@promptowl/contextnest-community 1.18.0 → 1.19.0

package/CONFIGURATION.md

@@ -60,7 +60,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `MANUAL_SIGN_IN` | `open` | Email + password sign-in mode. `open` = anyone may log in and self-register a new account; `invite-only` = existing/invited users may log in but brand-new self-registration returns `403` (the admin provisions accounts via invite/share/steward and shares the password — there is no self-service "set password", which would be account takeover without email verification); `disabled` = no email/password sign-in at all (`POST /auth/login` and `POST /auth/register` return `403`). Independent of `PROMPTOWL_SIGN_IN_GATE`, so the two methods are controlled separately (e.g. `invite-only` manual + `admin-only` PromptOwl). Also settable from Settings → General. The server refuses `disabled` while PromptOwl sign-in is also `disabled` (that would leave no way to log in). Unknown values fall back to `open`. |
 | `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
-| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — only when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Three uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — only when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. |
 | `OIDC_ENABLED` | `false` | Turn on generic OIDC single sign-on (`GET /auth/oidc/login` / `GET /auth/oidc/callback`). Requires `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET` — the login-page button only appears once all three are set. Also editable from Settings → Single sign-on. See [Single sign-on (OIDC)](#single-sign-on-oidc). |
 | `OIDC_ISSUER` | `""` | OIDC issuer URL, e.g. `https://login.microsoftonline.com/<tenant>/v2.0` (Microsoft Entra ID) or `https://accounts.google.com` (Google). **`https://` only** — a non-https value is rejected with a warning and SSO stays off. Must serve `<issuer>/.well-known/openid-configuration`. |
 | `OIDC_CLIENT_ID` | `""` | Application (client) ID from your IdP app registration. |

package/dist/{chunk-TQACHVVA.js → chunk-3GMGLYTZ.js}

@@ -11,11 +11,11 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,

package/dist/{chunk-34UXRZXD.js → chunk-BXUVIAMP.js}

@@ -2,7 +2,7 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   getDb
 } from "./chunk-HYSTFMFG.js";

package/dist/{chunk-FUUJG6XP.js → chunk-ENDHMQPD.js}

@@ -3,7 +3,7 @@ import {
   ForbiddenError,
   NotFoundError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,
@@ -1101,6 +1101,9 @@ function docLink(nestId, nodeId, baseUrl) {
   if (nodeId) q.set("doc", nodeId);
   return `${base.replace(/\/$/, "")}/?${q.toString()}`;
 }
+function resolveNodeUrl(node, opts) {
+  return docLink(opts.nestId, node.id, opts.baseUrl) || void 0;
+}
 async function buildDocContext(nestId, nodeId, baseUrl) {
   const titles = await buildTitleMap(nestId);
   const docTitle = titles.get(nodeId) || nodeId;
@@ -2244,8 +2247,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-34E3YNX7.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-6Q6SHEOF.js");
+  const { engineCache: engineCache2 } = await import("./engine-V4DY4PYN.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-3NK5DGLA.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2558,6 +2561,7 @@ export {
   prettyFolderPath,
   nestName,
   docLink,
+  resolveNodeUrl,
   buildDocContext,
   createTeam,
   findTeamByExternalId,

package/dist/{chunk-HGN45I5P.js → chunk-FBDEESNJ.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-TQACHVVA.js";
+} from "./chunk-3GMGLYTZ.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
+} from "./chunk-GSYMJ3A4.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-34UXRZXD.js";
+} from "./chunk-BXUVIAMP.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -35,12 +35,12 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   ConflictError,
   NotFoundError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb

package/dist/{chunk-QUZXRLUA.js → chunk-GSYMJ3A4.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   getDb
 } from "./chunk-HYSTFMFG.js";

package/dist/{chunk-OOBZG6BW.js → chunk-TNAZJYL5.js}

@@ -4,7 +4,7 @@ import {
   markIndexStale,
   resolveNestPath,
   setSuggestionFlag
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   getDb
 } from "./chunk-HYSTFMFG.js";
@@ -253,7 +253,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-JWEN5UUW.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-G7SFFKFO.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{chunk-GUNJTORH.js → chunk-YVMSM7LS.js}

@@ -43,6 +43,17 @@ var LockedError = class extends AppError {
     this.name = "LockedError";
   }
 };
+var VaultBusyError = class extends AppError {
+  retryAfterSeconds = 5;
+  constructor(message = "The vault is busy with another write. Retry shortly.") {
+    super(503, message);
+    this.name = "VaultBusyError";
+  }
+};
+function isVaultLockTimeout(err) {
+  const e = err;
+  return e?.name === "VaultLockTimeoutError" || e?.code === "VAULT_LOCK_TIMEOUT";
+}
 
 export {
   AppError,
@@ -51,5 +62,7 @@ export {
   UnauthorizedError,
   ValidationError,
   ConflictError,
-  LockedError
+  LockedError,
+  VaultBusyError,
+  isVaultLockTimeout
 };

package/dist/{engine-34E3YNX7.js → engine-V4DY4PYN.js}

@@ -2,8 +2,8 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-ENDHMQPD.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";

package/dist/{external-edit-service-6Q6SHEOF.js → external-edit-service-3NK5DGLA.js}

@@ -11,9 +11,9 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-OOBZG6BW.js";
-import "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-TNAZJYL5.js";
+import "./chunk-ENDHMQPD.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";

package/dist/{grants-service-ME7HIVHU.js → grants-service-CADI6LIB.js}

@@ -6,8 +6,8 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-GSYMJ3A4.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 export {

package/dist/index.js

@@ -41,7 +41,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-HGN45I5P.js";
+} from "./chunk-FBDEESNJ.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -61,7 +61,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-TQACHVVA.js";
+} from "./chunk-3GMGLYTZ.js";
 import {
   createGrant,
   deleteGrant,
@@ -70,7 +70,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
+} from "./chunk-GSYMJ3A4.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -93,7 +93,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-34UXRZXD.js";
+} from "./chunk-BXUVIAMP.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -105,7 +105,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-OOBZG6BW.js";
+} from "./chunk-TNAZJYL5.js";
 import {
   addMember,
   assertSafeNodeId,
@@ -174,6 +174,7 @@ import {
   resolveNestAccess,
   resolveNestPath,
   resolveNestPermission,
+  resolveNodeUrl,
   resolveTeamRolesForUser,
   sendEmailToRecipient,
   setAllowSelfApprove,
@@ -190,7 +191,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   AppError,
   ConflictError,
@@ -198,8 +199,10 @@ import {
   LockedError,
   NotFoundError,
   UnauthorizedError,
-  ValidationError
-} from "./chunk-GUNJTORH.js";
+  ValidationError,
+  VaultBusyError,
+  isVaultLockTimeout
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,
@@ -1657,16 +1660,14 @@ import {
   normalizeStatus,
   isRejected,
   filterDocuments,
-  DocumentNotFoundError
+  DocumentNotFoundError,
+  NODE_TYPES
 } from "@promptowl/contextnest-engine";
 import { rename, mkdir } from "fs/promises";
 import { dirname, join } from "path";
 
 // src/governance/safe-publish.ts
-import {
-  publishDocument,
-  serializeDocument
-} from "@promptowl/contextnest-engine";
+import { serializeDocument } from "@promptowl/contextnest-engine";
 function serializeNodeSafe(node) {
   return serializeDocument({
     ...node,
@@ -1804,6 +1805,10 @@ function toSafeError(err, context, message) {
       "This document is rejected. Change its status before saving."
     );
   }
+  if (isVaultLockTimeout(err)) {
+    console.error(`${context}:`, err);
+    return new VaultBusyError();
+  }
   console.error(`${context}:`, err);
   return new AppError(500, message);
 }
@@ -1818,6 +1823,12 @@ var RUNNABLE_NODE_TYPES = ["agent", "skill"];
 function isRunnableType(type) {
   return RUNNABLE_NODE_TYPES.includes(type || "");
 }
+var ACCEPTED_NODE_TYPES = /* @__PURE__ */ new Set([
+  ...NODE_TYPES,
+  ...RUNNABLE_NODE_TYPES,
+  "artifact",
+  "table"
+]);
 function toNodeResponse(node) {
   const fm = node.frontmatter;
   const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
@@ -1947,12 +1958,12 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
   if (filters.folder !== void 0) assertSafeFolder(filters.folder);
   const { versions: versionManager } = await engineCache.get(nestId);
   const userEmail = await resolveCallerEmail(userId);
-  const frontmatterFilters = {
+  const listFilters = {
     ...filters.type ? { type: filters.type } : {},
     ...filters.tag ? { tag: filters.tag } : {},
-    ...filters.status ? { status: filters.status } : {},
-    includeRetired: true
+    ...filters.status ? { status: filters.status } : {}
   };
+  const frontmatterFilters = { ...listFilters, includeRetired: true };
   let documents;
   if (filters.withContent) {
     const scopeInEngine = filters.folder !== void 0 && engineScopesFolders();
@@ -1960,7 +1971,7 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
     ({ documents } = await engineApi.run(
       "context_list",
       {
-        ...frontmatterFilters,
+        ...listFilters,
         include_retired: true,
         ...scopeInEngine ? {
           folder: [scopePrefix, filters.folder].filter(Boolean).join("/"),
@@ -1976,7 +1987,10 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
       nestId,
       filters.folder !== void 0 ? { folder: filters.folder } : {}
     );
-    documents = filterDocuments(indexed, frontmatterFilters);
+    documents = filterDocuments(indexed, {
+      ...frontmatterFilters,
+      includeRetired: true
+    });
   }
   const scoped = filters.folder === void 0 ? documents : documents.filter((d) => folderOfId(d.id) === filters.folder);
   const nodes = scoped.map((d) => ({
@@ -2226,6 +2240,11 @@ async function createNodeOnce(nestId, input, userEmail) {
   if (requestedType === "table" && !config.TYPE_TABLE_ENABLED) {
     throw new ValidationError("Table nodes are disabled on this server");
   }
+  if (!ACCEPTED_NODE_TYPES.has(requestedType)) {
+    throw new ValidationError(
+      `unknown node type "${requestedType}"; allowed: ${[...ACCEPTED_NODE_TYPES].sort().join(", ")}`
+    );
+  }
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
       `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
@@ -4229,7 +4248,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-U4CKL7Y5.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-JAFSU5GN.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -4250,7 +4269,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-H2M5ACPQ.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-LK4M2C43.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -4889,7 +4908,6 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 
 // src/nodes/query-routes.ts
 import { Hono as Hono10 } from "hono";
-import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -5649,11 +5667,15 @@ queryRoutes.get("/graph", async (c) => {
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
-function formatContextBlock(node) {
+function formatContextBlock(node, url) {
   const tags = (node.frontmatter.tags || []).join(" ");
-  const header = tags ? `# ${node.frontmatter.title}
+  const meta = [
+    tags ? `_tags: ${tags}_` : null,
+    url ? `_source: ${url}_` : null
+  ].filter(Boolean);
+  const header = meta.length ? `# ${node.frontmatter.title}
 
-_tags: ${tags}_
+${meta.join("\n")}
 
 ` : `# ${node.frontmatter.title}
 
@@ -5666,6 +5688,7 @@ queryRoutes.post("/context", async (c) => {
     throw new ValidationError("prompt or selector is required");
   }
   const nestId = c.req.param("nestId");
+  const baseUrl = requestBaseUrl(c.req.url);
   const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const hops = body.hops ?? 2;
@@ -5774,20 +5797,21 @@ queryRoutes.post("/context", async (c) => {
   const readable = await Promise.all(
     accessible.map(async (doc) => ({
       ...doc,
-      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || "")
+      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || ""),
+      url: resolveNodeUrl(doc, { nestId, baseUrl })
     }))
   );
   const included = [];
   let tokenCount = 0;
   for (const doc of readable) {
-    const block = formatContextBlock(doc);
+    const block = formatContextBlock(doc, doc.url);
     const blockTokens = approxTokens(block);
     if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
     included.push(doc);
     tokenCount += blockTokens;
   }
   const truncatedByBudget = accessible.length - included.length;
-  const contextMarkdown = included.map(formatContextBlock).join("\n\n---\n\n");
+  const contextMarkdown = included.map((n) => formatContextBlock(n, n.url)).join("\n\n---\n\n");
   trackEvent("context.resolve", {
     nestId,
     selector_from_prompt: !!compileDetail,
@@ -5800,6 +5824,7 @@ queryRoutes.post("/context", async (c) => {
     nodes: included.map((n) => ({
       id: n.id,
       title: n.frontmatter.title,
+      url: n.url,
       tags: n.frontmatter.tags || [],
       type: n.frontmatter.type || "document"
     })),
@@ -6013,48 +6038,51 @@ queryRoutes.post("/publish", async (c) => {
     }
   }
   const nestId = c.req.param("nestId");
-  const { storage } = await engineCache.get(nestId);
+  const userEmail = await resolveCallerEmail(c.get("userId"));
   const created = [];
+  const skipped = [];
+  const failed = [];
   if (body.context_md) {
+    const { storage } = await engineCache.get(nestId);
     await storage.writeContextMd(body.context_md);
+    await storage.regenerateIndex();
   }
   for (const doc of body.documents || []) {
     if (!doc.title || !doc.content) continue;
-    const slug = doc.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-    const id = `nodes/${slug}`;
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const tags = doc.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
-    const node = {
-      id,
-      filePath: "",
-      frontmatter: {
+    try {
+      const result = await createNode(
+        nestId,
+        {
+          title: doc.title,
+          content: doc.content,
+          type: doc.type,
+          tags: doc.tags,
+          scope: doc.scope
+        },
+        userEmail
+      );
+      created.push(result.node.id);
+    } catch (err) {
+      if (err instanceof ConflictError) {
+        skipped.push(doc.title);
+        continue;
+      }
+      if (isVaultLockTimeout(err) || err instanceof VaultBusyError) throw err;
+      if (!(err instanceof AppError)) console.error("bulk publish row failed", err);
+      failed.push({
         title: doc.title,
-        type: doc.type || "document",
-        tags,
-        status: "draft",
-        version: 1,
-        created_at: now,
-        updated_at: now,
-        metadata: {
-          owners: ["*"],
-          scope: doc.scope || "team"
-        }
-      },
-      body: doc.content,
-      rawContent: ""
-    };
-    const serialized = serializeDocument3(node);
-    await storage.writeDocument(id, serialized);
-    await syncNodeTags(nestId, id, tags);
-    created.push(id);
+        error: err instanceof AppError ? err.message : "Could not create this document"
+      });
+    }
   }
-  if (created.length > 0 || body.context_md) await storage.regenerateIndex();
   trackEvent("nest.publish", { nestId, count: created.length });
   return c.json(
     {
       published: created.length,
       context_md_updated: !!body.context_md,
-      node_ids: created
+      node_ids: created,
+      skipped,
+      failed
     },
     201
   );
@@ -7664,6 +7692,13 @@ async function handleToolCall(toolName, args, ctx) {
   try {
     return await runTool(toolName, args, ctx);
   } catch (err) {
+    if (isVaultLockTimeout(err) || err instanceof VaultBusyError) {
+      status = 503;
+      return toolError(
+        "The vault is busy with another write. Retry in a few seconds.",
+        "VAULT_BUSY"
+      );
+    }
     status = 500;
     throw err;
   } finally {
@@ -8554,7 +8589,7 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-ME7HIVHU.js");
+        const { createGrant: createGrant2 } = await import("./grants-service-CADI6LIB.js");
         const db = (await import("./client-SW5I6ZBK.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
@@ -12534,6 +12569,12 @@ function createApp() {
   );
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
+    if (isVaultLockTimeout(err) || err instanceof VaultBusyError) {
+      const busy = err instanceof VaultBusyError ? err : new VaultBusyError();
+      return c.json({ error: busy.message }, 503, {
+        "Retry-After": String(busy.retryAfterSeconds)
+      });
+    }
     if (err instanceof AppError) {
       return c.json({ error: err.message }, err.statusCode);
     }

package/dist/{review-service-H2M5ACPQ.js → review-service-LK4M2C43.js}

@@ -16,14 +16,14 @@ import {
   requestDeletion,
   submitForReview,
   withdrawDeletionRequest
-} from "./chunk-HGN45I5P.js";
+} from "./chunk-FBDEESNJ.js";
 import {
   canUserApprove
-} from "./chunk-TQACHVVA.js";
-import "./chunk-QUZXRLUA.js";
-import "./chunk-34UXRZXD.js";
-import "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-3GMGLYTZ.js";
+import "./chunk-GSYMJ3A4.js";
+import "./chunk-BXUVIAMP.js";
+import "./chunk-ENDHMQPD.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";

package/dist/{stewardship-service-U4CKL7Y5.js → stewardship-service-JAFSU5GN.js}

@@ -23,9 +23,9 @@ import {
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-TQACHVVA.js";
-import "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-3GMGLYTZ.js";
+import "./chunk-ENDHMQPD.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";

package/dist/{version-service-JWEN5UUW.js → version-service-G7SFFKFO.js}

@@ -16,9 +16,9 @@ import {
   setApprovedVersion,
   systemAuthor,
   upsertVersion
-} from "./chunk-34UXRZXD.js";
-import "./chunk-FUUJG6XP.js";
-import "./chunk-GUNJTORH.js";
+} from "./chunk-BXUVIAMP.js";
+import "./chunk-ENDHMQPD.js";
+import "./chunk-YVMSM7LS.js";
 import "./chunk-HYSTFMFG.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";