        `[import] publish retry needed for ${nodeId}: ${err?.message ?? err}`
       );
+      try {
+        await resetImportedDocForPublish(storage, nestId, nodeId);
+        const result = await safePublishDocument(storage, nodeId, {
+          editedBy: userEmail,
+          note: "Imported from existing folder (reset chain)"
+        });
+        version = result.node.frontmatter.version || 1;
+        content = result.node.body || content;
+        published = true;
+        publishRecovered++;
+      } catch (err2) {
+        publishFailed++;
+        console.error(
+          "reset+republish failed (import register)",
+          nodeId,
+          err2
+        );
+      }
     }
     await createVersion({
       nestId,
@@ -1675,14 +2270,19 @@ async function registerImportedDocuments(nestId, userEmail) {
       version,
       content,
       author: userEmail,
-      status: "published",
+      status: published ? "published" : "draft",
       changeNote: "Imported from existing folder",
       tags
     });
-    await setApprovedVersion(nestId, nodeId, version, userEmail);
+    if (published) {
+      await setApprovedVersion(nestId, nodeId, version, userEmail);
+    }
     await syncNodeTags(nestId, nodeId, tags);
     registered++;
   }
+  console.log(
+    `[import] register done: registered=${registered} alreadyTracked=${alreadyTracked} keptUnpublished=${keptUnpublished} publishRecovered=${publishRecovered} publishFailed=${publishFailed} tookMs=${Date.now() - startedAt}`
+  );
   await trackEvent("nest.import.documents", { nestId, registered });
   return registered;
 }
@@ -2147,7 +2747,7 @@ async function effectivePermission(nestId, userId) {
   }
   return resolveNestPermission(nestId, userId);
 }
-var nestRoutes = new Hono2();
+var nestRoutes = new Hono3();
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const owned = await listNests(userId);
@@ -2168,8 +2768,11 @@ nestRoutes.get("/", async (c) => {
         await getCollaboratorRole(n.id, callerEmail)
       );
       const stewardRoles = await getStewardRolesForUser(n.id, callerEmail);
+      const teamRoles = await resolveTeamRolesForUser(n.id, userId);
       roles = [
-        ...new Set([grantRole, ...stewardRoles].filter(Boolean))
+        ...new Set(
+          [grantRole, ...stewardRoles, ...teamRoles].filter(Boolean)
+        )
       ];
     }
     if (!is_owner && n.user_id !== ANON_USER_ID) {
@@ -2252,6 +2855,31 @@ nestRoutes.post("/:nestId", async (c) => {
   }
   const files = Array.isArray(body.files) ? body.files : [];
   const userId = c.get("userId");
+  console.log(
+    `[import] request: name=${JSON.stringify(body.name)} files=${files.length}`
+  );
+  if (c.req.query("stream") === "1") {
+    const name = body.name;
+    return streamText(c, async (stream) => {
+      try {
+        await stream.writeln(JSON.stringify({ phase: "write" }));
+        const nest2 = await importNest(userId, name, files);
+        const email = await resolveCallerEmail(userId);
+        const documents2 = await registerImportedDocuments(
+          nest2.id,
+          email,
+          async (done, total) => {
+            await stream.writeln(JSON.stringify({ phase: "register", done, total }));
+          }
+        );
+        await stream.writeln(JSON.stringify({ complete: true, nest: nest2, documents: documents2 }));
+      } catch (err) {
+        await stream.writeln(
+          JSON.stringify({ error: err?.message || "Import failed" })
+        );
+      }
+    });
+  }
   const nest = await importNest(userId, body.name, files);
   const documents = await registerImportedDocuments(
     nest.id,
@@ -2261,7 +2889,7 @@ nestRoutes.post("/:nestId", async (c) => {
 });
 async function handleUnsyncedList(c) {
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can list unsynced folders");
   }
   return c.json({ folders: listUnsyncedFolders() });
@@ -2271,7 +2899,7 @@ nestRoutes.post("/:nestId/sync", async (c) => {
     throw new NotFoundError("Not found");
   }
   const userId = c.get("userId");
-  if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
+  if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can sync folders");
   }
   const body = await c.req.json();
@@ -2391,10 +3019,10 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
 });
 
 // src/nests/sharing-routes.ts
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono4 } from "hono";
 
 // src/nests/sharing-service.ts
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 var VALID_PERMISSIONS = ["read", "write", "admin"];
 async function addCollaborator(params) {
   const { nestId } = params;
@@ -2418,10 +3046,10 @@ async function addCollaborator(params) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
-      userId = uuid2();
+      userId = uuid3();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid2())]
+        [userId, email, null, await hashPassword2(uuid3())]
       );
     }
   }
@@ -2459,7 +3087,7 @@ async function addCollaborator(params) {
     [params.grantedByEmail]
   ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
-  const collabId = uuid2();
+  const collabId = uuid3();
   await db.run(
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
     [collabId, nestId, userId, params.permission, granterId]
@@ -2484,18 +3112,8 @@ async function addCollaborator(params) {
   );
 }
 
-// src/shared/base-url.ts
-function requestBaseUrl(reqUrl) {
-  if (config.PUBLIC_BASE_URL) return config.PUBLIC_BASE_URL;
-  try {
-    return new URL(reqUrl).origin;
-  } catch {
-    return "";
-  }
-}
-
 // src/nests/sharing-routes.ts
-var sharingRoutes = new Hono3();
+var sharingRoutes = new Hono4();
 sharingRoutes.get("/collaborators", async (c) => {
   const db = getDb();
   const nestId = c.req.param("nestId");
@@ -2582,9 +3200,9 @@ sharingRoutes.patch("/visibility", async (c) => {
 });
 
 // src/nests/grant-routes.ts
-import { Hono as Hono4 } from "hono";
-import { v4 as uuid3 } from "uuid";
-var grantRoutes = new Hono4();
+import { Hono as Hono5 } from "hono";
+import { v4 as uuid4 } from "uuid";
+var grantRoutes = new Hono5();
 async function requireManage(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
     throw new ForbiddenError(
@@ -2598,10 +3216,10 @@ async function resolveGrantee(email) {
   const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
   if (existing) return existing.id;
   const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
-  const id = uuid3();
+  const id = uuid4();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid3())]
+    [id, e, null, await hashPassword2(uuid4())]
   );
   return id;
 }
@@ -2652,10 +3270,347 @@ grantRoutes.delete("/:id", async (c) => {
   return c.json({ deleted: true });
 });
 
+// src/nests/nest-team-routes.ts
+import { Hono as Hono6 } from "hono";
+var nestTeamRoutes = new Hono6();
+nestTeamRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const refs = await listNestTeams(nestId);
+  const teams = [];
+  for (const ref of refs) {
+    const team = await getTeam(ref.teamId).catch(() => null);
+    teams.push({
+      teamId: ref.teamId,
+      teamName: team?.name ?? ref.teamName,
+      members: team?.members ?? []
+    });
+  }
+  return c.json({ teams });
+});
+nestTeamRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.team_id) {
+    throw new ValidationError("team_id is required");
+  }
+  const userId = c.get("userId");
+  const teams = await shareTeamWithNest({
+    nestId: c.req.param("nestId"),
+    teamId: body.team_id,
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ teams }, 201);
+});
+nestTeamRoutes.delete("/:teamId", async (c) => {
+  const teams = await unshareTeamFromNest({
+    nestId: c.req.param("nestId"),
+    teamId: c.req.param("teamId")
+  });
+  return c.json({ teams });
+});
+
+// src/governance/team-routes.ts
+import { Hono as Hono7 } from "hono";
+
+// src/governance/promptowl-teams.ts
+var PROMPTOWL_SOURCE = "promptowl";
+var IMPORTABLE_PROMPTOWL_ROLES = ["owner", "editor"];
+function canImportPromptowlTeam(team) {
+  return IMPORTABLE_PROMPTOWL_ROLES.includes(
+    (team.your_role || "").toLowerCase()
+  );
+}
+function mapPromptowlRole(role) {
+  switch ((role || "").toLowerCase()) {
+    case "owner":
+      return "admin";
+    case "editor":
+      return "editor";
+    default:
+      return "viewer";
+  }
+}
+async function fetchOwnedPromptowlTeams(token) {
+  if (!token?.trim()) throw new ValidationError("token is required");
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  let res;
+  try {
+    res = await fetch(`${promptowlUrl}/api/user/teams`, {
+      headers: {
+        ...config.PROMPTOWL_FETCH_HEADERS,
+        Authorization: `Bearer ${token}`
+      }
+    });
+  } catch {
+    throw new ValidationError("Could not reach PromptOwl. Check this server's network access.");
+  }
+  if (res.status === 401) {
+    throw new UnauthorizedError(
+      "PromptOwl rejected this approval. Approve again and retry."
+    );
+  }
+  if (!res.ok) {
+    throw new ValidationError(
+      `PromptOwl could not list your teams (HTTP ${res.status}).`
+    );
+  }
+  const data = await res.json();
+  return Array.isArray(data.teams) ? data.teams : [];
+}
+async function syncPromptowlTeams(params) {
+  if (!params.teamIds?.length) {
+    throw new ValidationError("team_ids is required");
+  }
+  const owned = await fetchOwnedPromptowlTeams(params.token);
+  const byId = new Map(owned.map((t) => [t.id, t]));
+  const selected = [];
+  for (const id of params.teamIds) {
+    const team = byId.get(id);
+    if (!team) {
+      throw new ValidationError(
+        "One of the selected teams isn't available to import. Refresh the list and try again."
+      );
+    }
+    if (!canImportPromptowlTeam(team)) {
+      throw new ForbiddenError(
+        `You're view-only on "${team.name}" in PromptOwl, so you can't import it. Ask an owner or editor of that team to import it.`
+      );
+    }
+    selected.push(team);
+  }
+  const db = getDb();
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+    params.callerUserId
+  ]);
+  if (!caller?.email) {
+    throw new ValidationError("Could not resolve your account.");
+  }
+  const results = [];
+  for (const poTeam of selected) {
+    results.push(await syncOne(poTeam, params.callerUserId, caller.email));
+  }
+  return results;
+}
+async function syncOne(poTeam, callerUserId, callerEmail) {
+  const existing = await findTeamByExternalId({
+    ownerId: callerUserId,
+    source: PROMPTOWL_SOURCE,
+    externalId: poTeam.id
+  });
+  const team = existing ?? await createTeam({
+    name: poTeam.name,
+    ownerId: callerUserId,
+    source: PROMPTOWL_SOURCE,
+    externalId: poTeam.id
+  });
+  if (existing && existing.name !== poTeam.name) {
+    await renameTeam({
+      teamId: team.id,
+      name: poTeam.name,
+      callerUserId,
+      allowAdmin: false
+    });
+  }
+  const desired = await desiredRoster(poTeam, callerEmail);
+  const before = new Map(team.members.map((m) => [m.email, m.role]));
+  const after = new Map(desired.map((m) => [m.email, m.role]));
+  const added = [...after.keys()].filter((e) => !before.has(e));
+  const removed = [...before.keys()].filter((e) => !after.has(e));
+  const updated = [...after.keys()].filter(
+    (e) => before.has(e) && before.get(e) !== after.get(e)
+  );
+  if (added.length || removed.length || updated.length) {
+    await replaceTeamRoster({
+      teamId: team.id,
+      members: desired,
+      callerUserId,
+      allowAdmin: false
+    });
+  }
+  return {
+    team_id: team.id,
+    external_id: poTeam.id,
+    name: poTeam.name,
+    created: !existing,
+    added,
+    removed,
+    updated
+  };
+}
+async function desiredRoster(poTeam, callerEmail) {
+  const caller = normalizeEmail(callerEmail);
+  const roster = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const poMember of poTeam.members || []) {
+    if (!poMember?.email) continue;
+    const email = normalizeEmail(poMember.email);
+    if (email === caller || seen.has(email)) continue;
+    seen.add(email);
+    const identity = await resolveMemberIdentity({ email });
+    roster.push({
+      userId: identity.userId,
+      email: identity.email,
+      role: mapPromptowlRole(poMember.role)
+    });
+  }
+  return roster;
+}
+
+// src/governance/team-routes.ts
+var teamRoutes = new Hono7();
+var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+var CONNECT_REQUIRED = "promptowl_connect_required";
+var CONNECT_REQUIRED_STATUS = 428;
+async function withPromptowlToken(c, run) {
+  if (!config.PROMPTOWL_TEAMS_ENABLED) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  if (!tryConsume(`po-teams:ip:${clientIp(c)}`, PROMPTOWL_LIMIT)) {
+    return c.json({ error: "Too many PromptOwl requests, try again later" }, 429);
+  }
+  const token = getPromptowlTokenFromRequest(c);
+  if (!token) {
+    return c.json(
+      {
+        error: "Sign in with PromptOwl to import teams.",
+        code: CONNECT_REQUIRED
+      },
+      CONNECT_REQUIRED_STATUS
+    );
+  }
+  try {
+    return c.json(await run(token));
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      c.header(
+        "Set-Cookie",
+        buildPromptowlTokenCookie("", { secure: isSecureRequest(c), clear: true }),
+        { append: true }
+      );
+      return c.json(
+        { error: err.message, code: CONNECT_REQUIRED },
+        CONNECT_REQUIRED_STATUS
+      );
+    }
+    throw err;
+  }
+}
+teamRoutes.get(
+  "/promptowl",
+  async (c) => withPromptowlToken(c, async (token) => ({
+    teams: await fetchOwnedPromptowlTeams(token)
+  }))
+);
+teamRoutes.post("/promptowl/sync", async (c) => {
+  const body = await c.req.json().catch(() => ({}));
+  return withPromptowlToken(c, async (token) => ({
+    results: await syncPromptowlTeams({
+      callerUserId: c.get("userId"),
+      token,
+      teamIds: body.team_ids ?? []
+    })
+  }));
+});
+teamRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  const team = await createTeam({
+    name: body.name ?? "",
+    ownerId: c.get("userId")
+  });
+  return c.json({ team }, 201);
+});
+teamRoutes.get("/", async (c) => {
+  const teams = await listTeamsForUser(c.get("userId"));
+  return c.json({ teams });
+});
+teamRoutes.get("/:teamId", async (c) => {
+  const userId = c.get("userId");
+  const team = await getTeam(c.req.param("teamId"));
+  const isMember = team.members.some((m) => m.userId === userId);
+  if (team.owner_id !== userId && !isMember && !await isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("You don't have access to this team.");
+  }
+  return c.json({ team });
+});
+teamRoutes.patch("/:teamId", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await renameTeam({
+    teamId: c.req.param("teamId"),
+    name: body.name ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team });
+});
+teamRoutes.delete("/:teamId", async (c) => {
+  const userId = c.get("userId");
+  await deleteTeam({
+    teamId: c.req.param("teamId"),
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ removed: true });
+});
+teamRoutes.post("/:teamId/members", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await addMember({
+    teamId: c.req.param("teamId"),
+    email: body.email,
+    userId: body.user_id,
+    role: body.role ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team }, 201);
+});
+teamRoutes.patch("/:teamId/members/:userId", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await updateMemberRole({
+    teamId: c.req.param("teamId"),
+    userId: c.req.param("userId"),
+    role: body.role ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team });
+});
+teamRoutes.delete("/:teamId/members/:userId", async (c) => {
+  const userId = c.get("userId");
+  const team = await removeMember({
+    teamId: c.req.param("teamId"),
+    userId: c.req.param("userId"),
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team });
+});
+
 // src/nodes/routes.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono8 } from "hono";
+
+// src/shared/artifact-sandbox.ts
+var ARTIFACT_SANDBOX_CSP = [
+  "sandbox allow-scripts allow-popups allow-modals",
+  "default-src 'none'",
+  "script-src 'unsafe-inline'",
+  "style-src 'unsafe-inline'",
+  "img-src data: blob:",
+  "font-src data:",
+  "connect-src 'none'",
+  "base-uri 'none'",
+  "form-action 'none'"
+].join("; ");
+function applyArtifactSandboxHeaders(c) {
+  c.header("Content-Security-Policy", ARTIFACT_SANDBOX_CSP);
+  c.header("X-Content-Type-Options", "nosniff");
+  c.header("Referrer-Policy", "no-referrer");
+}
 
 // src/nodes/markdown-export.ts
+import { parseDocument as parseDocument3 } from "@promptowl/contextnest-engine";
 function nodeToMarkdown(node) {
   const tags = node.tags ?? [];
   return [
@@ -2674,9 +3629,37 @@ function nodesToMarkdown(nodes) {
 function isMarkdownFormat(c) {
   return c.req.query("format") === "markdown";
 }
+function isRawFormat(c) {
+  const format = c.req.query("format");
+  if (format !== void 0) return format === "raw";
+  const accept = c.req.header("Accept") ?? "";
+  return accept.split(",").some((part) => part.trim().split(";")[0].trim().toLowerCase() === "text/markdown");
+}
+var RAW_CONTENT_TYPES = {
+  artifact: "text/html; charset=utf-8",
+  tool: "text/plain; charset=utf-8",
+  table: "text/plain; charset=utf-8"
+};
+function rawContentType(nodeType) {
+  return RAW_CONTENT_TYPES[nodeType || "document"] ?? "text/markdown; charset=utf-8";
+}
+function frontmatterBlockOf(raw) {
+  if (!raw || !raw.startsWith("---")) return "";
+  try {
+    const body = parseDocument3("frontmatter-split.md", raw, "frontmatter-split").body ?? "";
+    if (raw.endsWith(body)) return raw.slice(0, raw.length - body.length);
+  } catch {
+  }
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  return m ? `---
+${m[1]}
+---
+
+` : "";
+}
 
 // src/annotations/service.ts
-import { v4 as uuid4 } from "uuid";
+import { v4 as uuid5 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -2826,7 +3809,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid4();
+  const id = uuid5();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
@@ -2845,7 +3828,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     );
     await tx.run(
       "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-      [uuid4(), id, authorEmail, body]
+      [uuid5(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -2865,7 +3848,7 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   await getScopedThreadRow(threadId, nestId, nodeId);
   await getDb().run(
     "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-    [uuid4(), threadId, authorEmail, trimmed]
+    [uuid5(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -2964,7 +3947,7 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono5();
+var nodeRoutes = new Hono8();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -2974,6 +3957,17 @@ function nodeAsMarkdown(response, nodeId) {
     body: response.content
   });
 }
+function rawNodeBody(c, response, storedRaw) {
+  const body = response.content ?? "";
+  const payload = c.req.query("frontmatter") === "1" ? frontmatterBlockOf(storedRaw) + body : body;
+  c.header("X-Content-Type-Options", "nosniff");
+  if ((response.type || "document") === "artifact") {
+    applyArtifactSandboxHeaders(c);
+  }
+  return c.body(payload, 200, {
+    "Content-Type": rawContentType(response.type)
+  });
+}
 nodeRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -3017,7 +4011,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-D5PDWXBR.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-7BHI2YXB.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -3038,7 +4032,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-A2YAKYQW.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-YQIIQ7FN.js");
   const allVersions = await getVersions2(nestId, nodeId);
   const approved = await getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -3070,7 +4064,7 @@ nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-VLSUT6KK.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-DPN26C47.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -3189,15 +4183,26 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     }
   }
   const response = toNodeResponse(node);
-  if (await isPublicReader(nestId, userId)) {
+  const publicReader = await isPublicReader(nestId, userId);
+  if (!publicReader) {
+    const people = (await resolveAuthorship(nestId, [
+      { id: nodeId, frontmatterAuthor: node.frontmatter?.author ?? null }
+    ])).get(nodeId);
+    if (people) {
+      response.author = people.author;
+      response.collaborators = people.collaborators;
+    }
+  }
+  if (publicReader) {
     const approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
+      let approvedRaw = "";
       try {
-        const raw = await versionManager.reconstructVersion(
+        approvedRaw = await versionManager.reconstructVersion(
           nodeId,
           approved
         );
-        response.content = bodyOnly(nodeId, raw);
+        response.content = bodyOnly(nodeId, approvedRaw);
       } catch (err) {
         console.error(
           "reconstructVersion failed (public single)",
@@ -3209,6 +4214,9 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
       }
       response.version = approved;
       response.status = "published";
+      if (isRawFormat(c)) {
+        return rawNodeBody(c, response, approvedRaw);
+      }
       if (isMarkdownFormat(c)) {
         return c.body(nodeAsMarkdown(response, nodeId), 200, {
           "Content-Type": "text/markdown; charset=utf-8"
@@ -3222,6 +4230,9 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
     const pending = await getPendingReview(nestId, nodeId);
     response.pendingReviewBy = pending?.requestedBy ?? null;
   }
+  if (isRawFormat(c)) {
+    return rawNodeBody(c, response, node.rawContent);
+  }
   if (isMarkdownFormat(c)) {
     return c.body(nodeAsMarkdown(response, nodeId), 200, {
       "Content-Type": "text/markdown; charset=utf-8"
@@ -3347,13 +4358,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono9 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono6();
+var annotationRoutes = new Hono9();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -3461,28 +4472,13 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
   if (type !== null && type !== ARTIFACT_NODE_TYPE) {
     return c.json({ error: "Not a hosted artifact" }, 404);
   }
-  c.header(
-    "Content-Security-Policy",
-    [
-      "sandbox allow-scripts allow-popups allow-modals",
-      "default-src 'none'",
-      "script-src 'unsafe-inline'",
-      "style-src 'unsafe-inline'",
-      "img-src data: blob:",
-      "font-src data:",
-      "connect-src 'none'",
-      "base-uri 'none'",
-      "form-action 'none'"
-    ].join("; ")
-  );
-  c.header("X-Content-Type-Options", "nosniff");
-  c.header("Referrer-Policy", "no-referrer");
+  applyArtifactSandboxHeaders(c);
   if (served != null) c.header("X-Artifact-Snapshot", String(served));
   return c.html(html);
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono10 } from "hono";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 
 // src/tables/service.ts
@@ -4053,7 +5049,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono7();
+var queryRoutes = new Hono10();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -4517,6 +5513,15 @@ queryRoutes.post("/publish", async (c) => {
   if (!body.documents?.length && !body.context_md) {
     throw new ValidationError("documents array or context_md is required");
   }
+  for (const doc of body.documents || []) {
+    const t = doc.type || "document";
+    if (t === "artifact" && !config.TYPE_ARTIFACT_ENABLED) {
+      throw new ValidationError("Artifact nodes are disabled on this server");
+    }
+    if (t === "table" && !config.TYPE_TABLE_ENABLED) {
+      throw new ValidationError("Table nodes are disabled on this server");
+    }
+  }
   const nestId = c.req.param("nestId");
   const { storage } = await engineCache.get(nestId);
   const created = [];
@@ -4565,7 +5570,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono12 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -4645,7 +5650,7 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid7 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 
 // src/shared/node-id.ts
 function assertSafeNodeId(rawId) {
@@ -4672,7 +5677,7 @@ function assertSafeNodeId(rawId) {
 }
 
 // src/workflow/run-service.ts
-import { v4 as uuid5 } from "uuid";
+import { v4 as uuid6 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -4802,7 +5807,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid5()}`;
+  const id = `run_${uuid6()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -4963,8 +5968,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono8 } from "hono";
-import { v4 as uuid6 } from "uuid";
+import { Hono as Hono11 } from "hono";
+import { v4 as uuid7 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -5066,7 +6071,7 @@ async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
     }
   }
 }
-var edgeRoutes = new Hono8();
+var edgeRoutes = new Hono11();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -5134,7 +6139,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid6();
+  const id = uuid7();
   await db.transaction(async (tx) => {
     if (type.is_flow) {
       await assertNoFlowCycle(tx, nestId, fromNode, toNode);
@@ -5526,7 +6531,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid7();
+  const id = uuid8();
   await db.transaction(async (tx) => {
     if (type.is_flow) {
       await assertNoFlowCycle(tx, ctx.nestId, fromNode, toNode);
@@ -5589,7 +6594,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid7(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid8(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -5765,7 +6770,7 @@ var TOOL_DEFINITIONS = [
         },
         type: {
           type: "string",
-          description: "Node type (default: document)"
+          description: "Node type (default: document). Note: artifact and table can be disabled server-wide by an admin \u2014 creating a disabled type is rejected; existing nodes of that type stay readable."
         },
         tags: {
           type: "array",
@@ -6466,19 +7471,19 @@ ${list}`;
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-6H4WUA2F.js");
-        const db = (await import("./client-VZLX4THW.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-PS5RMMEA.js");
+        const db = (await import("./client-YUOEVUFU.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
           const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
-          const { v4: uuid15 } = await import("uuid");
-          const id = uuid15();
+          const { v4: uuid16 } = await import("uuid");
+          const id = uuid16();
           await db.run(
             "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid15())]
+            [id, e, null, await hashPassword2(uuid16())]
           );
           row = { id };
         }
@@ -6496,7 +7501,7 @@ ${list}`;
       }
     }
     case "context_unsynced_list": {
-      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
         return "You don't have permission to list unsynced folders. Server admin only.";
       }
       const folders = listUnsyncedFolders();
@@ -6509,7 +7514,7 @@ ${list}`;
 ${list}`;
     }
     case "context_sync_folder": {
-      if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
+      if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
         return "You don't have permission to sync folders. Server admin only.";
       }
       try {
@@ -6533,7 +7538,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono9();
+var mcpRoutes = new Hono12();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -6599,8 +7604,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono10 } from "hono";
-import { v4 as uuid8 } from "uuid";
+import { Hono as Hono13 } from "hono";
+import { v4 as uuid9 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -6718,7 +7723,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono10();
+var runTriggerRoutes = new Hono13();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -6797,7 +7802,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid8()}`;
+  const id = `run_${uuid9()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -6826,7 +7831,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono10();
+var runListRoutes = new Hono13();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -6858,7 +7863,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono10();
+var runDetailRoutes = new Hono13();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -7001,8 +8006,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono11 } from "hono";
-import { v4 as uuid9 } from "uuid";
+import { Hono as Hono14 } from "hono";
+import { v4 as uuid10 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -7039,7 +8044,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono11();
+var scheduleRoutes = new Hono14();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -7080,7 +8085,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid9()}`;
+  const id = `sch_${uuid10()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -7135,8 +8140,8 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono12 } from "hono";
-import { v4 as uuid10 } from "uuid";
+import { Hono as Hono15 } from "hono";
+import { v4 as uuid11 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
@@ -7182,7 +8187,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono12();
+var connectorRoutes = new Hono15();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -7201,7 +8206,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid10()}`;
+  const id = `con_${uuid11()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -7244,7 +8249,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono16 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -7267,7 +8272,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono13();
+var hookNestRoutes = new Hono16();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -7341,7 +8346,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono13();
+var hookFireRoutes = new Hono16();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -7441,9 +8446,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono14 } from "hono";
-import { v4 as uuid11 } from "uuid";
-var definitionRoutes = new Hono14();
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid12 } from "uuid";
+var definitionRoutes = new Hono17();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -7522,7 +8527,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid11();
+      targetId = uuid12();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -7551,41 +8556,69 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono15 } from "hono";
-import { v4 as uuid12 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid13 } from "uuid";
 import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
 import { join as join4 } from "path";
-var assetRoutes = new Hono15();
+var assetRoutes = new Hono18();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
   jpeg: "image/jpeg",
   gif: "image/gif",
-  webp: "image/webp"
+  webp: "image/webp",
+  mp4: "video/mp4",
+  webm: "video/webm"
 };
-var SAFE_NAME = /^[0-9a-f-]{36}\.(png|jpe?g|gif|webp)$/;
+var VIDEO_EXTS = /* @__PURE__ */ new Set(["mp4", "webm"]);
+var IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+var VIDEO_MAX_BYTES = 100 * 1024 * 1024;
+var ASSET_MAX_REQUEST_BYTES = VIDEO_MAX_BYTES + 1024 * 1024;
+var SAFE_NAME = /^[0-9a-f-]{36}\.(png|jpe?g|gif|webp|mp4|webm)$/;
 assetRoutes.post("/", async (c) => {
   const nestId = c.req.param("nestId");
+  const lenStr = c.req.header("Content-Length");
+  if (lenStr) {
+    const len = parseInt(lenStr, 10);
+    if (Number.isFinite(len) && len > ASSET_MAX_REQUEST_BYTES) {
+      throw new ValidationError(
+        `upload too large (${(len / (1024 * 1024)).toFixed(1)} MB, max ${VIDEO_MAX_BYTES / (1024 * 1024)} MB for video, ${IMAGE_MAX_BYTES / (1024 * 1024)} MB for images)`
+      );
+    }
+  }
   const body = await c.req.parseBody();
   const file = body["file"];
   if (!(file instanceof File)) {
-    throw new ValidationError('multipart field "file" (an image) is required');
+    throw new ValidationError(
+      'multipart field "file" (an image or video) is required'
+    );
   }
   const ext = (file.name.split(".").pop() || "").toLowerCase();
   if (!CONTENT_TYPES[ext]) {
     throw new ValidationError(
-      `unsupported image type ".${ext}" \u2014 allowed: ${Object.keys(CONTENT_TYPES).join(", ")}`
+      `unsupported asset type ".${ext}" \u2014 allowed: ${Object.keys(CONTENT_TYPES).join(", ")}`
+    );
+  }
+  const isVideo = VIDEO_EXTS.has(ext);
+  const maxBytes = isVideo ? VIDEO_MAX_BYTES : IMAGE_MAX_BYTES;
+  if (file.size > maxBytes) {
+    throw new ValidationError(
+      `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid12()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const name = `${uuid13()}.${ext === "jpeg" ? "jpg" : ext}`;
   const dir = join4(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
   await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
+  const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
       file: name,
-      url: `/nests/${nestId}/assets/${name}`,
-      markdown: `![${file.name.replace(/\.[^.]+$/, "")}](/nests/${nestId}/assets/${name})`
+      url,
+      // Ready-to-paste reference: image syntax for images; videos are
+      // referenced by bare URL on its own line (the read view upgrades
+      // same-origin asset video URLs to a <video> player).
+      markdown: isVideo ? url : `![${file.name.replace(/\.[^.]+$/, "")}](${url})`
     },
     201
   );
@@ -7606,12 +8639,15 @@ assetRoutes.get("/:file", async (c) => {
   return c.body(new Uint8Array(bytes), 200, {
     "Content-Type": CONTENT_TYPES[ext],
     // uuid names never change content — cache hard.
-    "Cache-Control": "public, max-age=31536000, immutable"
+    "Cache-Control": "public, max-age=31536000, immutable",
+    // Never let the browser second-guess the declared type on direct
+    // navigation (same posture as annotation attachments).
+    "X-Content-Type-Options": "nosniff"
   });
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono19 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
@@ -7852,7 +8888,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono16();
+var serverMcpRoutes = new Hono19();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -7874,7 +8910,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono16();
+var nestIndexRoutes = new Hono19();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -7944,6 +8980,7 @@ Other read endpoints (all under \`${B}/nests/<nest-id>\`):
 - \`GET /search?q=<terms>\` \u2014 full-text search
 - \`GET /overview\` \u2014 node count, types, tags
 - \`GET /nodes\` \u2014 list; \`GET /nodes/<node-id>?format=markdown\` \u2014 one document
+- \`GET /nodes/<node-id>?format=raw\` \u2014 direct consumption path: the node BODY as plain text (no JSON envelope; add \`&frontmatter=1\` for the stored YAML block)
 - \`GET /export?format=markdown\` \u2014 whole nest as one markdown file (optional \`selector\`, \`max_tokens\`)
 - \`GET /graph\` \u2014 ontology graph (nodes, links, tags, stewards)
 
@@ -7996,17 +9033,145 @@ npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono16();
+var llmsTxtRoutes = new Hono19();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono20 } from "hono";
+
+// src/governance/feed-service.ts
+var SNIPPET_CHARS = 200;
+function snippet(body) {
+  const flat = body.replace(/\s+/g, " ").trim();
+  return flat.length > SNIPPET_CHARS ? `${flat.slice(0, SNIPPET_CHARS)}\u2026` : flat;
+}
+async function getNestFeed(params) {
+  const db = getDb();
+  const filter = params.filter ?? "all";
+  const limit = Number.isFinite(params.limit) && params.limit > 0 ? Math.min(params.limit, 200) : 50;
+  const offset = Number.isFinite(params.offset) && params.offset > 0 ? params.offset : 0;
+  const fetchWindow = offset + limit;
+  const titles = await buildTitleMap(params.nestId);
+  let changes = [];
+  let changesTotal = 0;
+  {
+    changesTotal = (await db.get(
+      "SELECT COUNT(*) AS c FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [params.nestId]
+    )).c;
+    if (filter !== "comments" && changesTotal > 0) {
+      const rows = await db.all(
+        `SELECT * FROM review_requests
+          WHERE nest_id = ? AND status = 'pending'
+          ORDER BY requested_at DESC, id DESC
+          LIMIT ?`,
+        [params.nestId, fetchWindow]
+      );
+      const distinctNodeIds = [
+        ...new Set(rows.map((r) => r.node_id))
+      ];
+      const canReviewByNode = new Map(
+        await Promise.all(
+          distinctNodeIds.map(
+            async (nodeId) => [
+              nodeId,
+              (await canUserApprove(params.nestId, nodeId, params.userEmail)).allowed
+            ]
+          )
+        )
+      );
+      changes = rows.map((row) => ({
+        type: "change",
+        id: row.id,
+        nestId: row.nest_id,
+        nodeId: row.node_id,
+        title: titles.get(row.node_id),
+        version: row.version,
+        requestedBy: row.requested_by,
+        requestedAt: row.requested_at,
+        requestNote: row.request_note || void 0,
+        status: row.status,
+        resolvedBy: row.resolved_by || void 0,
+        resolvedAt: row.resolved_at || void 0,
+        resolutionNote: row.resolution_note || void 0,
+        priority: row.priority,
+        canReview: canReviewByNode.get(row.node_id) ?? false,
+        createdAt: row.requested_at
+      }));
+    }
+  }
+  let comments = [];
+  let commentsTotal = 0;
+  {
+    const nodeRows = await db.all(
+      "SELECT DISTINCT node_id AS id FROM annotation_threads WHERE nest_id = ?",
+      [params.nestId]
+    );
+    const accessible = await filterAccessible(
+      params.nestId,
+      params.userId,
+      params.userEmail,
+      nodeRows
+    );
+    if (accessible.length > 0) {
+      const placeholders = accessible.map(() => "?").join(",");
+      const ids = accessible.map((n) => n.id);
+      commentsTotal = (await db.get(
+        `SELECT COUNT(*) AS c
+             FROM annotation_comments c
+             JOIN annotation_threads t ON t.id = c.thread_id
+            WHERE t.nest_id = ? AND t.node_id IN (${placeholders})`,
+        [params.nestId, ...ids]
+      )).c;
+      if (filter !== "changes" && commentsTotal > 0) {
+        const rows = await db.all(
+          `SELECT c.id, c.thread_id, c.author, c.body, c.created_at,
+                  t.node_id, t.status,
+                  CASE WHEN c.id = (
+                    SELECT c2.id FROM annotation_comments c2
+                     WHERE c2.thread_id = c.thread_id
+                     ORDER BY c2.created_at ASC, c2.id ASC LIMIT 1
+                  ) THEN 0 ELSE 1 END AS is_reply
+             FROM annotation_comments c
+             JOIN annotation_threads t ON t.id = c.thread_id
+            WHERE t.nest_id = ? AND t.node_id IN (${placeholders})
+            ORDER BY c.created_at DESC, c.id DESC
+            LIMIT ?`,
+          [params.nestId, ...ids, fetchWindow]
+        );
+        comments = rows.map((row) => ({
+          type: "comment",
+          id: row.id,
+          threadId: row.thread_id,
+          nodeId: row.node_id,
+          title: titles.get(row.node_id),
+          author: row.author,
+          snippet: snippet(row.body),
+          createdAt: row.created_at,
+          resolved: row.status === "resolved",
+          isReply: Number(row.is_reply) === 1
+        }));
+      }
+    }
+  }
+  const merged = [...changes, ...comments].sort((a, b) => {
+    const byTime = b.createdAt.localeCompare(a.createdAt);
+    if (byTime !== 0) return byTime;
+    return b.id.localeCompare(a.id);
+  });
+  const total = filter === "changes" ? changesTotal : filter === "comments" ? commentsTotal : changesTotal + commentsTotal;
+  return {
+    items: merged.slice(offset, offset + limit),
+    total,
+    counts: { changes: changesTotal, comments: commentsTotal }
+  };
+}
 
 // src/governance/comment-service.ts
-import { v4 as uuid13 } from "uuid";
+import { v4 as uuid14 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -8022,7 +9187,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid13();
+  const id = uuid14();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -8307,7 +9472,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono17();
+var governanceRoutes = new Hono20();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -8424,6 +9589,25 @@ governanceRoutes.get("/review-queue", async (c) => {
   }
   return c.json({ ...result, requests });
 });
+governanceRoutes.get("/feed", async (c) => {
+  const nestId = c.req.param("nestId");
+  const filterRaw = c.req.query("filter");
+  const filter = filterRaw === "changes" || filterRaw === "comments" ? filterRaw : "all";
+  const limit = parseLimit(c.req.query("limit"), 50, 200);
+  const offsetRaw = parseInt(c.req.query("offset") ?? "", 10);
+  const offset = Number.isNaN(offsetRaw) || offsetRaw < 0 ? 0 : Math.min(offsetRaw, 1e4);
+  const userId = c.get("userId");
+  const userEmail = await getUserEmail4(c);
+  const result = await getNestFeed({
+    nestId,
+    userId,
+    userEmail,
+    filter,
+    limit,
+    offset
+  });
+  return c.json({ ...result, filter, limit, offset });
+});
 governanceRoutes.get("/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
   const refresh = c.req.query("refresh") === "true";
@@ -8445,7 +9629,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono17();
+var governanceNodeRoutes = new Hono20();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -8597,6 +9781,67 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
     201
   );
 });
+governanceNodeRoutes.post(
+  "/:nodeId{.+}/external-edits/:suggestionId/approve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    const actor = await getUserEmail4(c);
+    try {
+      const result = await approveExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        comment: body.comment
+      });
+      return c.json({
+        approved: true,
+        version: result.versionEntry.version,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      console.error(
+        `[external-edit-route] approve failed nest=${nestId} node=${nodeId} suggestion=${suggestionId}`,
+        { message: err?.message, name: err?.name, stack: err?.stack }
+      );
+      return c.json(
+        { error: err.message, name: err?.name },
+        400
+      );
+    }
+  }
+);
+governanceNodeRoutes.post(
+  "/:nodeId{.+}/external-edits/:suggestionId/reject",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const suggestionId = c.req.param("suggestionId");
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.reason) {
+      throw new ValidationError("Rejection reason is required");
+    }
+    const actor = await getUserEmail4(c);
+    try {
+      const result = await rejectExternalEdit({
+        nestId,
+        documentId: nodeId,
+        suggestionId,
+        actor,
+        reason: body.reason
+      });
+      return c.json({
+        rejected: true,
+        chainEvent: result.chainEvent.event_id
+      });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  }
+);
 governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -8681,67 +9926,6 @@ governanceNodeRoutes.get(
     return c.json({ entry: detail });
   }
 );
-governanceNodeRoutes.post(
-  "/:nodeId{.+}/external-edits/:suggestionId/approve",
-  async (c) => {
-    const nestId = c.req.param("nestId");
-    const nodeId = c.req.param("nodeId");
-    const suggestionId = c.req.param("suggestionId");
-    const body = await c.req.json().catch(() => ({}));
-    const actor = await getUserEmail4(c);
-    try {
-      const result = await approveExternalEdit({
-        nestId,
-        documentId: nodeId,
-        suggestionId,
-        actor,
-        comment: body.comment
-      });
-      return c.json({
-        approved: true,
-        version: result.versionEntry.version,
-        chainEvent: result.chainEvent.event_id
-      });
-    } catch (err) {
-      console.error(
-        `[external-edit-route] approve failed nest=${nestId} node=${nodeId} suggestion=${suggestionId}`,
-        { message: err?.message, name: err?.name, stack: err?.stack }
-      );
-      return c.json(
-        { error: err.message, name: err?.name },
-        400
-      );
-    }
-  }
-);
-governanceNodeRoutes.post(
-  "/:nodeId{.+}/external-edits/:suggestionId/reject",
-  async (c) => {
-    const nestId = c.req.param("nestId");
-    const nodeId = c.req.param("nodeId");
-    const suggestionId = c.req.param("suggestionId");
-    const body = await c.req.json().catch(() => ({}));
-    if (!body.reason) {
-      throw new ValidationError("Rejection reason is required");
-    }
-    const actor = await getUserEmail4(c);
-    try {
-      const result = await rejectExternalEdit({
-        nestId,
-        documentId: nodeId,
-        suggestionId,
-        actor,
-        reason: body.reason
-      });
-      return c.json({
-        rejected: true,
-        chainEvent: result.chainEvent.event_id
-      });
-    } catch (err) {
-      return c.json({ error: err.message }, 400);
-    }
-  }
-);
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -8833,20 +10017,22 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
-  const app = new Hono18({ router: new LinearRouter() });
+  const app = new Hono21({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
     corsOrigins === "*" ? cors({ origin: "*" }) : cors({ origin: corsOrigins, credentials: true })
   );
+  const ASSET_UPLOAD_PATH = /^\/nests\/[^/]+\/assets\/?$/;
   app.use("*", async (c, next) => {
     const lenStr = c.req.header("Content-Length");
     if (lenStr) {
       const len = parseInt(lenStr, 10);
-      if (Number.isFinite(len) && len > config.MAX_BODY_BYTES) {
+      const cap = c.req.method === "POST" && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : config.MAX_BODY_BYTES;
+      if (Number.isFinite(len) && len > cap) {
         return c.json(
           {
-            error: `Request body too large (${len} bytes, max ${config.MAX_BODY_BYTES})`
+            error: `Request body too large (${len} bytes, max ${cap})`
           },
           413
         );
@@ -8870,9 +10056,9 @@ function createApp() {
       durationMs: Date.now() - started
     });
   });
-  app.get(
-    "/health",
-    (c) => c.json({
+  app.get("/health", (c) => {
+    const oidcReady = isOidcReady();
+    return c.json({
       status: isSuspended() ? "suspended" : "ok",
       service: "contextnest-community",
       version: SERVICE_VERSION,
@@ -8886,10 +10072,24 @@ function createApp() {
       // The login page reads this to show/hide the credential form, and to
       // switch the Register link to an "activate invite" affordance.
       manual_sign_in: config.MANUAL_SIGN_IN,
+      // OIDC SSO — true only when enabled AND fully configured, so the login
+      // page never shows a button that would bounce with an error. The issuer
+      // is exposed (when live) so the client can label the button by IdP
+      // (login.microsoftonline.com → Microsoft, accounts.google.com → Google).
+      oidc_enabled: oidcReady,
+      ...oidcReady && { oidc_issuer: config.OIDC_ISSUER },
       // Public feature flags the SPA needs before auth to decide what to
       // render. Mirrors the server-side route gate so UI and API agree:
       // flag off → the plane's routes 404 AND its UI stays hidden.
       workflow_plane_enabled: config.FEATURE_WORKFLOW_PLANE,
+      // Import teams from PromptOwl (default OFF). Off → /teams/promptowl 404s
+      // and the UI hides the PromptOwl Teams panel.
+      promptowl_teams_enabled: config.PROMPTOWL_TEAMS_ENABLED,
+      // Content-type toggles (default ON). The editor's type picker mirrors
+      // these so a disabled type disappears from creation exactly when the
+      // API would refuse it — existing nodes of the type stay readable.
+      type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
+      type_table_enabled: config.TYPE_TABLE_ENABLED,
       // Sub-agent runs gate its own recursion surface separately (env-only,
       // must clear a security review — NOT a UI toggle). Exposed read-only so
       // the Runs page shows the "spawn sub-agent" option only when it's live.
@@ -8901,8 +10101,8 @@ function createApp() {
       subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
       subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
-    })
-  );
+    });
+  });
   app.use("/auth/invite", async (c, next) => {
     if (!getCurrentLicense()?.valid) {
       return c.json(
@@ -8983,8 +10183,8 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
+  const serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
   app.use("/admin/settings", flexAuthMiddleware);
-  const adminSettingsAllowed = async (c) => config.AUTH_MODE === "open" || await isLicenseAdminUserId(c.get("userId"));
   const currentServerSettings = () => ({
     promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
     manual_sign_in: config.MANUAL_SIGN_IN,
@@ -8993,10 +10193,27 @@ function createApp() {
     public_base_url: config.PUBLIC_BASE_URL,
     max_body_bytes: config.MAX_BODY_BYTES,
     workflow_plane_enabled: config.FEATURE_WORKFLOW_PLANE,
+    promptowl_teams_enabled: config.PROMPTOWL_TEAMS_ENABLED,
+    type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
+    type_table_enabled: config.TYPE_TABLE_ENABLED,
     subagent_runs_enabled: config.FEATURE_SUBAGENT_RUNS,
     subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
     subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
     trace_retention_days: config.TRACE_RETENTION_DAYS,
+    // OIDC SSO. The client secret is WRITE-ONLY: only its presence is
+    // reported, never the value (same discipline as the Anthropic key below).
+    oidc_enabled: config.OIDC_ENABLED,
+    oidc_issuer: config.OIDC_ISSUER,
+    oidc_client_id: config.OIDC_CLIENT_ID,
+    oidc_client_secret_set: !!config.OIDC_CLIENT_SECRET,
+    oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
+    oidc_auto_provision: config.OIDC_AUTO_PROVISION,
+    oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    // Live readiness (enabled AND issuer+id+secret present) — the SAVED state,
+    // i.e. whether the login button is currently live. The Settings UI derives
+    // its own "enabled but not configured" warning from the unsaved draft
+    // instead, so this is for API consumers (and tests) rather than that badge.
+    oidc_ready: isOidcReady(),
     // Server-wide runner default. NEVER the value — masked tail only.
     anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
@@ -9005,12 +10222,12 @@ function createApp() {
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
   app.get("/admin/settings", async (c) => {
-    if (!await adminSettingsAllowed(c))
+    if (!await serverAdminAllowed(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     return c.json(currentServerSettings());
   });
   app.patch("/admin/settings", async (c) => {
-    if (!await adminSettingsAllowed(c))
+    if (!await serverAdminAllowed(c))
       return c.json({ error: "Only the server admin can change this." }, 403);
     let body;
     try {
@@ -9052,6 +10269,24 @@ function createApp() {
         value: body.workflow_plane_enabled ? "true" : null
       });
     }
+    if ("promptowl_teams_enabled" in body) {
+      pending.push({
+        name: "PROMPTOWL_TEAMS_ENABLED",
+        value: body.promptowl_teams_enabled ? "true" : null
+      });
+    }
+    if ("type_artifact_enabled" in body) {
+      pending.push({
+        name: "TYPE_ARTIFACT_ENABLED",
+        value: body.type_artifact_enabled ? null : "false"
+      });
+    }
+    if ("type_table_enabled" in body) {
+      pending.push({
+        name: "TYPE_TABLE_ENABLED",
+        value: body.type_table_enabled ? null : "false"
+      });
+    }
     if ("anthropic_api_key" in body) {
       const v = body.anthropic_api_key;
       if (v === null || v === "") {
@@ -9109,6 +10344,74 @@ function createApp() {
         else pending.push({ name: "TRACE_RETENTION_DAYS", value: String(n) });
       }
     }
+    if ("oidc_issuer" in body) {
+      const v = String(body.oidc_issuer ?? "").trim().replace(/\/$/, "");
+      let ok = false;
+      try {
+        ok = !v || new URL(v).protocol === "https:";
+      } catch {
+        ok = false;
+      }
+      if (!ok)
+        addError("oidc_issuer", "OIDC issuer must be a valid https:// URL (e.g. https://accounts.google.com), or empty to clear it.");
+      else pending.push({ name: "OIDC_ISSUER", value: v || null });
+    }
+    if ("oidc_client_id" in body) {
+      const v = String(body.oidc_client_id ?? "").trim();
+      pending.push({ name: "OIDC_CLIENT_ID", value: v || null });
+    }
+    if ("oidc_client_secret" in body) {
+      const v = body.oidc_client_secret;
+      if (v === null || v === "") {
+        pending.push({ name: "OIDC_CLIENT_SECRET", value: null });
+      } else if (typeof v !== "string") {
+        addError("oidc_client_secret", "OIDC client secret must be a string (or empty to clear it).");
+      } else {
+        pending.push({ name: "OIDC_CLIENT_SECRET", value: v.trim() });
+      }
+    }
+    if ("oidc_allowed_domains" in body) {
+      const raw = String(body.oidc_allowed_domains ?? "").trim();
+      const entries = raw.split(",").map((d) => d.trim().toLowerCase()).filter(Boolean);
+      const bad = entries.find((d) => !/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(d));
+      if (bad !== void 0)
+        addError("oidc_allowed_domains", `"${bad}" is not a valid domain \u2014 use bare domains, comma-separated (e.g. acme.com, contractors.acme.com), or leave empty to allow any.`);
+      else
+        pending.push({
+          name: "OIDC_ALLOWED_DOMAINS",
+          value: entries.length ? entries.join(",") : null
+        });
+    }
+    if ("oidc_auto_provision" in body) {
+      pending.push({
+        name: "OIDC_AUTO_PROVISION",
+        value: body.oidc_auto_provision ? "true" : "false"
+      });
+    }
+    if ("oidc_department_tagging" in body) {
+      pending.push({
+        name: "OIDC_DEPARTMENT_TAGGING",
+        value: body.oidc_department_tagging ? "true" : null
+      });
+    }
+    const effOidcIssuer = "oidc_issuer" in body ? String(body.oidc_issuer ?? "").trim() : config.OIDC_ISSUER;
+    const effOidcClientId = "oidc_client_id" in body ? String(body.oidc_client_id ?? "").trim() : config.OIDC_CLIENT_ID;
+    const effOidcSecret = "oidc_client_secret" in body ? String(body.oidc_client_secret ?? "").trim() : config.OIDC_CLIENT_SECRET;
+    const effOidcEnabled = "oidc_enabled" in body ? !!body.oidc_enabled : config.OIDC_ENABLED;
+    const effOidcReady = effOidcEnabled && !!effOidcIssuer && !!effOidcClientId && !!effOidcSecret;
+    if ("oidc_enabled" in body) {
+      if (body.oidc_enabled && !effOidcReady) {
+        addError(
+          "oidc_enabled",
+          "Set the OIDC issuer, client ID, and client secret before turning single sign-on on."
+        );
+      } else {
+        pending.push({
+          name: "OIDC_ENABLED",
+          value: body.oidc_enabled ? "true" : null
+        });
+      }
+    }
     if ("slack_webhook_url" in body) {
       const v = String(body.slack_webhook_url ?? "").trim();
       if (v && !/^https:\/\//i.test(v))
@@ -9143,10 +10446,13 @@ function createApp() {
     }
     const effManual = "manual_sign_in" in body ? String(body.manual_sign_in ?? "").trim().toLowerCase() : config.MANUAL_SIGN_IN;
     const effGate = "promptowl_sign_in_gate" in body ? String(body.promptowl_sign_in_gate ?? "").trim().toLowerCase() : config.PROMPTOWL_SIGN_IN_GATE;
-    if (effManual === "disabled" && effGate === "disabled") {
+    if (effManual === "disabled" && effGate === "disabled" && !effOidcReady) {
+      const touchedOidcOnly = !("manual_sign_in" in body) && !("promptowl_sign_in_gate" in body) && ["oidc_enabled", "oidc_issuer", "oidc_client_id", "oidc_client_secret"].some(
+        (k) => k in body
+      );
       addError(
-        "manual_sign_in",
-        "Cannot disable both manual and PromptOwl sign-in \u2014 no one would be able to log in."
+        touchedOidcOnly ? "oidc_enabled" : "manual_sign_in",
+        "Cannot disable both manual and PromptOwl sign-in unless SSO (OIDC) is enabled and configured \u2014 no one would be able to log in."
       );
     }
     const errorMessages = Object.values(fieldErrors);
@@ -9188,14 +10494,8 @@ function createApp() {
     return c.json({ settings: currentServerSettings() });
   });
   app.use("/admin/trace", flexAuthMiddleware);
-  const traceAllowed = async (c) => {
-    if (config.AUTH_MODE === "open") return true;
-    const userId = c.get("userId");
-    if (await isLicenseAdminUserId(userId)) return true;
-    return isSuperAdmin(await resolveCallerEmail(userId));
-  };
   app.get("/admin/trace", async (c) => {
-    if (!await traceAllowed(c))
+    if (!await serverAdminAllowed(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     const limitRaw = Number(c.req.query("limit"));
     const offsetRaw = Number(c.req.query("offset"));
@@ -9210,6 +10510,124 @@ function createApp() {
     });
     return c.json({ count: events.length, total, limit, offset, events });
   });
+  app.use("/admin/super-admins", flexAuthMiddleware);
+  app.use("/admin/super-admins/*", flexAuthMiddleware);
+  app.get("/admin/super-admins", async (c) => {
+    if (!await serverAdminAllowed(c))
+      return c.json({ error: "Only the server admin can view this." }, 403);
+    const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
+    const byEmail = /* @__PURE__ */ new Map();
+    const add = (row) => {
+      if (!byEmail.has(row.email)) byEmail.set(row.email, row);
+    };
+    const lic = getCurrentLicense();
+    if (lic?.valid && lic.ownerEmail) {
+      const email = lic.ownerEmail.toLowerCase();
+      add({ email, source: "license", granted_by: null, granted_at: null, self: email === callerEmail });
+    }
+    for (const raw of getAccessConfig()?.super_admins ?? []) {
+      const email = raw.toLowerCase();
+      add({ email, source: "config", granted_by: null, granted_at: null, self: email === callerEmail });
+    }
+    const granted = await getDb().all(
+      "SELECT email, granted_by, granted_at FROM super_admins ORDER BY granted_at, email"
+    );
+    for (const g of granted) {
+      const email = g.email.toLowerCase();
+      add({ email, source: "granted", granted_by: g.granted_by, granted_at: g.granted_at, self: email === callerEmail });
+    }
+    return c.json({ super_admins: [...byEmail.values()] });
+  });
+  app.post("/admin/super-admins", async (c) => {
+    if (!await serverAdminAllowed(c))
+      return c.json({ error: "Only the server admin can grant superadmin." }, 403);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+    if (!email || !isEmailish(email)) {
+      return c.json({ error: "A valid email is required." }, 400);
+    }
+    const user = await getDb().get(
+      "SELECT id FROM users WHERE LOWER(email) = ?",
+      [email]
+    );
+    if (!user) {
+      return c.json(
+        { error: "No user with this email exists on this server. Invite them as a teammate first." },
+        400
+      );
+    }
+    const lic = getCurrentLicense();
+    const isLicenseOwner = !!lic?.valid && lic.ownerEmail?.toLowerCase() === email;
+    if (isLicenseOwner || isSuperAdmin(email)) {
+      return c.json({ error: "This user is already a superadmin." }, 409);
+    }
+    const grantedBy = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
+    try {
+      await getDb().run(
+        "INSERT INTO super_admins (email, granted_by) VALUES (?, ?)",
+        [email, grantedBy]
+      );
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/unique|duplicate/i.test(msg)) {
+        await loadGrantedSuperAdmins();
+        return c.json({ error: "This user is already a superadmin." }, 409);
+      }
+      throw err;
+    }
+    await loadGrantedSuperAdmins();
+    return c.json({ email, source: "granted", granted_by: grantedBy }, 201);
+  });
+  app.delete("/admin/super-admins/:email", async (c) => {
+    if (!await serverAdminAllowed(c))
+      return c.json({ error: "Only the server admin can revoke superadmin." }, 403);
+    const email = c.req.param("email").trim().toLowerCase();
+    const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
+    const lic = getCurrentLicense();
+    if (lic?.valid && lic.ownerEmail?.toLowerCase() === email) {
+      return c.json(
+        { error: "The license admin can't be revoked \u2014 their access comes from owning the installed PromptOwl license." },
+        400
+      );
+    }
+    if (isConfigSuperAdmin(email)) {
+      return c.json(
+        { error: "This superadmin is defined in access.yaml and can't be revoked from here. Remove them from the file and restart the server." },
+        400
+      );
+    }
+    const db = getDb();
+    const row = await db.get(
+      "SELECT email FROM super_admins WHERE LOWER(email) = ?",
+      [email]
+    );
+    if (!row) return c.json({ error: "Not a granted superadmin." }, 404);
+    if (email === callerEmail) {
+      const hasLicenseAdmin = !!lic?.valid && !!lic.ownerEmail;
+      const hasConfigAdmins = (getAccessConfig()?.super_admins?.length ?? 0) > 0;
+      const others = await db.get(
+        "SELECT COUNT(*) AS c FROM super_admins WHERE LOWER(email) != ?",
+        [email]
+      );
+      if (!hasLicenseAdmin && !hasConfigAdmins && others.c === 0) {
+        return c.json(
+          { error: "You're the last superadmin on this server \u2014 grant someone else superadmin before revoking yourself." },
+          400
+        );
+      }
+    }
+    await db.run("DELETE FROM super_admins WHERE LOWER(email) = ?", [email]);
+    await loadGrantedSuperAdmins();
+    return c.json({ ok: true, email });
+  });
+  app.use("/teams/*", flexAuthMiddleware);
+  app.use("/teams", flexAuthMiddleware);
+  app.route("/teams", teamRoutes);
   app.use("/me/*", flexAuthMiddleware);
   app.get("/me/work", async (c) => {
     const userId = c.get("userId");
@@ -9283,7 +10701,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthMiddleware);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono18();
+  const nestsApp = new Hono21();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
     const localPath = c.req.path.replace(/^\/nests\//, "");
@@ -9293,36 +10711,46 @@ function createApp() {
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
+    const isMcpTransport = parts.length === 2 && parts[1] === "mcp";
+    const deny = async (status, error, extra) => {
+      if (!isMcpTransport) return c.json({ error, ...extra }, status);
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      const message = typeof extra?.reason === "string" ? `${error} \u2014 ${extra.reason}` : error;
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message } },
+        status
+      );
+    };
     if (nestScope && nestScope !== nestId) {
-      return c.json({ error: "API key not authorized for this nest" }, 403);
+      return deny(
+        403,
+        `API key not authorized for this nest \u2014 this key is scoped to nest "${nestScope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`
+      );
     }
     if (isSuspended() && c.req.method !== "GET") {
-      return c.json(
-        {
-          error: "Server suspended by PromptOwl",
-          reason: getSuspensionReason(),
-          contact: "support@promptowl.ai"
-        },
-        503
-      );
+      return deny(503, "Server suspended by PromptOwl", {
+        reason: getSuspensionReason(),
+        contact: "support@promptowl.ai"
+      });
     }
     {
       const path2 = c.req.path;
       const isCommentPath = /\/comments$/.test(path2) || /\/comments\/[^/]+\/resolve$/.test(path2);
       const isActivityPath = /\/activity$/.test(path2);
-      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath;
+      const isFeedPath = parts.length === 2 && parts[1] === "feed";
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath || isFeedPath;
       const needsLicense = c.req.method !== "GET" || isGovernance;
       if (needsLicense) {
         const lic = getCurrentLicense();
         if (!lic?.valid) {
-          return c.json(
-            {
-              error: "License required",
-              reason: "Install a PromptOwl license key via the setup screen or POST /license/install.",
-              setup_url: "/setup"
-            },
-            503
-          );
+          return deny(503, "License required", {
+            reason: "This server has no valid PromptOwl license installed. Ask the server admin to install one via the setup screen or POST /license/install.",
+            setup_url: "/setup"
+          });
         }
       }
     }
@@ -9350,7 +10778,9 @@ function createApp() {
         grantNestVisible = await hasAnyGrant(nestId, userId);
       }
       if (!grantRole && !grantNestVisible) {
-        return c.json({ error: "Nest not found" }, 404);
+        return deny(404, "Nest not found", {
+          reason: "The nest id may be wrong, or these credentials have no access to it. Ask the nest owner to share the nest with you, then reconnect."
+        });
       }
     }
     let required = "read";
@@ -9372,9 +10802,11 @@ function createApp() {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
+    } else if (resource === "teams") {
+      required = c.req.method === "GET" ? "write" : "admin";
     } else if (parts[1] === "hooks") {
       required = "write";
-    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery) {
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery && !isMcpTransport) {
       required = "write";
     }
     const isNodeAction = c.req.method === "POST" && parts.length >= 4 && (parts[parts.length - 1] === "revert" || parts[parts.length - 1] === "move");
@@ -9403,13 +10835,13 @@ function createApp() {
     const grantLevel = grantRole ? permissionLevel(grantRole) : grantNestVisible ? permissionLevel("read") : 0;
     const effectiveLevel = Math.max(permissionLevel(permission), grantLevel);
     if (!stewardEditorBypass && effectiveLevel < permissionLevel(required)) {
-      return c.json(
+      return deny(
+        403,
+        `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
         {
-          error: `You don't have access to perform this action on this nest. Required permission: '${required}', your permission: '${permission}'. Ask the nest owner or a server admin to grant you ${required} access.`,
           required_permission: required,
           your_permission: permission
-        },
-        403
+        }
       );
     }
     c.set(
@@ -9454,6 +10886,7 @@ function createApp() {
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);
+  nestsApp.route("/:nestId/teams", nestTeamRoutes);
   nestsApp.route("/:nestId/edge-types", edgeTypeRoutes);
   nestsApp.route("/:nestId/edges", edgeRoutes);
   nestsApp.route("/:nestId/run", runTriggerRoutes);
@@ -9655,7 +11088,7 @@ async function backfillNodeVersionsFromHistory(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid14 } from "uuid";
+import { v4 as uuid15 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -9679,7 +11112,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid14()}`;
+      const id = `run_${uuid15()}`;
       const nowIso = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
@@ -9734,6 +11167,11 @@ async function main() {
   if (accessCfg) {
     console.log(`  Loaded access.yaml (mode: ${accessCfg.mode || "open"})`);
   }
+  try {
+    await loadGrantedSuperAdmins();
+  } catch (err) {
+    console.error("[access] failed to load DB-granted superadmins:", err);
+  }
   const license = await validateLicense();
   if (!license.valid) {
     console.warn(`