@promptowl/contextnest-community 1.18.0 → 1.20.0

package/dist/index.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import {
-  addWatcher,
   approve,
   canReadNode,
   canRequestDeletion,
@@ -21,16 +20,11 @@ import {
   getReviewQueue,
   isSafeConnectorUrl,
   listDeletionRequests,
-  listNotifications,
-  listWatchers,
-  markNotificationsRead,
   nodeWriteKey,
   notifyDeletionResolved,
   notifyNestEvent,
-  notifyNestInvite,
   parseConditionSchema,
   reject,
-  removeWatcher,
   repointPendingReview,
   requestDeletion,
   requireWorkflowPlane,
@@ -41,7 +35,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-HGN45I5P.js";
+} from "./chunk-GVUBZTI3.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -61,7 +55,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-TQACHVVA.js";
+} from "./chunk-O5DYL7ZG.js";
 import {
   createGrant,
   deleteGrant,
@@ -70,7 +64,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-QUZXRLUA.js";
+} from "./chunk-3LUUJUWS.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -93,7 +87,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-34UXRZXD.js";
+} from "./chunk-KHMSDTJJ.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -105,9 +99,10 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-OOBZG6BW.js";
+} from "./chunk-EY7WOKJR.js";
 import {
   addMember,
+  addWatcher,
   assertSafeNodeId,
   buildTitleMap,
   canApproveWith,
@@ -135,6 +130,7 @@ import {
   insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
+  isEmailConfigured,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
   isPublicReader,
@@ -144,13 +140,16 @@ import {
   isSuspended,
   listNestTeams,
   listNests,
+  listNotifications,
   listPublicNests,
   listSharedNests,
   listTeamsForUser,
   listVisibleNests,
+  listWatchers,
   loadAccessConfig,
   loadGrantedSuperAdmins,
   loadServerSettings,
+  markNotificationsRead,
   nestAllowsSelfApprove,
   nestName,
   nestPrimeTags,
@@ -158,6 +157,7 @@ import {
   nestStorageRoot,
   nodesWithSuggestions,
   normalizeTag,
+  notifyNestInvite,
   nowExpr,
   opContext,
   permissionLevel,
@@ -167,6 +167,7 @@ import {
   rebuildNodeIndex,
   removeMember,
   removeNodeFromTagIndex,
+  removeWatcher,
   renameNest,
   renameTeam,
   replaceTeamRoster,
@@ -174,11 +175,13 @@ import {
   resolveNestAccess,
   resolveNestPath,
   resolveNestPermission,
+  resolveNodeUrl,
   resolveTeamRolesForUser,
   sendEmailToRecipient,
   setAllowSelfApprove,
   setPrimeOnlyReview,
   setPrimeTags,
+  setReaderMode,
   setStewardshipEnabled,
   shareTeamWithNest,
   startLicenseSafetyPoll,
@@ -190,7 +193,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-FUUJG6XP.js";
+} from "./chunk-7CPP6FIU.js";
 import {
   AppError,
   ConflictError,
@@ -198,15 +201,17 @@ import {
   LockedError,
   NotFoundError,
   UnauthorizedError,
-  ValidationError
-} from "./chunk-GUNJTORH.js";
+  ValidationError,
+  VaultBusyError,
+  isVaultLockTimeout
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-HYSTFMFG.js";
+} from "./chunk-XCFKS65Y.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -220,7 +225,7 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono23 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
@@ -250,7 +255,7 @@ function applyArtifactSandboxHeaders(c) {
 
 // src/auth/routes.ts
 import { Hono as Hono2 } from "hono";
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
@@ -472,8 +477,39 @@ function b64urlToBuffer(input) {
   const pad = input.length % 4 === 0 ? "" : "=".repeat(4 - input.length % 4);
   return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
 }
+function bufferToB64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 var SsoTokenError = class extends Error {
 };
+var MCP_TICKET_MIN_TTL = 30;
+var MCP_TICKET_MAX_TTL = 3600;
+function signMcpTicket(input, secret, nowSec = Math.floor(Date.now() / 1e3)) {
+  if (!secret) throw new SsoTokenError("MCP signing secret not configured");
+  const sub = (input.sub ?? "").trim();
+  if (!isValidTicketSub(sub)) throw new SsoTokenError("Invalid ticket subject");
+  const ttl = Math.max(
+    MCP_TICKET_MIN_TTL,
+    Math.min(MCP_TICKET_MAX_TTL, Math.floor(input.ttlSeconds))
+  );
+  const headerB64 = bufferToB64url(
+    Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" }))
+  );
+  const claims = {
+    sub,
+    scope: "mcp",
+    iat: nowSec,
+    exp: nowSec + ttl
+  };
+  if (input.aud) claims.aud = input.aud;
+  if (input.name) claims.name = input.name;
+  const payloadB64 = bufferToB64url(Buffer.from(JSON.stringify(claims)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const sig = bufferToB64url(
+    createHmac("sha256", secret).update(signingInput).digest()
+  );
+  return `${signingInput}.${sig}`;
+}
 function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
   if (!secret) throw new SsoTokenError("SSO secret not configured");
   if (!token || typeof token !== "string") {
@@ -553,14 +589,15 @@ var NONCE_COOKIE = "cnst_oidc_nonce";
 var VERIFIER_COOKIE = "cnst_oidc_verifier";
 var FLOW_COOKIE_TTL_SECS = 10 * 60;
 var DISCOVERY_TTL_MS = 5 * 6e4;
-var discoveryCache = null;
+var discoveryCache = /* @__PURE__ */ new Map();
 function isOidcReady() {
   return config.OIDC_ENABLED && !!config.OIDC_ISSUER && !!config.OIDC_CLIENT_ID && !!config.OIDC_CLIENT_SECRET;
 }
 async function discover(issuer) {
   const now = Date.now();
-  if (discoveryCache && discoveryCache.issuer === issuer && now - discoveryCache.fetchedAt < DISCOVERY_TTL_MS) {
-    return { doc: discoveryCache.doc, jwks: discoveryCache.jwks };
+  const cached = discoveryCache.get(issuer);
+  if (cached && now - cached.fetchedAt < DISCOVERY_TTL_MS) {
+    return { doc: cached.doc, jwks: cached.jwks };
   }
   const res = await fetch(`${issuer}/.well-known/openid-configuration`, {
     headers: { Accept: "application/json" },
@@ -579,12 +616,7 @@ async function discover(issuer) {
     );
   }
   const jwks = createRemoteJWKSet(new URL(doc.jwks_uri));
-  discoveryCache = {
-    issuer,
-    doc,
-    jwks,
-    fetchedAt: now
-  };
+  discoveryCache.set(issuer, { doc, jwks, fetchedAt: now });
   return { doc, jwks };
 }
 function base64url(buf) {
@@ -849,6 +881,184 @@ oidcRoutes.get("/logout", async (c) => {
   return c.redirect(home, 302);
 });
 
+// src/auth/token-exchange.ts
+import { v4 as uuid2 } from "uuid";
+import { jwtVerify as jwtVerify2 } from "jose";
+var TX_LIMIT = { max: 60, windowMs: 15 * 6e4 };
+var ExchangeError = class extends Error {
+  constructor(code, status, message) {
+    super(message ?? code);
+    this.code = code;
+    this.status = status;
+  }
+  code;
+  status;
+};
+function expectedIssuer(provider, msTenantId) {
+  if (provider === "microsoft") {
+    return msTenantId ? `https://login.microsoftonline.com/${msTenantId}/v2.0` : "";
+  }
+  return "https://accounts.google.com";
+}
+function providerConfig(p) {
+  if (p === "microsoft") {
+    return {
+      enabled: config.MS_TOKEN_EXCHANGE_ENABLED,
+      issuer: expectedIssuer("microsoft", config.MS_TENANT_ID),
+      audience: config.MS_CLIENT_ID
+    };
+  }
+  return {
+    enabled: config.GOOGLE_TOKEN_EXCHANGE_ENABLED,
+    issuer: expectedIssuer("google", ""),
+    audience: config.GOOGLE_CLIENT_ID
+  };
+}
+async function verifySubjectToken(provider, subjectToken) {
+  const pc = providerConfig(provider);
+  if (!pc.issuer || !pc.audience) {
+    throw new ExchangeError("provider_misconfigured", 400);
+  }
+  let discovered;
+  try {
+    discovered = await discover(pc.issuer);
+  } catch (err) {
+    console.error(`[token-exchange] discovery failed for ${pc.issuer}:`, err);
+    throw new ExchangeError("provider_misconfigured", 400);
+  }
+  let claims;
+  try {
+    const { payload } = await jwtVerify2(subjectToken, discovered.jwks, {
+      issuer: discovered.doc.issuer,
+      audience: pc.audience,
+      algorithms: ["RS256"],
+      // Same leeway verifySsoTicket allows, so modest clock skew doesn't
+      // bounce a legitimate token on one path and pass on the other.
+      clockTolerance: 30
+    });
+    claims = payload;
+  } catch (err) {
+    console.warn(
+      `[token-exchange] subject_token rejected (${provider}):`,
+      err instanceof Error ? err.message : err
+    );
+    throw new ExchangeError("invalid_subject_token", 401);
+  }
+  if (claims.email_verified === false || claims.email_verified === "false") {
+    throw new ExchangeError("email_not_verified", 403);
+  }
+  const raw = typeof claims.email === "string" && claims.email || typeof claims.preferred_username === "string" && claims.preferred_username || "";
+  const email = normalizeEmail(raw);
+  if (!email || !isEmailish(email)) {
+    throw new ExchangeError("invalid_subject_token", 401);
+  }
+  const allowed = config.OIDC_ALLOWED_DOMAINS;
+  if (allowed.length > 0 && !allowed.includes(email.slice(email.lastIndexOf("@") + 1))) {
+    throw new ExchangeError("domain_not_allowed", 403);
+  }
+  const name = typeof claims.name === "string" && claims.name.trim() ? claims.name.trim() : null;
+  return { email, name, department: normalizeDepartment(claims.department) };
+}
+async function resolveUser(email, name, department) {
+  const db = getDb();
+  const existing = await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
+  if (existing) return withDepartment(existing, department);
+  if (!config.OIDC_AUTO_PROVISION || config.OIDC_ALLOWED_DOMAINS.length === 0) {
+    throw new ExchangeError("no_account", 403);
+  }
+  const userId = uuid2();
+  const placeholderHash = await hashPassword(uuid2());
+  try {
+    await db.run(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+      [userId, email, name, placeholderHash]
+    );
+    trackEvent("user.register", { userId, email, method: "token-exchange" });
+    return withDepartment({ id: userId }, department);
+  } catch (insErr) {
+    const raced = await db.get(
+      "SELECT id FROM users WHERE LOWER(email) = ?",
+      [email]
+    );
+    if (!raced) throw insErr;
+    return withDepartment(raced, department);
+  }
+}
+async function withDepartment(user, department) {
+  try {
+    await getDb().run("UPDATE users SET department = ? WHERE id = ?", [
+      department,
+      user.id
+    ]);
+  } catch (err) {
+    console.error("[token-exchange] department upsert failed:", err);
+  }
+  return user;
+}
+async function handleTokenExchange(c) {
+  if (!config.SSO_TOKEN_EXCHANGE_ENABLED || !config.MCP_SIGNING_SECRET) {
+    return c.json(
+      { error: "Token exchange is not enabled on this server", code: "disabled" },
+      404
+    );
+  }
+  if (!tryConsume(`token-exchange:${clientIp(c)}`, TX_LIMIT)) {
+    return c.json({ error: "Too many requests", code: "rate_limited" }, 429);
+  }
+  let body;
+  try {
+    const parsed = await c.req.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("body is not a JSON object");
+    }
+    body = parsed;
+  } catch {
+    return c.json({ error: "Invalid JSON body", code: "bad_request" }, 400);
+  }
+  const provider = body.provider;
+  if (provider !== "microsoft" && provider !== "google") {
+    return c.json({ error: "Unknown or missing provider", code: "bad_request" }, 400);
+  }
+  if (!providerConfig(provider).enabled) {
+    return c.json({ error: "Provider not enabled", code: "provider_disabled" }, 400);
+  }
+  const subjectToken = typeof body.subject_token === "string" ? body.subject_token.trim() : "";
+  if (!subjectToken) {
+    return c.json({ error: "Missing subject_token", code: "bad_request" }, 400);
+  }
+  try {
+    const { email, name, department } = await verifySubjectToken(
+      provider,
+      subjectToken
+    );
+    const user = await resolveUser(email, name, department);
+    const token = signMcpTicket(
+      {
+        sub: email,
+        aud: config.PUBLIC_BASE_URL || void 0,
+        name: name ?? void 0,
+        ttlSeconds: config.MCP_TOKEN_TTL_SECONDS
+      },
+      config.MCP_SIGNING_SECRET
+    );
+    trackEvent("token_exchange.mint", { userId: user.id, provider });
+    return c.json({
+      access_token: token,
+      token_type: "Bearer",
+      expires_in: config.MCP_TOKEN_TTL_SECONDS
+    });
+  } catch (err) {
+    if (err instanceof ExchangeError) {
+      return c.json({ error: err.message, code: err.code }, err.status);
+    }
+    console.error("[token-exchange] unexpected error:", err);
+    return c.json({ error: "Token exchange failed", code: "server_error" }, 500);
+  }
+}
+
 // src/auth/routes.ts
 function isServerAdminEmail(email) {
   return isLicenseAdminEmail(email) || isSuperAdmin(email);
@@ -936,8 +1146,8 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
     [meEmail]
   );
   if (!user) {
-    const userId = uuid2();
-    const placeholderHash = await hashPassword(uuid2());
+    const userId = uuid3();
+    const placeholderHash = await hashPassword(uuid3());
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
       [userId, meEmail, rawName || null, placeholderHash]
@@ -971,6 +1181,7 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
 }
 var authRoutes = new Hono2();
 authRoutes.route("/oidc", oidcRoutes);
+authRoutes.post("/token-exchange", handleTokenExchange);
 authRoutes.post("/register", async (c) => {
   if (config.MANUAL_SIGN_IN !== "open") {
     return c.json(
@@ -1009,7 +1220,7 @@ authRoutes.post("/register", async (c) => {
     }
     throw new ValidationError("Email already registered");
   }
-  const userId = uuid2();
+  const userId = uuid3();
   const passwordHash = await hashPassword(body.password);
   await db.run(
     "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -1111,7 +1322,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const apiKey = generateApiKey();
-  const keyId = uuid2();
+  const keyId = uuid3();
   await db.run(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
     [
@@ -1140,7 +1351,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
   const apiKey = generateApiKey();
-  const keyId = uuid2();
+  const keyId = uuid3();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
   const replaced = await db.transaction(async (tx) => {
     const removed = await tx.run(
@@ -1448,7 +1659,7 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   if (supplied !== void 0) {
     assertValidPassword(supplied);
   }
-  const generated = supplied ? null : uuid2().replace(/-/g, "").slice(0, 16);
+  const generated = supplied ? null : uuid3().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
   await db.transaction(async (tx) => {
@@ -1559,7 +1770,7 @@ authRoutes.post("/invite", async (c) => {
       409
     );
   }
-  const tempPassword = uuid2().replace(/-/g, "").slice(0, 16);
+  const tempPassword = uuid3().replace(/-/g, "").slice(0, 16);
   const passwordHash = await hashPassword(tempPassword);
   let userId;
   if (existing) {
@@ -1569,7 +1780,7 @@ authRoutes.post("/invite", async (c) => {
       userId
     ]);
   } else {
-    userId = uuid2();
+    userId = uuid3();
     await db.run(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
       [userId, email, null, passwordHash]
@@ -1657,16 +1868,15 @@ import {
   normalizeStatus,
   isRejected,
   filterDocuments,
-  DocumentNotFoundError
+  DocumentNotFoundError,
+  NODE_TYPES,
+  generateIndexMd
 } from "@promptowl/contextnest-engine";
-import { rename, mkdir } from "fs/promises";
+import { rename, mkdir, rm, stat } from "fs/promises";
 import { dirname, join } from "path";
 
 // src/governance/safe-publish.ts
-import {
-  publishDocument,
-  serializeDocument
-} from "@promptowl/contextnest-engine";
+import { serializeDocument } from "@promptowl/contextnest-engine";
 function serializeNodeSafe(node) {
   return serializeDocument({
     ...node,
@@ -1804,6 +2014,10 @@ function toSafeError(err, context, message) {
       "This document is rejected. Change its status before saving."
     );
   }
+  if (isVaultLockTimeout(err)) {
+    console.error(`${context}:`, err);
+    return new VaultBusyError();
+  }
   console.error(`${context}:`, err);
   return new AppError(500, message);
 }
@@ -1818,6 +2032,12 @@ var RUNNABLE_NODE_TYPES = ["agent", "skill"];
 function isRunnableType(type) {
   return RUNNABLE_NODE_TYPES.includes(type || "");
 }
+var ACCEPTED_NODE_TYPES = /* @__PURE__ */ new Set([
+  ...NODE_TYPES,
+  ...RUNNABLE_NODE_TYPES,
+  "artifact",
+  "table"
+]);
 function toNodeResponse(node) {
   const fm = node.frontmatter;
   const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
@@ -1903,6 +2123,9 @@ function engineScopesFolders() {
   }
   return folderScopeSupported;
 }
+function isDerivedAnnotationsNode(id) {
+  return id.endsWith("--annotations");
+}
 async function getNodeForCaller(nestId, selector, userId, userEmail, opts = {}) {
   if (selector.id && !await canReadNode(nestId, selector.id, userId, userEmail)) {
     throw new ForbiddenError(
@@ -1947,12 +2170,12 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
   if (filters.folder !== void 0) assertSafeFolder(filters.folder);
   const { versions: versionManager } = await engineCache.get(nestId);
   const userEmail = await resolveCallerEmail(userId);
-  const frontmatterFilters = {
+  const listFilters = {
     ...filters.type ? { type: filters.type } : {},
     ...filters.tag ? { tag: filters.tag } : {},
-    ...filters.status ? { status: filters.status } : {},
-    includeRetired: true
+    ...filters.status ? { status: filters.status } : {}
   };
+  const frontmatterFilters = { ...listFilters, includeRetired: true };
   let documents;
   if (filters.withContent) {
     const scopeInEngine = filters.folder !== void 0 && engineScopesFolders();
@@ -1960,7 +2183,7 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
     ({ documents } = await engineApi.run(
       "context_list",
       {
-        ...frontmatterFilters,
+        ...listFilters,
         include_retired: true,
         ...scopeInEngine ? {
           folder: [scopePrefix, filters.folder].filter(Boolean).join("/"),
@@ -1976,7 +2199,13 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
       nestId,
       filters.folder !== void 0 ? { folder: filters.folder } : {}
     );
-    documents = filterDocuments(indexed, frontmatterFilters);
+    documents = filterDocuments(indexed, {
+      ...frontmatterFilters,
+      includeRetired: true
+    });
+  }
+  if (!filters.includeDerived) {
+    documents = documents.filter((d) => !isDerivedAnnotationsNode(d.id));
   }
   const scoped = filters.folder === void 0 ? documents : documents.filter((d) => folderOfId(d.id) === filters.folder);
   const nodes = scoped.map((d) => ({
@@ -2080,10 +2309,37 @@ function withSubtreeTotals(direct) {
     )
   })).sort((a, b) => a.path.localeCompare(b.path));
 }
+async function createEmptyFolder(nestId, folder) {
+  const segments = folderToSegments(folder);
+  if (segments.length === 0) {
+    throw new ValidationError("folder is required");
+  }
+  const path = segments.join("/");
+  const prefix = await storagePrefix(nestId);
+  const vaultPath = prefix ? `${prefix}/${path}` : path;
+  if (await vaultFolderExists(nestId, path)) return path;
+  const title = segments[segments.length - 1].replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+  const { storage } = await engineCache.get(nestId);
+  await storage.writeIndexMd(vaultPath, generateIndexMd(vaultPath, title, []));
+  return path;
+}
+async function vaultFolderPaths(nestId, opts = {}) {
+  const prefix = await storagePrefix(nestId);
+  const scope = [prefix, opts.folder].filter(Boolean).join("/");
+  const { storage } = await engineCache.get(nestId);
+  const entries = await storage.listFolders({
+    ...scope ? { folder: scope } : {},
+    ...opts.recursive === false ? { recursive: false } : {}
+  });
+  return entries.map(
+    (e) => prefix && e.path.startsWith(`${prefix}/`) ? e.path.slice(prefix.length + 1) : e.path
+  ).filter(Boolean);
+}
 async function listNestFolders(nestId, opts = {}) {
   if (opts.folder !== void 0) assertSafeFolder(opts.folder);
   await ensureNodeIndex(nestId);
   const counts = /* @__PURE__ */ new Map();
+  for (const path of await vaultFolderPaths(nestId, opts)) counts.set(path, 0);
   for (const { path, count } of await indexedFolderCounts(nestId)) {
     counts.set(path, count);
     let parent = path;
@@ -2108,7 +2364,9 @@ var RECENT_LIMIT = 3;
 async function nestCensus(nestId, userId) {
   const userEmail = await resolveCallerEmail(userId);
   await ensureNodeIndex(nestId);
-  const documents = await readIndexedNodes(nestId);
+  const documents = (await readIndexedNodes(nestId)).filter(
+    (d) => !isDerivedAnnotationsNode(d.id)
+  );
   const visible = await filterAccessible(nestId, userId, userEmail, documents);
   const tags = {};
   const types = {};
@@ -2129,6 +2387,7 @@ async function nestCensus(nestId, userId) {
     const segs = folder.split("/");
     for (let i = 1; i <= segs.length; i++) paths.add(segs.slice(0, i).join("/"));
   }
+  for (const path of await vaultFolderPaths(nestId)) paths.add(path);
   const folders = withSubtreeTotals(
     [...paths].map((path) => ({ path, count: direct.get(path) ?? 0 }))
   );
@@ -2172,7 +2431,10 @@ async function nestCensus(nestId, userId) {
   };
 }
 async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
-  return listNodesForCaller(nestId, await userIdFromEmail(userEmail), filters);
+  return listNodesForCaller(nestId, await userIdFromEmail(userEmail), {
+    includeDerived: true,
+    ...filters
+  });
 }
 async function actorAutoPublishes(nestId, userEmail) {
   if (!await nestAllowsSelfApprove(nestId)) return false;
@@ -2226,6 +2488,11 @@ async function createNodeOnce(nestId, input, userEmail) {
   if (requestedType === "table" && !config.TYPE_TABLE_ENABLED) {
     throw new ValidationError("Table nodes are disabled on this server");
   }
+  if (!ACCEPTED_NODE_TYPES.has(requestedType)) {
+    throw new ValidationError(
+      `unknown node type "${requestedType}"; allowed: ${[...ACCEPTED_NODE_TYPES].sort().join(", ")}`
+    );
+  }
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
       `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
@@ -2632,6 +2899,10 @@ var NODE_KEYED_TABLES = [
   // A live capability token bound to one agent node — deleting the agent must
   // revoke it, or a later node at that id answers the old webhook.
   ["trigger_hooks", "agent_node"],
+  // A live public link pinned to one node. Deleting the document must kill the
+  // link, and moving it must carry the link along — otherwise /p/<slug> serves
+  // whatever node next takes that id.
+  ["publish", "node_id"],
   ["edges", "from_node"],
   ["edges", "to_node"]
 ];
@@ -2795,6 +3066,7 @@ async function deleteFolder(nestId, folder, userEmail) {
   const docs = await storage.discoverDocuments();
   const targets = docs.map((d) => d.id).filter((id) => isIdUnderFolder(id, rel));
   if (targets.length === 0) {
+    if (await removeVaultFolder(nestId, rel)) return [];
     throw new NotFoundError(`No documents found under folder: ${folder}`);
   }
   const deleted = [];
@@ -2809,13 +3081,35 @@ async function deleteFolder(nestId, folder, userEmail) {
       );
     }
   }
+  await removeVaultFolder(nestId, rel);
   return deleted;
 }
+async function vaultFolderDir(nestId, rel) {
+  const prefix = await storagePrefix(nestId);
+  return join(
+    resolveNestPath(nestId),
+    ...prefix ? [prefix] : [],
+    ...rel.split("/")
+  );
+}
+async function vaultFolderExists(nestId, rel) {
+  if (!rel) return false;
+  try {
+    return (await stat(await vaultFolderDir(nestId, rel))).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function removeVaultFolder(nestId, rel) {
+  if (!await vaultFolderExists(nestId, rel)) return false;
+  await rm(await vaultFolderDir(nestId, rel), { recursive: true, force: true });
+  return true;
+}
 
 // src/nests/unsynced-service.ts
 import { readdirSync, readFileSync, statSync } from "fs";
 import { join as join2, relative, resolve } from "path";
-import { rm } from "fs/promises";
+import { rm as rm2 } from "fs/promises";
 var RESERVED = /* @__PURE__ */ new Set(["nests"]);
 function isNestStorageRoot(absPath) {
   return resolve(absPath) === resolve(nestStorageRoot());
@@ -2958,14 +3252,14 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
-  let stat;
+  let stat2;
   try {
-    stat = statSync(src);
+    stat2 = statSync(src);
   } catch {
     console.warn(`[unsynced] source missing: ${src}`);
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat.isDirectory()) {
+  if (!stat2.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   const files = collectMarkdownFiles(src, src);
@@ -3000,7 +3294,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
     `[unsynced] registered ${documents} document(s) for nest ${nest.id}`
   );
   try {
-    await rm(src, { recursive: true, force: true });
+    await rm2(src, { recursive: true, force: true });
     console.log(`[unsynced] removed source folder ${src}`);
   } catch (err) {
     console.error("[unsynced] failed to remove source folder", src, err);
@@ -3014,16 +3308,16 @@ async function deleteUnsyncedFolder(folderName) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for delete");
   }
-  let stat;
+  let stat2;
   try {
-    stat = statSync(src);
+    stat2 = statSync(src);
   } catch {
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat.isDirectory()) {
+  if (!stat2.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
-  await rm(src, { recursive: true, force: true });
+  await rm2(src, { recursive: true, force: true });
   console.log(`[unsynced] deleted folder ${src}`);
 }
 
@@ -3402,7 +3696,7 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
 import { Hono as Hono4 } from "hono";
 
 // src/nests/sharing-service.ts
-import { v4 as uuid3 } from "uuid";
+import { v4 as uuid4 } from "uuid";
 var VALID_PERMISSIONS = ["read", "write", "admin"];
 async function addCollaborator(params) {
   const { nestId } = params;
@@ -3429,10 +3723,10 @@ async function addCollaborator(params) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid3();
+      userId = uuid4();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid3())]
+        [userId, email, null, await hashPassword2(uuid4())]
       );
     }
   }
@@ -3470,7 +3764,7 @@ async function addCollaborator(params) {
     [params.grantedByEmail]
   ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
-  const collabId = uuid3();
+  const collabId = uuid4();
   await db.run(
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
     [collabId, nestId, userId, params.permission, granterId]
@@ -3589,6 +3883,16 @@ sharingRoutes.patch("/visibility", async (c) => {
   if (!body.visibility || !["private", "public"].includes(body.visibility)) {
     throw new ValidationError("visibility must be private or public");
   }
+  if (body.visibility === "public" && body.acknowledge_public !== true) {
+    return c.json(
+      {
+        error: "Publishing this nest requires acknowledgement.",
+        requires_acknowledgement: true,
+        warning: "This makes the nest readable by anyone on the internet, outside your organization."
+      },
+      409
+    );
+  }
   const db = getDb();
   const nestId = c.req.param("nestId");
   const result = await db.run("UPDATE nests SET visibility = ? WHERE id = ?", [
@@ -3603,10 +3907,55 @@ sharingRoutes.patch("/visibility", async (c) => {
   ]);
   return c.json({ visibility: row.visibility });
 });
+sharingRoutes.patch("/reader-mode", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
+    throw new ForbiddenError(
+      "Only the server admin can configure reader mode"
+    );
+  }
+  const body = await c.req.json();
+  if (body.enabled !== void 0 && typeof body.enabled !== "boolean") {
+    throw new ValidationError("enabled must be a boolean");
+  }
+  let homeNode;
+  if (body.home_node !== void 0) {
+    if (body.home_node === null) {
+      homeNode = null;
+    } else if (typeof body.home_node === "string") {
+      const trimmed = body.home_node.trim();
+      homeNode = trimmed === "" ? null : trimmed;
+    } else {
+      throw new ValidationError("home_node must be a string or null");
+    }
+  }
+  if (body.enabled === void 0 && homeNode === void 0) {
+    throw new ValidationError(
+      "provide enabled and/or home_node to update"
+    );
+  }
+  const db = getDb();
+  const nestId = c.req.param("nestId");
+  const exists = await db.get("SELECT id FROM nests WHERE id = ?", [
+    nestId
+  ]);
+  if (!exists) {
+    throw new NotFoundError("Nest not found");
+  }
+  await setReaderMode(nestId, { enabled: body.enabled, homeNode });
+  const saved = await db.get(
+    "SELECT reader_mode, reader_home_node FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return c.json({
+    reader_mode: saved.reader_mode,
+    reader_home_node: saved.reader_home_node
+  });
+});
 
 // src/nests/grant-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid4 } from "uuid";
+import { v4 as uuid5 } from "uuid";
 var grantRoutes = new Hono5();
 async function requireManage(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
@@ -3621,10 +3970,10 @@ async function resolveGrantee(email) {
   const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
   if (existing) return existing.id;
   const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid4();
+  const id = uuid5();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid4())]
+    [id, e, null, await hashPassword2(uuid5())]
   );
   return id;
 }
@@ -3722,1059 +4071,1718 @@ grantRoutes.delete("/:id", async (c) => {
   return c.json({ deleted: true });
 });
 
-// src/nests/nest-team-routes.ts
+// src/nests/publish-routes.ts
 import { Hono as Hono6 } from "hono";
-var nestTeamRoutes = new Hono6();
-nestTeamRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const refs = await listNestTeams(nestId);
-  const teams = [];
-  for (const ref of refs) {
-    const team = await getTeam(ref.teamId).catch(() => null);
-    teams.push({
-      teamId: ref.teamId,
-      teamName: team?.name ?? ref.teamName,
-      members: team?.members ?? []
-    });
-  }
-  return c.json({ teams });
-});
-nestTeamRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.team_id) {
-    throw new ValidationError("team_id is required");
-  }
-  const userId = c.get("userId");
-  const teams = await shareTeamWithNest({
-    nestId: c.req.param("nestId"),
-    teamId: body.team_id,
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId),
-    baseUrl: requestBaseUrl(c.req.url)
-  });
-  return c.json({ teams }, 201);
-});
-nestTeamRoutes.delete("/:teamId", async (c) => {
-  const teams = await unshareTeamFromNest({
-    nestId: c.req.param("nestId"),
-    teamId: c.req.param("teamId")
-  });
-  return c.json({ teams });
-});
-
-// src/governance/team-routes.ts
-import { Hono as Hono7 } from "hono";
 
-// src/governance/promptowl-teams.ts
-var PROMPTOWL_SOURCE = "promptowl";
-var IMPORTABLE_PROMPTOWL_ROLES = ["owner", "editor"];
-function canImportPromptowlTeam(team) {
-  return IMPORTABLE_PROMPTOWL_ROLES.includes(
-    (team.your_role || "").toLowerCase()
-  );
-}
-function mapPromptowlRole(role) {
-  switch ((role || "").toLowerCase()) {
-    case "owner":
-      return "admin";
-    case "editor":
-      return "editor";
-    default:
-      return "viewer";
-  }
-}
-async function fetchOwnedPromptowlTeams(token) {
-  if (!token?.trim()) throw new ValidationError("token is required");
-  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
-  let res;
+// src/nests/publish-service.ts
+import { v4 as uuid6 } from "uuid";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
+var MODES = ["public", "email", "code", "invite"];
+var LINK_TTL_SECONDS = 60 * 60;
+var SESSION_TTL_SECONDS = 24 * 60 * 60;
+function sha256Hex(s) {
+  return createHash2("sha256").update(s).digest("hex");
+}
+async function nodeExists(nestId, nodeId) {
   try {
-    res = await fetch(`${promptowlUrl}/api/user/teams`, {
-      headers: {
-        ...config.PROMPTOWL_FETCH_HEADERS,
-        Authorization: `Bearer ${token}`
-      }
-    });
+    const { storage } = await engineCache.get(nestId);
+    await storage.readDocument(nodeId);
+    return true;
   } catch {
-    throw new ValidationError("Could not reach PromptOwl. Check this server's network access.");
+    return false;
   }
-  if (res.status === 401) {
-    throw new UnauthorizedError(
-      "PromptOwl rejected this approval. Approve again and retry."
-    );
+}
+function newSlug() {
+  return randomBytes3(8).toString("base64url");
+}
+function newToken() {
+  return randomBytes3(32).toString("hex");
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function isPast(iso) {
+  return !!iso && new Date(iso).getTime() < Date.now();
+}
+function isLivePublish(row) {
+  return !!row && !row.revoked_at && !isPast(row.expires_at);
+}
+function toPublishResponse(row) {
+  return {
+    id: row.id,
+    slug: row.slug,
+    node_id: row.node_id,
+    access_mode: row.access_mode,
+    comments_enabled: row.comments_enabled === 1,
+    watermark: row.watermark === 1,
+    no_download: row.no_download === 1,
+    created_at: row.created_at,
+    expires_at: row.expires_at,
+    revoked_at: row.revoked_at
+  };
+}
+async function createPublish(params) {
+  const { nestId, mode, createdBy } = params;
+  const nodeId = (params.nodeId || "").trim();
+  if (!MODES.includes(mode)) {
+    throw new ValidationError("access_mode must be public | email | code | invite");
   }
-  if (!res.ok) {
-    throw new ValidationError(
-      `PromptOwl could not list your teams (HTTP ${res.status}).`
-    );
+  if (!nodeId) throw new ValidationError("node_id is required");
+  assertSafeNodeId(nodeId);
+  if (mode === "code" && !params.code?.trim()) {
+    throw new ValidationError("code is required for a code-gated publish");
   }
-  const data = await res.json();
-  return Array.isArray(data.teams) ? data.teams : [];
-}
-async function syncPromptowlTeams(params) {
-  if (!params.teamIds?.length) {
-    throw new ValidationError("team_ids is required");
+  if (params.expiresAt && Number.isNaN(new Date(params.expiresAt).getTime())) {
+    throw new ValidationError("expires_at must be an ISO date");
   }
-  const owned = await fetchOwnedPromptowlTeams(params.token);
-  const byId = new Map(owned.map((t) => [t.id, t]));
-  const selected = [];
-  for (const id of params.teamIds) {
-    const team = byId.get(id);
-    if (!team) {
-      throw new ValidationError(
-        "One of the selected teams isn't available to import. Refresh the list and try again."
-      );
-    }
-    if (!canImportPromptowlTeam(team)) {
-      throw new ForbiddenError(
-        `You're view-only on "${team.name}" in PromptOwl, so you can't import it. Ask an owner or editor of that team to import it.`
+  if (!await nodeExists(nestId, nodeId)) {
+    throw new ValidationError(`No such document in this nest: ${nodeId}`);
+  }
+  const db = getDb();
+  const id = uuid6();
+  const slug = newSlug();
+  const created = nowIso();
+  const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
+  await db.run(
+    `INSERT INTO publish
+       (id, nest_id, node_id, slug, access_mode, code_hash, comments_enabled,
+        watermark, no_download, created_by, created_at, expires_at, revoked_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)`,
+    [
+      id,
+      nestId,
+      nodeId,
+      slug,
+      mode,
+      codeHash,
+      params.commentsEnabled ? 1 : 0,
+      params.watermark ? 1 : 0,
+      params.noDownload ? 1 : 0,
+      createdBy,
+      created,
+      params.expiresAt ?? null
+    ]
+  );
+  if (mode === "invite") {
+    for (const raw of params.allowlist ?? []) {
+      const email = normalizeEmail(raw);
+      if (!email) continue;
+      await db.run(
+        `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
+         VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
+        [uuid6(), id, email, created]
       );
     }
-    selected.push(team);
   }
-  const db = getDb();
-  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
-    params.callerUserId
+  const row = await getPublishBySlug(slug);
+  if (!row) throw new ValidationError("failed to create publish");
+  return row;
+}
+async function getPublishBySlug(slug) {
+  return await getDb().get("SELECT * FROM publish WHERE slug = ?", [slug]);
+}
+async function getPublishById(nestId, id) {
+  return await getDb().get("SELECT * FROM publish WHERE id = ? AND nest_id = ?", [
+    id,
+    nestId
   ]);
-  if (!caller?.email) {
-    throw new ValidationError("Could not resolve your account.");
-  }
-  const results = [];
-  for (const poTeam of selected) {
-    results.push(await syncOne(poTeam, params.callerUserId, caller.email));
-  }
-  return results;
 }
-async function syncOne(poTeam, callerUserId, callerEmail) {
-  const existing = await findTeamByExternalId({
-    ownerId: callerUserId,
-    source: PROMPTOWL_SOURCE,
-    externalId: poTeam.id
-  });
-  const team = existing ?? await createTeam({
-    name: poTeam.name,
-    ownerId: callerUserId,
-    source: PROMPTOWL_SOURCE,
-    externalId: poTeam.id
-  });
-  if (existing && existing.name !== poTeam.name) {
-    await renameTeam({
-      teamId: team.id,
-      name: poTeam.name,
-      callerUserId,
-      allowAdmin: false
-    });
-  }
-  const desired = await desiredRoster(poTeam, callerEmail);
-  const before = new Map(team.members.map((m) => [m.email, m.role]));
-  const after = new Map(desired.map((m) => [m.email, m.role]));
-  const added = [...after.keys()].filter((e) => !before.has(e));
-  const removed = [...before.keys()].filter((e) => !after.has(e));
-  const updated = [...after.keys()].filter(
-    (e) => before.has(e) && before.get(e) !== after.get(e)
+async function listPublish(nestId) {
+  return await getDb().all(
+    "SELECT * FROM publish WHERE nest_id = ? ORDER BY created_at DESC",
+    [nestId]
   );
-  if (added.length || removed.length || updated.length) {
-    await replaceTeamRoster({
-      teamId: team.id,
-      members: desired,
-      callerUserId,
-      allowAdmin: false
-    });
-  }
-  return {
-    team_id: team.id,
-    external_id: poTeam.id,
-    name: poTeam.name,
-    created: !existing,
-    added,
-    removed,
-    updated
-  };
 }
-async function desiredRoster(poTeam, callerEmail) {
-  const caller = normalizeEmail(callerEmail);
-  const roster = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const poMember of poTeam.members || []) {
-    if (!poMember?.email) continue;
-    const email = normalizeEmail(poMember.email);
-    if (email === caller || seen.has(email)) continue;
-    seen.add(email);
-    const identity = await resolveMemberIdentity({ email });
-    roster.push({
-      userId: identity.userId,
-      email: identity.email,
-      role: mapPromptowlRole(poMember.role)
-    });
+async function revokePublish(nestId, id) {
+  const res = await getDb().run(
+    "UPDATE publish SET revoked_at = ? WHERE id = ? AND nest_id = ? AND revoked_at IS NULL",
+    [nowIso(), id, nestId]
+  );
+  return res.changes > 0;
+}
+async function verifyCode(row, code) {
+  if (row.access_mode !== "code" || !row.code_hash) return false;
+  return (await verifyPassword((code || "").trim(), row.code_hash)).ok;
+}
+async function isAllowlisted(publishId, email) {
+  const e = normalizeEmail(email);
+  if (!e) return false;
+  const row = await getDb().get(
+    "SELECT 1 AS x FROM access_grant WHERE publish_id = ? AND kind = 'invite' AND email = ? LIMIT 1",
+    [publishId, e]
+  );
+  return !!row;
+}
+async function mintMagicLink(publishId, email) {
+  const e = normalizeEmail(email);
+  const token = newToken();
+  const expires = new Date(Date.now() + LINK_TTL_SECONDS * 1e3).toISOString();
+  await getDb().run(
+    `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
+     VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
+    [uuid6(), publishId, e, sha256Hex(token), expires, nowIso()]
+  );
+  return token;
+}
+async function consumeMagicLink(publishId, token) {
+  if (!token) return null;
+  const row = await getDb().get(
+    "SELECT id, email, expires_at, used_at FROM access_grant WHERE publish_id = ? AND kind = 'link' AND token_hash = ?",
+    [publishId, sha256Hex(token)]
+  );
+  if (!row || row.used_at || isPast(row.expires_at)) return null;
+  const publishRow = await getDb().get("SELECT access_mode FROM publish WHERE id = ?", [
+    publishId
+  ]);
+  if (publishRow?.access_mode === "invite") {
+    if (!row.email || !await isAllowlisted(publishId, row.email)) return null;
   }
-  return roster;
+  const res = await getDb().run(
+    "UPDATE access_grant SET used_at = ? WHERE id = ? AND used_at IS NULL",
+    [nowIso(), row.id]
+  );
+  if (res.changes === 0) return null;
+  return row.email;
+}
+async function createSession2(publishId, email) {
+  const token = newToken();
+  const expires = new Date(Date.now() + SESSION_TTL_SECONDS * 1e3).toISOString();
+  await getDb().run(
+    `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
+     VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
+    [uuid6(), publishId, email, sha256Hex(token), expires, nowIso()]
+  );
+  return token;
+}
+async function verifySession(publishId, token) {
+  if (!token) return null;
+  const row = await getDb().get(
+    "SELECT email, expires_at FROM access_grant WHERE publish_id = ? AND kind = 'session' AND token_hash = ?",
+    [publishId, sha256Hex(token)]
+  );
+  if (!row || isPast(row.expires_at)) return null;
+  return { email: row.email };
+}
+async function logView(publishId, email) {
+  await getDb().run(
+    `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
+     VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
+    [uuid6(), publishId, email, nowIso()]
+  );
+}
+async function listAllowlist(publishId) {
+  const rows = await getDb().all(
+    "SELECT email FROM access_grant WHERE publish_id = ? AND kind = 'invite' ORDER BY created_at ASC",
+    [publishId]
+  );
+  return rows.map((r) => r.email ?? "").filter(Boolean);
+}
+async function listViews(publishId) {
+  return await getDb().all(
+    "SELECT email, created_at FROM access_grant WHERE publish_id = ? AND kind = 'view' ORDER BY created_at DESC LIMIT 500",
+    [publishId]
+  );
 }
 
-// src/governance/team-routes.ts
-var teamRoutes = new Hono7();
-var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
-var CONNECT_REQUIRED = "promptowl_connect_required";
-var CONNECT_REQUIRED_STATUS = 428;
-async function withPromptowlToken(c, run) {
-  if (!config.PROMPTOWL_TEAMS_ENABLED) {
-    return c.json({ error: "Not found" }, 404);
-  }
-  if (!tryConsume(`po-teams:ip:${clientIp(c)}`, PROMPTOWL_LIMIT)) {
-    return c.json({ error: "Too many PromptOwl requests, try again later" }, 429);
-  }
-  const token = getPromptowlTokenFromRequest(c);
-  if (!token) {
-    return c.json(
-      {
-        error: "Sign in with PromptOwl to import teams.",
-        code: CONNECT_REQUIRED
-      },
-      CONNECT_REQUIRED_STATUS
+// src/nests/publish-routes.ts
+var publishRoutes = new Hono6();
+async function requireManage2(c, nestId) {
+  if (!await canManageStewards(nestId, c.get("userId"))) {
+    throw new ForbiddenError(
+      "Only a nest admin, the nest owner, or the server admin can publish documents."
     );
   }
-  try {
-    return c.json(await run(token));
-  } catch (err) {
-    if (err instanceof UnauthorizedError) {
-      c.header(
-        "Set-Cookie",
-        buildPromptowlTokenCookie("", { secure: isSecureRequest(c), clear: true }),
-        { append: true }
-      );
-      return c.json(
-        { error: err.message, code: CONNECT_REQUIRED },
-        CONNECT_REQUIRED_STATUS
-      );
-    }
-    throw err;
-  }
 }
-teamRoutes.get(
-  "/promptowl",
-  async (c) => withPromptowlToken(c, async (token) => ({
-    teams: await fetchOwnedPromptowlTeams(token)
-  }))
-);
-teamRoutes.post("/promptowl/sync", async (c) => {
-  const body = await c.req.json().catch(() => ({}));
-  return withPromptowlToken(c, async (token) => ({
-    results: await syncPromptowlTeams({
-      callerUserId: c.get("userId"),
-      token,
-      teamIds: body.team_ids ?? []
-    })
-  }));
-});
-teamRoutes.post("/", async (c) => {
+publishRoutes.post("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  await requireManage2(c, nestId);
   const body = await c.req.json();
-  const team = await createTeam({
-    name: body.name ?? "",
-    ownerId: c.get("userId")
-  });
-  return c.json({ team }, 201);
-});
-teamRoutes.get("/", async (c) => {
-  const teams = await listTeamsForUser(c.get("userId"));
-  return c.json({ teams });
-});
-teamRoutes.get("/:teamId", async (c) => {
-  const userId = c.get("userId");
-  const team = await getTeam(c.req.param("teamId"));
-  const isMember = team.members.some((m) => m.userId === userId);
-  if (team.owner_id !== userId && !isMember && !await isLicenseAdminUserId(userId)) {
-    throw new ForbiddenError("You don't have access to this team.");
+  const mode = body.access_mode ?? "public";
+  if ((mode === "email" || mode === "invite") && !isEmailConfigured()) {
+    throw new ValidationError(
+      "Email and invite links need email set up on this server (SMTP_URL and NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
+    );
   }
-  return c.json({ team });
-});
-teamRoutes.patch("/:teamId", async (c) => {
-  const body = await c.req.json();
-  const userId = c.get("userId");
-  const team = await renameTeam({
-    teamId: c.req.param("teamId"),
-    name: body.name ?? "",
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
+  const row = await createPublish({
+    nestId,
+    nodeId: (body.node_id ?? "").trim(),
+    mode,
+    commentsEnabled: !!body.comments_enabled,
+    watermark: !!body.watermark,
+    noDownload: !!body.no_download,
+    code: body.code ?? null,
+    allowlist: Array.isArray(body.allowlist) ? body.allowlist : [],
+    expiresAt: body.expires_at ?? null,
+    createdBy: c.get("userId")
   });
-  return c.json({ team });
+  const link = `${requestBaseUrl(c.req.url)}/p/${row.slug}`;
+  if (mode === "invite") {
+    for (const email of await listAllowlist(row.id)) {
+      void sendEmailToRecipient(email, {
+        status: "shared",
+        docTitle: "A document has been shared with you",
+        path: "PromptOwl \xB7 ContextNest",
+        permission: "view",
+        link
+      });
+    }
+  }
+  return c.json({ publish: toPublishResponse(row), link }, 201);
 });
-teamRoutes.delete("/:teamId", async (c) => {
-  const userId = c.get("userId");
-  await deleteTeam({
-    teamId: c.req.param("teamId"),
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
+publishRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  await requireManage2(c, nestId);
+  const base = requestBaseUrl(c.req.url);
+  const rows = await listPublish(nestId);
+  return c.json({
+    count: rows.length,
+    publishes: rows.map((r) => ({ ...toPublishResponse(r), link: `${base}/p/${r.slug}` }))
   });
-  return c.json({ removed: true });
 });
-teamRoutes.post("/:teamId/members", async (c) => {
-  const body = await c.req.json();
-  const userId = c.get("userId");
-  const team = await addMember({
-    teamId: c.req.param("teamId"),
-    email: body.email,
-    userId: body.user_id,
-    role: body.role ?? "",
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
-  });
-  return c.json({ team }, 201);
+publishRoutes.get("/:id/views", async (c) => {
+  const nestId = c.req.param("nestId");
+  await requireManage2(c, nestId);
+  const row = await getPublishById(nestId, c.req.param("id"));
+  if (!row) throw new NotFoundError("Publish not found");
+  const views = await listViews(row.id);
+  return c.json({ count: views.length, views });
 });
-teamRoutes.patch("/:teamId/members/:userId", async (c) => {
-  const body = await c.req.json();
-  const userId = c.get("userId");
-  const team = await updateMemberRole({
-    teamId: c.req.param("teamId"),
-    userId: c.req.param("userId"),
-    role: body.role ?? "",
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
-  });
-  return c.json({ team });
-});
-teamRoutes.delete("/:teamId/members/:userId", async (c) => {
-  const userId = c.get("userId");
-  const team = await removeMember({
-    teamId: c.req.param("teamId"),
-    userId: c.req.param("userId"),
-    callerUserId: userId,
-    allowAdmin: await isLicenseAdminUserId(userId)
-  });
-  return c.json({ team });
+publishRoutes.delete("/:id", async (c) => {
+  const nestId = c.req.param("nestId");
+  await requireManage2(c, nestId);
+  const ok = await revokePublish(nestId, c.req.param("id"));
+  if (!ok) throw new NotFoundError("Publish not found");
+  return c.json({ revoked: true });
 });
 
-// src/nodes/search.ts
-async function discoverForSearch(storage) {
-  return storage.discoverDocuments({ includeRetired: true });
+// src/nests/publish-render-routes.ts
+import { Hono as Hono7 } from "hono";
+import MarkdownIt from "markdown-it";
+
+// src/annotations/service.ts
+import { v4 as uuid7 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
 }
-function titleScore(title, query) {
-  const t = (title || "").toLowerCase();
-  const q = query.trim().toLowerCase();
-  if (!q) return 0;
-  if (t === q) return 4;
-  let midWord = false;
-  for (let i = t.indexOf(q); i !== -1; i = t.indexOf(q, i + 1)) {
-    if (i === 0) return 3;
-    if (!/[a-z0-9]/.test(t[i - 1])) return 2;
-    midWord = true;
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
   }
-  if (midWord) return 1;
-  const terms = q.split(/\s+/).filter(Boolean);
-  if (terms.length > 1 && terms.every((term) => t.includes(term))) return 1;
-  return 0;
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
 }
-function matchDocuments(documents, query) {
-  const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
-  if (terms.length === 0) return [];
-  return documents.filter((node) => {
-    const haystack = [
-      node.frontmatter.title,
-      node.body || "",
-      node.frontmatter.type || "",
-      ...node.frontmatter.tags || []
-    ].join(" ").toLowerCase();
-    return terms.every((term) => haystack.includes(term));
-  }).sort(
-    (a, b) => titleScore(b.frontmatter.title, query) - titleScore(a.frontmatter.title, query)
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
+  });
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
   );
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
+  });
+  for (const key of keys) {
+    lines.push(`## ${snapshotLabel(key)}`);
+    lines.push("");
+    for (const thread of orderThreads(buckets2.get(key))) {
+      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
+      lines.push(renderAnchor(thread.anchor));
+      for (const comment of thread.comments) {
+        lines.push(
+          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
 }
-function bodySnippet(body, query) {
-  const flat = body.replace(/\s+/g, " ").trim();
-  const terms = (query || "").toLowerCase().split(/\s+/).filter(Boolean);
-  const at = terms.map((t) => flat.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0];
-  if (at === void 0 || at < 80) return flat.slice(0, 200);
-  const start = Math.max(0, at - 60);
-  return `\u2026${flat.slice(start, start + 200)}`;
+
+// src/annotations/service.ts
+async function loadComments(threadId) {
+  const db = getDb();
+  const rows = await db.all(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
+    [threadId]
+  );
+  return rows.map((r) => ({
+    id: r.id,
+    author: r.author,
+    body: r.body,
+    createdAt: r.created_at
+  }));
 }
-function toSearchHit(node, query) {
+async function rowToThread(row) {
+  let anchor = null;
+  if (row.anchor_json) {
+    try {
+      anchor = JSON.parse(row.anchor_json);
+    } catch {
+      anchor = null;
+    }
+  }
   return {
-    id: node.id,
-    title: node.frontmatter.title,
-    type: node.frontmatter.type || "document",
-    tags: node.frontmatter.tags || [],
-    snippet: bodySnippet(node.body || "", query)
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    snapshotVersion: row.snapshot_version,
+    anchor,
+    status: row.status,
+    createdBy: row.created_by,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by,
+    resolvedAt: row.resolved_at,
+    comments: await loadComments(row.id)
   };
 }
-
-// src/nodes/routes.ts
-import { Hono as Hono8 } from "hono";
-
-// src/nodes/markdown-export.ts
-import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
-function nodeToMarkdown(node) {
-  const tags = node.tags ?? [];
-  return [
-    "---",
-    `title: ${JSON.stringify(node.title ?? "")}`,
-    `tags: [${tags.map((t) => JSON.stringify(t)).join(", ")}]`,
-    `status: ${JSON.stringify(node.status ?? "")}`,
-    `id: ${JSON.stringify(node.id)}`,
-    "---",
-    ""
-  ].join("\n") + (node.body ?? "");
+async function getThreadRow(threadId) {
+  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
 }
-function nodesToMarkdown(nodes) {
-  return nodes.map(nodeToMarkdown).join("\n\n---\n\n");
+async function countThreadsByNode(nestId) {
+  const rows = await getDb().all(
+    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
+         FROM annotation_threads
+        WHERE nest_id = ?
+        GROUP BY node_id`,
+    [nestId]
+  );
+  const out = {};
+  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
+  return out;
 }
-function isMarkdownFormat(c) {
-  return c.req.query("format") === "markdown";
+async function listThreads(nestId, nodeId) {
+  const rows = await getDb().all(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
+    [nestId, nodeId]
+  );
+  return Promise.all(rows.map(rowToThread));
 }
-function isRawFormat(c) {
-  const format = c.req.query("format");
-  if (format !== void 0) return format === "raw";
-  const accept = c.req.header("Accept") ?? "";
-  return accept.split(",").some((part) => part.trim().split(";")[0].trim().toLowerCase() === "text/markdown");
+async function createThread(nestId, nodeId, input, authorEmail) {
+  const body = (input.body ?? "").trim();
+  if (!body) {
+    throw new Error("comment body is required");
+  }
+  const db = getDb();
+  const id = uuid7();
+  const anchor = clampAnchor(input.anchor);
+  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  await db.transaction(async (tx) => {
+    await tx.run(
+      `INSERT INTO annotation_threads
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+      [
+        id,
+        nestId,
+        nodeId,
+        snapshot,
+        anchor ? JSON.stringify(anchor) : null,
+        authorEmail
+      ]
+    );
+    await tx.run(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+      [uuid7(), id, authorEmail, body]
+    );
+  });
+  return rowToThread(await getThreadRow(id));
 }
-var RAW_CONTENT_TYPES = {
-  artifact: "text/html; charset=utf-8",
-  tool: "text/plain; charset=utf-8",
-  table: "text/plain; charset=utf-8"
-};
-function rawContentType(nodeType) {
-  return RAW_CONTENT_TYPES[nodeType || "document"] ?? "text/markdown; charset=utf-8";
+async function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = await getThreadRow(threadId);
+  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
+    throw new NotFoundError(`Thread not found: ${threadId}`);
+  }
+  return row;
 }
-function frontmatterBlockOf(raw) {
-  if (!raw || !raw.startsWith("---")) return "";
-  try {
-    const body = parseDocument2("frontmatter-split.md", raw, "frontmatter-split").body ?? "";
-    if (raw.endsWith(body)) return raw.slice(0, raw.length - body.length);
+async function addComment(nestId, nodeId, threadId, authorEmail, body) {
+  const trimmed = (body ?? "").trim();
+  if (!trimmed) {
+    throw new Error("comment body is required");
+  }
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  await getDb().run(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
+    [uuid7(), threadId, authorEmail, trimmed]
+  );
+  return rowToThread(await getThreadRow(threadId));
+}
+async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  await getScopedThreadRow(threadId, nestId, nodeId);
+  const db = getDb();
+  if (status === "resolved") {
+    await db.run(
+      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
+      [byEmail, threadId]
+    );
+  } else {
+    await db.run(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
+      [threadId]
+    );
+  }
+  return rowToThread(await getThreadRow(threadId));
+}
+async function readArtifact(nestId, nodeId, version) {
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
+  let title = nodeId;
+  let type = null;
+  let liveHtml = "";
+  let liveExists = true;
+  try {
+    const node = await storage.readDocument(nodeId);
+    title = node.frontmatter?.title || nodeId;
+    type = node.frontmatter?.type || null;
+    liveHtml = node.body || "";
   } catch {
+    liveExists = false;
+  }
+  if (target != null) {
+    try {
+      const raw = await versionManager.reconstructVersion(nodeId, target);
+      return { title, html: bodyOnly(nodeId, raw), version: target, type };
+    } catch (err) {
+      console.warn(
+        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
+        err
+      );
+    }
+  }
+  if (!liveExists) {
+    throw new NotFoundError(`Artifact not found: ${nodeId}`);
+  }
+  return { title, html: liveHtml, version: target, type };
+}
+function derivedAnnotationsId(sourceNodeId) {
+  const base = sourceNodeId.replace(/^nodes\//, "");
+  return `nodes/${base}--annotations`;
+}
+async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  try {
+    let title = nodeId;
+    let type = null;
+    try {
+      const { storage } = await engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+      type = node.frontmatter?.type || "document";
+    } catch {
+    }
+    if (type !== null && type !== "artifact") return;
+    const threads = await listThreads(nestId, nodeId);
+    const derivedTitle = `${title.slice(0, 100)} \u2014 Annotations`;
+    const markdown2 = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown2 }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown2,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
+    );
   }
-  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  return m ? `---
-${m[1]}
----
-
-` : "";
 }
 
-// src/nodes/routes.ts
-var nodeRoutes = new Hono8();
-function nodeAsMarkdown(response, nodeId) {
-  return nodeToMarkdown({
-    id: nodeId,
-    title: response.title,
-    tags: response.tags,
-    status: response.status,
-    body: response.content
-  });
+// src/nests/publish-render-routes.ts
+var publishRenderRoutes = new Hono7();
+var SESSION_TTL_SECONDS2 = 24 * 60 * 60;
+var GATE_LIMIT = { max: 10, windowMs: 10 * 6e4 };
+var COMMENT_LIMIT = { max: 5, windowMs: 10 * 6e4 };
+var COMMENT_MAX_CHARS = 4e3;
+var markdown = new MarkdownIt({ html: false, linkify: true, breaks: false });
+var PROSE_CSS = `
+  body{margin:0;background:#fff;color:#1c1917;font:16px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  main{max-width:820px;margin:0 auto;padding:48px 24px}
+  h1,h2,h3,h4{color:#142a80;line-height:1.25;margin:1.8em 0 .6em}
+  h1{font-size:2em;margin-top:0}h2{font-size:1.5em}h3{font-size:1.2em}h4{font-size:1.05em}
+  p,ul,ol,blockquote,table{margin:0 0 1.1em}
+  ul,ol{padding-left:1.5em}li{margin:.3em 0}
+  a{color:#142a80}
+  hr{border:0;border-top:1px solid #e7e5e4;margin:2em 0}
+  blockquote{border-left:3px solid #d6d3d1;margin-left:0;padding:.2em 0 .2em 1em;color:#57534e}
+  code{background:#f5f5f4;border-radius:4px;padding:.15em .35em;font:.9em/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+  pre{background:#f5f5f4;border-radius:9px;padding:14px 16px;overflow-x:auto}
+  pre code{background:none;padding:0}
+  table{border-collapse:collapse;width:100%;display:block;overflow-x:auto}
+  th,td{border:1px solid #e7e5e4;padding:8px 10px;text-align:left}
+  th{background:#fafaf9}
+  img{max-width:100%}
+`;
+function cookieName(slug) {
+  return `cnp_${slug}`;
 }
-function rawNodeBody(c, response, storedRaw) {
-  const body = response.content ?? "";
-  const payload = c.req.query("frontmatter") === "1" ? frontmatterBlockOf(storedRaw) + body : body;
-  c.header("X-Content-Type-Options", "nosniff");
-  if ((response.type || "document") === "artifact") {
-    applyArtifactSandboxHeaders(c);
+function readCookie2(c, name) {
+  const raw = c.req.header("cookie");
+  if (!raw) return null;
+  for (const part of raw.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) {
+      try {
+        return decodeURIComponent(part.slice(eq + 1).trim());
+      } catch {
+        return part.slice(eq + 1).trim();
+      }
+    }
   }
-  return c.body(payload, 200, {
-    "Content-Type": rawContentType(response.type)
-  });
+  return null;
 }
-nodeRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const q = c.req.query();
-  const limit = q.limit ? parseInt(q.limit, 10) : void 0;
-  const nodes = await listNodesForCaller(nestId, userId, {
-    ...q.type ? { type: q.type } : {},
-    ...q.tag ? { tag: q.tag } : {},
-    ...q.status ? { status: q.status } : {},
-    // Lets an owner preview what making the nest public would expose.
-    ...q.approved_only === "1" || q.approved_only === "true" ? { approvedOnly: true } : {},
-    // Ignore junk rather than 400 — a bad ?limit should not fail a listing.
-    ...limit !== void 0 && Number.isFinite(limit) && limit > 0 ? { limit } : {},
-    // Present (even as "") = one folder level only, for the lazily-expanded
-    // document tree. Absent = the whole nest, as every existing caller expects.
-    ...q.folder !== void 0 ? { folder: q.folder } : {},
-    // Bodies are off by default — the list is served from the DB index, which
-    // holds metadata only. Opt back in and the listing crawls the vault for
-    // them; kept for any client that was reading `content` off this route.
-    ...q.content === "1" || q.content === "true" ? { withContent: true } : {}
-  });
-  return c.json({ count: nodes.length, nodes });
-});
-nodeRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.title || !body.content) {
-    throw new ValidationError("title and content are required");
+function setSessionCookie2(c, slug, token) {
+  const parts = [
+    `${cookieName(slug)}=${encodeURIComponent(token)}`,
+    "HttpOnly",
+    `Path=/p/${slug}`,
+    "SameSite=Lax",
+    `Max-Age=${SESSION_TTL_SECONDS2}`
+  ];
+  if (isSecureRequest(c)) parts.push("Secure");
+  c.header("Set-Cookie", parts.join("; "));
+}
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var NO_DOWNLOAD_CSS = `<style>
+  @media print{html,body{display:none !important}}
+  html,body{-webkit-user-select:none;-ms-user-select:none;user-select:none}
+  img,a,svg,canvas{-webkit-user-drag:none;user-drag:none}
+</style>`;
+var SHELL_PRINT_BLANK = `<style>@media print{html,body{display:none !important}}</style>`;
+var NO_DOWNLOAD_SCRIPT = `<script>
+  (function () {
+    function stop(e) { e.preventDefault(); return false; }
+    ["contextmenu", "copy", "cut", "dragstart", "selectstart"].forEach(function (evt) {
+      document.addEventListener(evt, stop, { capture: true });
+    });
+    document.addEventListener("keydown", function (e) {
+      var k = (e.key || "").toLowerCase();
+      // Save, print, copy, cut, select-all, view-source.
+      if ((e.ctrlKey || e.metaKey) && ["s", "p", "c", "x", "a", "u"].indexOf(k) !== -1) return stop(e);
+      // DevTools. Blocking these is courtesy at best \u2014 the browser menu still
+      // opens them \u2014 but it stops the reflex.
+      if (k === "f12") return stop(e);
+      if ((e.ctrlKey || e.metaKey) && e.shiftKey && ["i", "j", "c"].indexOf(k) !== -1) return stop(e);
+    }, { capture: true });
+    // Belt and braces with the print stylesheet, for engines that ignore it.
+    window.addEventListener("beforeprint", function () { document.body.style.display = "none"; });
+    window.addEventListener("afterprint", function () { document.body.style.display = ""; });
+  })();
+</script>`;
+function overlayMarkup(row, viewerEmail) {
+  const parts = [];
+  if (row.no_download === 1) {
+    parts.push(NO_DOWNLOAD_CSS, NO_DOWNLOAD_SCRIPT);
+  }
+  if (row.watermark === 1 && viewerEmail) {
+    parts.push(
+      `<style>#cn-watermark{position:fixed;inset:0;z-index:2147483647;pointer-events:none;overflow:hidden;display:flex;align-items:center;justify-content:center}#cn-watermark span{font:700 42px/1 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:rgba(20,42,128,.10);transform:rotate(-24deg);white-space:nowrap}</style><div id="cn-watermark" aria-hidden="true"><span>${esc(viewerEmail)}</span></div>`
+    );
+  }
+  return parts.join("");
+}
+async function publishedTitle(row) {
+  try {
+    return (await readArtifact(row.nest_id, row.node_id)).title || row.node_id;
+  } catch {
+    return row.node_id;
   }
-  if (body.folder !== void 0 && typeof body.folder !== "string") {
-    throw new ValidationError('folder must be a string path like "gtm/deals"');
+}
+function withOverlays(html, extra) {
+  if (!extra) return html;
+  const at = html.toLowerCase().lastIndexOf("</body>");
+  return at === -1 ? html + extra : html.slice(0, at) + extra + html.slice(at);
+}
+async function renderPublished(c, row, viewerEmail) {
+  let artifact;
+  try {
+    artifact = await readArtifact(row.nest_id, row.node_id);
+  } catch {
+    return c.html(unavailablePage(), 404);
   }
-  const nestId = c.req.param("nestId");
-  const authorEmail = await getUserEmail(c);
-  const { node } = await createNode(
-    nestId,
-    {
-      title: body.title,
-      content: body.content,
-      type: body.type,
-      tags: body.tags,
-      scope: body.scope,
-      status: body.status,
-      schedule: body.schedule,
-      folder: body.folder,
-      prime: body.prime
-    },
-    authorEmail
-  );
-  const resolved = await resolveStewardsForNode(nestId, node.id);
-  return c.json({
-    node: toNodeResponse(node),
-    stewards: resolved.length > 0 ? resolved.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      source: r.source
-    })) : void 0
-  }, 201);
+  if (artifact.version == null) return c.html(unavailablePage(), 404);
+  const type = String(artifact.type ?? "document");
+  const body = artifact.html ?? "";
+  const isHtml = type === "artifact" || /^\s*<(?:!doctype|html)\b/i.test(body);
+  await logView(row.id, viewerEmail);
+  applyArtifactSandboxHeaders(c);
+  const overlays = overlayMarkup(row, viewerEmail);
+  if (isHtml) {
+    return c.body(withOverlays(body, overlays), 200, {
+      "Content-Type": "text/html; charset=utf-8"
+    });
+  }
+  const title = esc(artifact.title || row.node_id);
+  const heading = /^\s*#\s/.test(body) ? "" : `<h1>${title}</h1>`;
+  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title><style>${PROSE_CSS}</style></head><body><main>${heading}${markdown.render(body)}</main>${overlays}</body></html>`;
+  return c.body(shell, 200, { "Content-Type": "text/html; charset=utf-8" });
+}
+var EYE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>`;
+var EYE_OFF_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9.9 4.24A9.1 9.1 0 0 1 12 4c6.4 0 10 7 10 7a17.6 17.6 0 0 1-2.2 3.14M6.6 6.6A17.7 17.7 0 0 0 2 11s3.6 7 10 7a9 9 0 0 0 5.4-1.6"/><path d="M9.9 9.9a3 3 0 0 0 4.2 4.2"/><path d="m2 2 20 20"/></svg>`;
+var GATE_EYE_SCRIPT = `<script>
+  (function () {
+    var input = document.getElementById("cn-code");
+    var btn = document.getElementById("cn-eye");
+    btn.addEventListener("click", function () {
+      var show = input.type === "password";
+      var at = input.selectionStart;
+      input.type = show ? "text" : "password";
+      btn.innerHTML = show ? ${JSON.stringify(EYE_OFF_SVG)} : ${JSON.stringify(EYE_SVG)};
+      btn.setAttribute("aria-label", show ? "Hide code" : "Show code");
+      btn.setAttribute("aria-pressed", show ? "true" : "false");
+      input.focus();
+      try { input.setSelectionRange(at, at); } catch (e) {}
+    });
+  })();
+</script>`;
+function gatePage(row, message) {
+  const wantsCode = row.access_mode === "code";
+  const field = wantsCode ? `<label>Access code<span class="wrap">
+        <input id="cn-code" name="code" type="password" autocomplete="off" required autofocus>
+        <button type="button" id="cn-eye" class="eye" aria-label="Show code" aria-pressed="false">${EYE_SVG}</button>
+      </span></label>` : `<label>Your email<input name="email" type="email" autocomplete="email" required autofocus></label>`;
+  const cta = wantsCode ? "Unlock" : "Send me a link";
+  const note = wantsCode ? "This document is protected by a passcode." : "Enter your email and we'll send you a one-time link to open it.";
+  const err = message ? `<p class="err">${esc(message)}</p>` : "";
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Protected document</title><style>
+    :root{--indigo:#142a80;--owl:#FF6500}
+    body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+    .card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:380px;width:calc(100% - 32px)}
+    h1{font-size:20px;color:var(--indigo);margin:0 0 6px}
+    p{color:#78716c;margin:0 0 18px;font-size:14px}
+    label{display:block;font-size:13px;font-weight:600;color:#44403c;margin-bottom:16px}
+    input{display:block;width:100%;margin-top:6px;padding:10px 12px;border:1px solid #d6d3d1;border-radius:9px;font:inherit;box-sizing:border-box}
+    .wrap{display:block;position:relative}
+    .wrap input{padding-right:44px}
+    button{width:100%;background:var(--indigo);color:#fff;font-weight:700;border:0;border-radius:9px;padding:11px;font-size:15px;cursor:pointer}
+    button.eye{position:absolute;top:6px;right:0;width:40px;height:calc(100% - 6px);background:none;border:0;padding:0;color:#78716c;display:grid;place-items:center;cursor:pointer}
+    button.eye:hover{color:#44403c}
+    button.eye svg{width:18px;height:18px;display:block}
+    .err{color:#be123c;font-weight:600}
+    .brand{font-size:12px;color:#a8a29e;margin:18px 0 0;text-align:center}
+  </style></head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
+    <h1>Protected document</h1><p>${esc(note)}</p>${err}${field}
+    <button type="submit">${cta}</button>
+    <p class="brand">Secured by PromptOwl \xB7 ContextNest</p>
+  </form>${wantsCode ? GATE_EYE_SCRIPT : ""}</body></html>`;
+}
+function unavailablePage() {
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Link unavailable</title><style>
+    body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+    .card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:420px;width:calc(100% - 32px);text-align:center}
+    h1{font-size:20px;color:#142a80;margin:0 0 8px}
+    p{color:#78716c;margin:0;font-size:14px}
+    .brand{font-size:12px;color:#a8a29e;margin:18px 0 0}
+  </style></head><body><div class="card">
+    <h1>This link is no longer available</h1>
+    <p>It may have been revoked by its owner, or it may have expired. Ask whoever shared it with you for a new link.</p>
+    <p class="brand">Secured by PromptOwl \xB7 ContextNest</p>
+  </div></body></html>`;
+}
+function sentPage() {
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Check your email</title><style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}.card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:380px;text-align:center}h1{font-size:20px;color:#142a80;margin:0 0 6px}p{color:#78716c;margin:0;font-size:14px}</style></head><body><div class="card"><h1>Check your email</h1><p>If your address has access, a one-time link to open this document is on its way.</p></div></body></html>`;
+}
+function readerShell(row, title, viewerEmail) {
+  const emailField = viewerEmail ? `<p class="who">Commenting as <strong>${esc(viewerEmail)}</strong></p>` : `<label>Your email<input id="cn-email" type="email" autocomplete="email" required></label>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>
+    html,body{margin:0;height:100%}
+    #cn-frame{border:0;width:100%;height:100%;display:block}
+    #cn-open{position:fixed;right:18px;bottom:18px;z-index:20;background:#142a80;color:#fff;font:600 14px/1 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;padding:11px 16px;border:0;border-radius:9999px;cursor:pointer;box-shadow:0 4px 14px rgba(20,42,128,.32)}
+    #cn-back{position:fixed;inset:0;z-index:30;background:rgba(28,25,23,.45);display:none;place-items:center}
+    #cn-back[data-open]{display:grid}
+    .card{background:#fff;border-radius:14px;box-shadow:0 10px 40px rgba(20,42,128,.22);padding:28px 30px;width:min(460px,calc(100% - 32px));font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:#1c1917;box-sizing:border-box}
+    .card h2{font-size:20px;color:#142a80;margin:0 0 6px}
+    .card p{color:#78716c;margin:0 0 18px;font-size:14px}
+    .who strong{color:#44403c}
+    label{display:block;font-size:13px;font-weight:600;color:#44403c;margin-bottom:16px}
+    input,textarea{display:block;width:100%;margin-top:6px;padding:10px 12px;border:1px solid #d6d3d1;border-radius:9px;font:inherit;box-sizing:border-box}
+    textarea{min-height:130px;resize:vertical}
+    .row{display:flex;gap:10px}
+    button{flex:1;background:#142a80;color:#fff;font-weight:700;border:0;border-radius:9px;padding:11px;font-size:15px;cursor:pointer}
+    button.ghost{background:#f5f5f4;color:#44403c}
+    button[disabled]{opacity:.6;cursor:default}
+    .msg{font-weight:600;margin:0 0 14px;font-size:14px}
+    .msg.err{color:#be123c}.msg.ok{color:#15803d}
+  </style></head><body>
+    <iframe id="cn-frame" src="/p/${esc(row.slug)}/view" title="${esc(title)}"></iframe>
+    <button id="cn-open" type="button">Leave a comment</button>
+    <div id="cn-back"><div class="card" role="dialog" aria-modal="true" aria-label="Leave a comment">
+      <h2>Leave a comment</h2>
+      <p>Your comment goes to this document's stewards for review \u2014 it is not posted publicly.</p>
+      <p class="msg" id="cn-msg" hidden></p>
+      ${emailField}
+      <label>Comment<textarea id="cn-body" maxlength="${COMMENT_MAX_CHARS}" required></textarea></label>
+      <div class="row">
+        <button type="button" class="ghost" id="cn-cancel">Cancel</button>
+        <button type="button" id="cn-send">Send comment</button>
+      </div>
+    </div></div>
+  <script>
+  (function () {
+    var back = document.getElementById("cn-back");
+    var msg = document.getElementById("cn-msg");
+    var send = document.getElementById("cn-send");
+    var bodyEl = document.getElementById("cn-body");
+    var emailEl = document.getElementById("cn-email");
+    function show(text, ok) {
+      msg.textContent = text;
+      msg.className = "msg " + (ok ? "ok" : "err");
+      msg.hidden = false;
+    }
+    function open() { msg.hidden = true; back.setAttribute("data-open", ""); (emailEl || bodyEl).focus(); }
+    function close() { back.removeAttribute("data-open"); }
+    document.getElementById("cn-open").addEventListener("click", open);
+    document.getElementById("cn-cancel").addEventListener("click", close);
+    back.addEventListener("click", function (e) { if (e.target === back) close(); });
+    document.addEventListener("keydown", function (e) { if (e.key === "Escape") close(); });
+    send.addEventListener("click", function () {
+      var payload = { body: bodyEl.value };
+      if (emailEl) payload.email = emailEl.value;
+      send.disabled = true;
+      fetch("/p/${esc(row.slug)}/comments", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      })
+        .then(function (r) { return r.json().then(function (d) { return { ok: r.ok, d: d }; }); })
+        .then(function (res) {
+          if (!res.ok) { show(res.d.error || "Could not send that comment.", false); return; }
+          bodyEl.value = "";
+          show("Thanks \u2014 your comment is with the stewards.", true);
+          setTimeout(close, 1600);
+        })
+        .catch(function () { show("Could not reach the server.", false); })
+        .then(function () { send.disabled = false; });
+    });
+  })();
+  </script>${row.no_download === 1 ? SHELL_PRINT_BLANK : ""}</body></html>`;
+}
+var SHELL_CSP = [
+  "default-src 'none'",
+  "script-src 'unsafe-inline'",
+  "style-src 'unsafe-inline'",
+  "frame-src 'self'",
+  "connect-src 'self'"
+].join("; ");
+async function resolveViewer(c, row) {
+  if (row.access_mode === "public") return { email: null };
+  const token = readCookie2(c, cookieName(row.slug));
+  return token ? await verifySession(row.id, token) : null;
+}
+publishRenderRoutes.get("/:slug", async (c) => {
+  const slug = c.req.param("slug");
+  const row = await getPublishBySlug(slug);
+  if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
+  const viewer = await resolveViewer(c, row);
+  if (!viewer) return c.html(gatePage(row));
+  if (row.comments_enabled !== 1) return renderPublished(c, row, viewer.email);
+  const title = await publishedTitle(row);
+  c.header("Content-Security-Policy", SHELL_CSP);
+  c.header("Referrer-Policy", "no-referrer");
+  return c.html(readerShell(row, title, viewer.email));
+});
+publishRenderRoutes.get("/:slug/view", async (c) => {
+  const slug = c.req.param("slug");
+  const row = await getPublishBySlug(slug);
+  if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
+  const viewer = await resolveViewer(c, row);
+  if (!viewer) return c.html(unavailablePage(), 404);
+  return renderPublished(c, row, viewer.email);
+});
+publishRenderRoutes.post("/:slug/comments", async (c) => {
+  const slug = c.req.param("slug");
+  const row = await getPublishBySlug(slug);
+  if (!isLivePublish(row) || row.comments_enabled !== 1) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  const viewer = await resolveViewer(c, row);
+  if (!viewer) return c.json({ error: "Not found" }, 404);
+  if (!tryConsume(`publish-comment:${slug}:${clientIp(c)}`, COMMENT_LIMIT)) {
+    return c.json({ error: "Too many comments. Try again in a few minutes." }, 429);
+  }
+  const input = await c.req.json().catch(() => ({}));
+  const email = viewer.email ?? normalizeEmail(String(input.email ?? ""));
+  if (!isEmailish(email)) {
+    return c.json({ error: "Enter a valid email address." }, 400);
+  }
+  const body = String(input.body ?? "").trim().slice(0, COMMENT_MAX_CHARS);
+  if (!body) {
+    return c.json({ error: "Write a comment first." }, 400);
+  }
+  await createThread(row.nest_id, row.node_id, { body, anchor: null }, email);
+  return c.json({ ok: true });
 });
-nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-U4CKL7Y5.js");
-  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
-    nestId,
-    nodeId
-  );
-  return c.json({
-    nodeId,
-    stewards: stewards.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      scope: r.steward.scope,
-      source: r.source,
-      priority: r.priority
-    })),
-    fallbackToOwner,
-    ownerEmail
+publishRenderRoutes.post("/:slug/gate", async (c) => {
+  const slug = c.req.param("slug");
+  const row = await getPublishBySlug(slug);
+  if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
+  if (!tryConsume(`publish-gate:${slug}:${clientIp(c)}`, GATE_LIMIT)) {
+    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes."), 429);
+  }
+  if (row.access_mode === "public") return c.redirect(`/p/${slug}`);
+  const form = await c.req.parseBody();
+  if (row.access_mode === "code") {
+    if (!await verifyCode(row, String(form.code ?? ""))) {
+      return c.html(gatePage(row, "That code is not correct."), 401);
+    }
+    setSessionCookie2(c, slug, await createSession2(row.id, null));
+    return c.redirect(`/p/${slug}`);
+  }
+  const email = normalizeEmail(String(form.email ?? ""));
+  if (!isEmailish(email)) {
+    return c.html(gatePage(row, "Enter a valid email address."), 400);
+  }
+  const allowed = row.access_mode !== "invite" || await isAllowlisted(row.id, email);
+  const linkToken = await mintMagicLink(row.id, email);
+  if (!allowed) return c.html(sentPage());
+  const link = `${requestBaseUrl(c.req.url)}/p/${slug}/verify?token=${linkToken}`;
+  void sendEmailToRecipient(email, {
+    status: "shared",
+    docTitle: "A document has been shared with you",
+    path: "PromptOwl \xB7 ContextNest",
+    link
   });
+  return c.html(sentPage());
 });
-nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-H2M5ACPQ.js");
-  const history = await getReviewHistory2(nestId, nodeId);
-  return c.json({ reviews: history });
+publishRenderRoutes.get("/:slug/verify", async (c) => {
+  const slug = c.req.param("slug");
+  const row = await getPublishBySlug(slug);
+  if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
+  const email = await consumeMagicLink(row.id, c.req.query("token") ?? "");
+  if (!email) {
+    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one."), 401);
+  }
+  setSessionCookie2(c, slug, await createSession2(row.id, email));
+  return c.redirect(`/p/${slug}`);
 });
-nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+
+// src/nests/nest-team-routes.ts
+import { Hono as Hono8 } from "hono";
+var nestTeamRoutes = new Hono8();
+nestTeamRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { versions: versionManager } = await engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
-    );
+  const refs = await listNestTeams(nestId);
+  const teams = [];
+  for (const ref of refs) {
+    const team = await getTeam(ref.teamId).catch(() => null);
+    teams.push({
+      teamId: ref.teamId,
+      teamName: team?.name ?? ref.teamName,
+      members: team?.members ?? []
+    });
   }
-  const body = await c.req.json().catch(() => ({}));
-  const targetVersion = Number(body.targetVersion);
-  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
-    throw new ValidationError("targetVersion (a positive integer) is required");
+  return c.json({ teams });
+});
+nestTeamRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.team_id) {
+    throw new ValidationError("team_id is required");
   }
-  let raw;
+  const userId = c.get("userId");
+  const teams = await shareTeamWithNest({
+    nestId: c.req.param("nestId"),
+    teamId: body.team_id,
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId),
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ teams }, 201);
+});
+nestTeamRoutes.delete("/:teamId", async (c) => {
+  const teams = await unshareTeamFromNest({
+    nestId: c.req.param("nestId"),
+    teamId: c.req.param("teamId")
+  });
+  return c.json({ teams });
+});
+
+// src/governance/team-routes.ts
+import { Hono as Hono9 } from "hono";
+
+// src/governance/promptowl-teams.ts
+var PROMPTOWL_SOURCE = "promptowl";
+var IMPORTABLE_PROMPTOWL_ROLES = ["owner", "editor"];
+function canImportPromptowlTeam(team) {
+  return IMPORTABLE_PROMPTOWL_ROLES.includes(
+    (team.your_role || "").toLowerCase()
+  );
+}
+function mapPromptowlRole(role) {
+  switch ((role || "").toLowerCase()) {
+    case "owner":
+      return "admin";
+    case "editor":
+      return "editor";
+    default:
+      return "viewer";
+  }
+}
+async function fetchOwnedPromptowlTeams(token) {
+  if (!token?.trim()) throw new ValidationError("token is required");
+  const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
+  let res;
   try {
-    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+    res = await fetch(`${promptowlUrl}/api/user/teams`, {
+      headers: {
+        ...config.PROMPTOWL_FETCH_HEADERS,
+        Authorization: `Bearer ${token}`
+      }
+    });
   } catch {
-    throw new NotFoundError(
-      `Version ${targetVersion} not found for ${nodeId}`
-    );
+    throw new ValidationError("Could not reach PromptOwl. Check this server's network access.");
   }
-  const content = bodyOnly(nodeId, raw);
-  const { node, version } = await updateNode(
-    nestId,
-    nodeId,
-    { content, changeNote: `Restored from version ${targetVersion}` },
-    userEmail
-  );
-  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
-  return c.json({ ok: true, version, node: toNodeResponse(node) });
-});
-nodeRoutes.post("/:nodeId{.+}/move", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
+  if (res.status === 401) {
+    throw new UnauthorizedError(
+      "PromptOwl rejected this approval. Approve again and retry."
     );
   }
-  const body = await c.req.json().catch(() => ({}));
-  if (typeof body.folder !== "string") {
-    throw new ValidationError('folder (a string; "" for the nest root) is required');
-  }
-  const { node, previousId } = await moveNode(nestId, nodeId, body.folder, userEmail);
-  return c.json({ ok: true, node: toNodeResponse(node), previousId });
-});
-nodeRoutes.get("/:nodeId{.+}/watchers", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  return c.json({ watchers: await listWatchers(nestId, nodeId) });
-});
-nodeRoutes.post("/:nodeId{.+}/watchers", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const body = await c.req.json().catch(() => ({}));
-  const email = typeof body.email === "string" ? body.email.trim() : "";
-  if (!email || !email.includes("@")) {
-    throw new ValidationError("email is required");
+  if (!res.ok) {
+    throw new ValidationError(
+      `PromptOwl could not list your teams (HTTP ${res.status}).`
+    );
   }
-  await addWatcher(nestId, nodeId, email, await getUserEmail(c));
-  return c.json({ watchers: await listWatchers(nestId, nodeId) }, 201);
-});
-nodeRoutes.delete("/:nodeId{.+}/watchers", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const email = c.req.query("email")?.trim() ?? "";
-  if (!email) throw new ValidationError("email query param is required");
-  if (!await removeWatcher(nestId, nodeId, email)) {
-    throw new NotFoundError("Not watching");
+  const data = await res.json();
+  return Array.isArray(data.teams) ? data.teams : [];
+}
+async function syncPromptowlTeams(params) {
+  if (!params.teamIds?.length) {
+    throw new ValidationError("team_ids is required");
   }
-  return c.json({ watchers: await listWatchers(nestId, nodeId) });
-});
-nodeRoutes.get("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  let node = await getNodeForCaller(
-    nestId,
-    { id: nodeId },
-    userId,
-    userEmail,
-    { verifyChecksum: true }
-  );
-  if (node.pendingChange) {
-    try {
-      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
-      const refreshed = await getPendingChange(nestId, nodeId);
-      if (refreshed) node.pendingChange = refreshed;
-    } catch (err) {
-      console.error("[external-edit] stage-on-read failed:", err);
+  const owned = await fetchOwnedPromptowlTeams(params.token);
+  const byId = new Map(owned.map((t) => [t.id, t]));
+  const selected = [];
+  for (const id of params.teamIds) {
+    const team = byId.get(id);
+    if (!team) {
+      throw new ValidationError(
+        "One of the selected teams isn't available to import. Refresh the list and try again."
+      );
     }
-    try {
-      const latest = await loadLatestApprovedNode(nestId, nodeId);
-      if (latest) {
-        node = { ...latest, pendingChange: node.pendingChange };
-      }
-    } catch (err) {
-      console.error("[external-edit] reconstruct-latest failed:", err);
+    if (!canImportPromptowlTeam(team)) {
+      throw new ForbiddenError(
+        `You're view-only on "${team.name}" in PromptOwl, so you can't import it. Ask an owner or editor of that team to import it.`
+      );
     }
+    selected.push(team);
   }
-  const response = toNodeResponse(node);
-  const publicReader = await isPublicReader(nestId, userId);
-  if (!publicReader) {
-    const people = (await resolveAuthorship(nestId, [
-      { id: nodeId, frontmatterAuthor: node.frontmatter?.author ?? null }
-    ])).get(nodeId);
-    if (people) {
-      response.author = people.author;
-      response.collaborators = people.collaborators;
-    }
+  const db = getDb();
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+    params.callerUserId
+  ]);
+  if (!caller?.email) {
+    throw new ValidationError("Could not resolve your account.");
   }
-  response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
-  if (publicReader) {
-    const approved = await getApprovedVersion(nestId, nodeId);
-    if (approved != null) {
-      let approvedRaw = "";
-      try {
-        approvedRaw = await versionManager.reconstructVersion(
-          nodeId,
-          approved
-        );
-        response.content = bodyOnly(nodeId, approvedRaw);
-      } catch (err) {
-        console.error(
-          "reconstructVersion failed (public single)",
-          nodeId,
-          approved,
-          err
-        );
-        response.content = "";
-      }
-      response.version = approved;
-      response.status = "published";
-      if (isRawFormat(c)) {
-        return rawNodeBody(c, response, approvedRaw);
-      }
-      if (isMarkdownFormat(c)) {
-        return c.body(nodeAsMarkdown(response, nodeId), 200, {
-          "Content-Type": "text/markdown; charset=utf-8"
-        });
-      }
-      return c.json({ node: response });
-    }
+  const results = [];
+  for (const poTeam of selected) {
+    results.push(await syncOne(poTeam, params.callerUserId, caller.email));
   }
-  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
-  if (response.status === "pending_review") {
-    const pending = await getPendingReview(nestId, nodeId);
-    response.pendingReviewBy = pending?.requestedBy ?? null;
+  return results;
+}
+async function syncOne(poTeam, callerUserId, callerEmail) {
+  const existing = await findTeamByExternalId({
+    ownerId: callerUserId,
+    source: PROMPTOWL_SOURCE,
+    externalId: poTeam.id
+  });
+  const team = existing ?? await createTeam({
+    name: poTeam.name,
+    ownerId: callerUserId,
+    source: PROMPTOWL_SOURCE,
+    externalId: poTeam.id
+  });
+  if (existing && existing.name !== poTeam.name) {
+    await renameTeam({
+      teamId: team.id,
+      name: poTeam.name,
+      callerUserId,
+      allowAdmin: false
+    });
   }
-  response.deletionRequest = await getLatestDeletionRequest(
-    nestId,
-    nodeId
+  const desired = await desiredRoster(poTeam, callerEmail);
+  const before = new Map(team.members.map((m) => [m.email, m.role]));
+  const after = new Map(desired.map((m) => [m.email, m.role]));
+  const added = [...after.keys()].filter((e) => !before.has(e));
+  const removed = [...before.keys()].filter((e) => !after.has(e));
+  const updated = [...after.keys()].filter(
+    (e) => before.has(e) && before.get(e) !== after.get(e)
   );
-  if (isRawFormat(c)) {
-    return rawNodeBody(c, response, node.rawContent);
+  if (added.length || removed.length || updated.length) {
+    await replaceTeamRoster({
+      teamId: team.id,
+      members: desired,
+      callerUserId,
+      allowAdmin: false
+    });
   }
-  if (isMarkdownFormat(c)) {
-    return c.body(nodeAsMarkdown(response, nodeId), 200, {
-      "Content-Type": "text/markdown; charset=utf-8"
+  return {
+    team_id: team.id,
+    external_id: poTeam.id,
+    name: poTeam.name,
+    created: !existing,
+    added,
+    removed,
+    updated
+  };
+}
+async function desiredRoster(poTeam, callerEmail) {
+  const caller = normalizeEmail(callerEmail);
+  const roster = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const poMember of poTeam.members || []) {
+    if (!poMember?.email) continue;
+    const email = normalizeEmail(poMember.email);
+    if (email === caller || seen.has(email)) continue;
+    seen.add(email);
+    const identity = await resolveMemberIdentity({ email });
+    roster.push({
+      userId: identity.userId,
+      email: identity.email,
+      role: mapPromptowlRole(poMember.role)
     });
   }
-  return c.json({ node: response });
-});
-nodeRoutes.patch("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const body = await c.req.json();
-  const baseVersionHeader = c.req.header("X-Base-Version");
-  if (baseVersionHeader) {
-    const baseVersion = parseInt(baseVersionHeader, 10);
-    const conflict = await checkConflict(nestId, nodeId, baseVersion);
-    if (conflict.conflict) {
+  return roster;
+}
+
+// src/governance/team-routes.ts
+var teamRoutes = new Hono9();
+var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+var CONNECT_REQUIRED = "promptowl_connect_required";
+var CONNECT_REQUIRED_STATUS = 428;
+async function withPromptowlToken(c, run) {
+  if (!config.PROMPTOWL_TEAMS_ENABLED) {
+    return c.json({ error: "Not found" }, 404);
+  }
+  if (!tryConsume(`po-teams:ip:${clientIp(c)}`, PROMPTOWL_LIMIT)) {
+    return c.json({ error: "Too many PromptOwl requests, try again later" }, 429);
+  }
+  const token = getPromptowlTokenFromRequest(c);
+  if (!token) {
+    return c.json(
+      {
+        error: "Sign in with PromptOwl to import teams.",
+        code: CONNECT_REQUIRED
+      },
+      CONNECT_REQUIRED_STATUS
+    );
+  }
+  try {
+    return c.json(await run(token));
+  } catch (err) {
+    if (err instanceof UnauthorizedError) {
+      c.header(
+        "Set-Cookie",
+        buildPromptowlTokenCookie("", { secure: isSecureRequest(c), clear: true }),
+        { append: true }
+      );
       return c.json(
-        {
-          error: "Version conflict",
-          your_version: baseVersion,
-          current_version: conflict.currentVersion,
-          updated_by: conflict.updatedBy,
-          updated_at: conflict.updatedAt,
-          rejected_content: body.content || body.append || null
-        },
-        409
+        { error: err.message, code: CONNECT_REQUIRED },
+        CONNECT_REQUIRED_STATUS
       );
     }
+    throw err;
   }
-  const authorEmail = await getUserEmail(c);
-  const { node, version: responseVersion } = await updateNode(
-    nestId,
-    nodeId,
-    {
-      content: body.content,
-      append: body.append,
-      tags: body.tags,
-      title: body.title,
-      status: body.status,
-      changeNote: body.changeNote,
-      schedule: body.schedule,
-      prime: body.prime
-    },
-    authorEmail
-  );
-  return c.json({ node: toNodeResponse(node), version: responseVersion });
+}
+teamRoutes.get(
+  "/promptowl",
+  async (c) => withPromptowlToken(c, async (token) => ({
+    teams: await fetchOwnedPromptowlTeams(token)
+  }))
+);
+teamRoutes.post("/promptowl/sync", async (c) => {
+  const body = await c.req.json().catch(() => ({}));
+  return withPromptowlToken(c, async (token) => ({
+    results: await syncPromptowlTeams({
+      callerUserId: c.get("userId"),
+      token,
+      teamIds: body.team_ids ?? []
+    })
+  }));
 });
-nodeRoutes.delete("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  await deleteNode(nestId, nodeId, await getUserEmail(c));
-  return c.json({ deleted: true });
+teamRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  const team = await createTeam({
+    name: body.name ?? "",
+    ownerId: c.get("userId")
+  });
+  return c.json({ team }, 201);
 });
-async function getUserEmail(c) {
+teamRoutes.get("/", async (c) => {
+  const teams = await listTeamsForUser(c.get("userId"));
+  return c.json({ teams });
+});
+teamRoutes.get("/:teamId", async (c) => {
   const userId = c.get("userId");
-  const db = getDb();
-  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  return user?.email || "anonymous@localhost";
-}
-
-// src/annotations/routes.ts
-import { Hono as Hono9 } from "hono";
-
-// src/annotations/service.ts
-import { v4 as uuid5 } from "uuid";
-
-// src/annotations/projection.ts
-var MAX_CONTEXT_CHARS = 250;
-var MAX_QUOTE_CHARS = 1e3;
-function clampAnchor(raw) {
-  if (!raw) return null;
-  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
-  if (!quote) return null;
-  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
-  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
-  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
-  return { quote, before, after, ...line !== void 0 ? { line } : {} };
-}
-function oneLine(s) {
-  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
-}
-function renderAnchor(anchor) {
-  if (!anchor) {
-    return "<!-- anchor: whole-artifact -->";
-  }
-  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
-  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
-    anchor.after
-  )}\u2026`;
-  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
-}
-function statusHeading(thread) {
-  if (thread.status === "resolved") {
-    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
-    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
-    const meta = who || when ? ` (${who}${when})` : "";
-    return `\u2705 RESOLVED${meta}`;
+  const team = await getTeam(c.req.param("teamId"));
+  const isMember = team.members.some((m) => m.userId === userId);
+  if (team.owner_id !== userId && !isMember && !await isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("You don't have access to this team.");
   }
-  return "\u{1F7E0} OPEN";
-}
-function snapshotLabel(v) {
-  return v == null ? "Unpinned" : `Snapshot v${v}`;
-}
-function orderThreads(threads) {
-  return [...threads].sort((a, b) => {
-    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
-    return a.createdAt.localeCompare(b.createdAt);
+  return c.json({ team });
+});
+teamRoutes.patch("/:teamId", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await renameTeam({
+    teamId: c.req.param("teamId"),
+    name: body.name ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
   });
-}
-function projectThreadsToMarkdown(artifactTitle, threads) {
-  const lines = [];
-  lines.push(`# ${artifactTitle} \u2014 Annotations`);
-  lines.push("");
-  lines.push(
-    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
-  );
-  lines.push("");
-  if (threads.length === 0) {
-    lines.push("_No annotations yet._");
-    lines.push("");
-    return lines.join("\n");
-  }
-  const buckets2 = /* @__PURE__ */ new Map();
-  for (const t of threads) {
-    const key = t.snapshotVersion ?? null;
-    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
-  }
-  const keys = [...buckets2.keys()].sort((a, b) => {
-    if (a == null) return 1;
-    if (b == null) return -1;
-    return b - a;
+  return c.json({ team });
+});
+teamRoutes.delete("/:teamId", async (c) => {
+  const userId = c.get("userId");
+  await deleteTeam({
+    teamId: c.req.param("teamId"),
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
   });
-  for (const key of keys) {
-    lines.push(`## ${snapshotLabel(key)}`);
-    lines.push("");
-    for (const thread of orderThreads(buckets2.get(key))) {
-      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
-      lines.push(renderAnchor(thread.anchor));
-      for (const comment of thread.comments) {
-        lines.push(
-          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
-        );
-      }
-      lines.push("");
-    }
+  return c.json({ removed: true });
+});
+teamRoutes.post("/:teamId/members", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await addMember({
+    teamId: c.req.param("teamId"),
+    email: body.email,
+    userId: body.user_id,
+    role: body.role ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team }, 201);
+});
+teamRoutes.patch("/:teamId/members/:userId", async (c) => {
+  const body = await c.req.json();
+  const userId = c.get("userId");
+  const team = await updateMemberRole({
+    teamId: c.req.param("teamId"),
+    userId: c.req.param("userId"),
+    role: body.role ?? "",
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team });
+});
+teamRoutes.delete("/:teamId/members/:userId", async (c) => {
+  const userId = c.get("userId");
+  const team = await removeMember({
+    teamId: c.req.param("teamId"),
+    userId: c.req.param("userId"),
+    callerUserId: userId,
+    allowAdmin: await isLicenseAdminUserId(userId)
+  });
+  return c.json({ team });
+});
+
+// src/nodes/search.ts
+async function discoverForSearch(storage) {
+  return storage.discoverDocuments({ includeRetired: true });
+}
+function titleScore(title, query) {
+  const t = (title || "").toLowerCase();
+  const q = query.trim().toLowerCase();
+  if (!q) return 0;
+  if (t === q) return 4;
+  let midWord = false;
+  for (let i = t.indexOf(q); i !== -1; i = t.indexOf(q, i + 1)) {
+    if (i === 0) return 3;
+    if (!/[a-z0-9]/.test(t[i - 1])) return 2;
+    midWord = true;
   }
-  return lines.join("\n");
+  if (midWord) return 1;
+  const terms = q.split(/\s+/).filter(Boolean);
+  if (terms.length > 1 && terms.every((term) => t.includes(term))) return 1;
+  return 0;
 }
-
-// src/annotations/service.ts
-async function loadComments(threadId) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
-    [threadId]
+function matchDocuments(documents, query) {
+  const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+  if (terms.length === 0) return [];
+  return documents.filter((node) => {
+    const haystack = [
+      node.frontmatter.title,
+      node.body || "",
+      node.frontmatter.type || "",
+      ...node.frontmatter.tags || []
+    ].join(" ").toLowerCase();
+    return terms.every((term) => haystack.includes(term));
+  }).sort(
+    (a, b) => titleScore(b.frontmatter.title, query) - titleScore(a.frontmatter.title, query)
   );
-  return rows.map((r) => ({
-    id: r.id,
-    author: r.author,
-    body: r.body,
-    createdAt: r.created_at
-  }));
 }
-async function rowToThread(row) {
-  let anchor = null;
-  if (row.anchor_json) {
-    try {
-      anchor = JSON.parse(row.anchor_json);
-    } catch {
-      anchor = null;
-    }
-  }
+function bodySnippet(body, query) {
+  const flat = body.replace(/\s+/g, " ").trim();
+  const terms = (query || "").toLowerCase().split(/\s+/).filter(Boolean);
+  const at = terms.map((t) => flat.toLowerCase().indexOf(t)).filter((i) => i >= 0).sort((a, b) => a - b)[0];
+  if (at === void 0 || at < 80) return flat.slice(0, 200);
+  const start = Math.max(0, at - 60);
+  return `\u2026${flat.slice(start, start + 200)}`;
+}
+function toSearchHit(node, query) {
   return {
-    id: row.id,
-    nestId: row.nest_id,
-    nodeId: row.node_id,
-    snapshotVersion: row.snapshot_version,
-    anchor,
-    status: row.status,
-    createdBy: row.created_by,
-    createdAt: row.created_at,
-    resolvedBy: row.resolved_by,
-    resolvedAt: row.resolved_at,
-    comments: await loadComments(row.id)
+    id: node.id,
+    title: node.frontmatter.title,
+    type: node.frontmatter.type || "document",
+    tags: node.frontmatter.tags || [],
+    snippet: bodySnippet(node.body || "", query)
   };
 }
-async function getThreadRow(threadId) {
-  return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
+
+// src/nodes/routes.ts
+import { Hono as Hono10 } from "hono";
+
+// src/nodes/markdown-export.ts
+import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
+function nodeToMarkdown(node) {
+  const tags = node.tags ?? [];
+  return [
+    "---",
+    `title: ${JSON.stringify(node.title ?? "")}`,
+    `tags: [${tags.map((t) => JSON.stringify(t)).join(", ")}]`,
+    `status: ${JSON.stringify(node.status ?? "")}`,
+    `id: ${JSON.stringify(node.id)}`,
+    "---",
+    ""
+  ].join("\n") + (node.body ?? "");
 }
-async function countThreadsByNode(nestId) {
-  const rows = await getDb().all(
-    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
-         FROM annotation_threads
-        WHERE nest_id = ?
-        GROUP BY node_id`,
-    [nestId]
-  );
-  const out = {};
-  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
-  return out;
+function nodesToMarkdown(nodes) {
+  return nodes.map(nodeToMarkdown).join("\n\n---\n\n");
 }
-async function listThreads(nestId, nodeId) {
-  const rows = await getDb().all(
-    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
-    [nestId, nodeId]
-  );
-  return Promise.all(rows.map(rowToThread));
+function isMarkdownFormat(c) {
+  return c.req.query("format") === "markdown";
 }
-async function createThread(nestId, nodeId, input, authorEmail) {
-  const body = (input.body ?? "").trim();
-  if (!body) {
-    throw new Error("comment body is required");
+function isRawFormat(c) {
+  const format = c.req.query("format");
+  if (format !== void 0) return format === "raw";
+  const accept = c.req.header("Accept") ?? "";
+  return accept.split(",").some((part) => part.trim().split(";")[0].trim().toLowerCase() === "text/markdown");
+}
+var RAW_CONTENT_TYPES = {
+  artifact: "text/html; charset=utf-8",
+  tool: "text/plain; charset=utf-8",
+  table: "text/plain; charset=utf-8"
+};
+function rawContentType(nodeType) {
+  return RAW_CONTENT_TYPES[nodeType || "document"] ?? "text/markdown; charset=utf-8";
+}
+function frontmatterBlockOf(raw) {
+  if (!raw || !raw.startsWith("---")) return "";
+  try {
+    const body = parseDocument2("frontmatter-split.md", raw, "frontmatter-split").body ?? "";
+    if (raw.endsWith(body)) return raw.slice(0, raw.length - body.length);
+  } catch {
   }
-  const db = getDb();
-  const id = uuid5();
-  const anchor = clampAnchor(input.anchor);
-  const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
-  await db.transaction(async (tx) => {
-    await tx.run(
-      `INSERT INTO annotation_threads
-         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
-      [
-        id,
-        nestId,
-        nodeId,
-        snapshot,
-        anchor ? JSON.stringify(anchor) : null,
-        authorEmail
-      ]
-    );
-    await tx.run(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-      [uuid5(), id, authorEmail, body]
-    );
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  return m ? `---
+${m[1]}
+---
+
+` : "";
+}
+
+// src/nodes/routes.ts
+var nodeRoutes = new Hono10();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
   });
-  return rowToThread(await getThreadRow(id));
 }
-async function getScopedThreadRow(threadId, nestId, nodeId) {
-  const row = await getThreadRow(threadId);
-  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
-    throw new NotFoundError(`Thread not found: ${threadId}`);
+function rawNodeBody(c, response, storedRaw) {
+  const body = response.content ?? "";
+  const payload = c.req.query("frontmatter") === "1" ? frontmatterBlockOf(storedRaw) + body : body;
+  c.header("X-Content-Type-Options", "nosniff");
+  if ((response.type || "document") === "artifact") {
+    applyArtifactSandboxHeaders(c);
   }
-  return row;
+  return c.body(payload, 200, {
+    "Content-Type": rawContentType(response.type)
+  });
 }
-async function addComment(nestId, nodeId, threadId, authorEmail, body) {
-  const trimmed = (body ?? "").trim();
-  if (!trimmed) {
-    throw new Error("comment body is required");
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const q = c.req.query();
+  const limit = q.limit ? parseInt(q.limit, 10) : void 0;
+  const nodes = await listNodesForCaller(nestId, userId, {
+    ...q.type ? { type: q.type } : {},
+    ...q.tag ? { tag: q.tag } : {},
+    ...q.status ? { status: q.status } : {},
+    // Lets an owner preview what making the nest public would expose.
+    ...q.approved_only === "1" || q.approved_only === "true" ? { approvedOnly: true } : {},
+    // Ignore junk rather than 400 — a bad ?limit should not fail a listing.
+    ...limit !== void 0 && Number.isFinite(limit) && limit > 0 ? { limit } : {},
+    // Present (even as "") = one folder level only, for the lazily-expanded
+    // document tree. Absent = the whole nest, as every existing caller expects.
+    ...q.folder !== void 0 ? { folder: q.folder } : {},
+    // Bodies are off by default — the list is served from the DB index, which
+    // holds metadata only. Opt back in and the listing crawls the vault for
+    // them; kept for any client that was reading `content` off this route.
+    ...q.content === "1" || q.content === "true" ? { withContent: true } : {}
+  });
+  return c.json({ count: nodes.length, nodes });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
   }
-  await getScopedThreadRow(threadId, nestId, nodeId);
-  await getDb().run(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-    [uuid5(), threadId, authorEmail, trimmed]
+  if (body.folder !== void 0 && typeof body.folder !== "string") {
+    throw new ValidationError('folder must be a string path like "gtm/deals"');
+  }
+  const nestId = c.req.param("nestId");
+  const authorEmail = await getUserEmail(c);
+  const { node } = await createNode(
+    nestId,
+    {
+      title: body.title,
+      content: body.content,
+      type: body.type,
+      tags: body.tags,
+      scope: body.scope,
+      status: body.status,
+      schedule: body.schedule,
+      folder: body.folder,
+      prime: body.prime
+    },
+    authorEmail
   );
-  return rowToThread(await getThreadRow(threadId));
-}
-async function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
-  await getScopedThreadRow(threadId, nestId, nodeId);
-  const db = getDb();
-  if (status === "resolved") {
-    await db.run(
-      `UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = ${nowExpr(db)} WHERE id = ?`,
-      [byEmail, threadId]
-    );
-  } else {
-    await db.run(
-      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?",
-      [threadId]
+  const resolved = await resolveStewardsForNode(nestId, node.id);
+  return c.json({
+    node: toNodeResponse(node),
+    stewards: resolved.length > 0 ? resolved.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      source: r.source
+    })) : void 0
+  }, 201);
+});
+nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-HRVD7SIS.js");
+  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
+    nestId,
+    nodeId
+  );
+  return c.json({
+    nodeId,
+    stewards: stewards.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      scope: r.steward.scope,
+      source: r.source,
+      priority: r.priority
+    })),
+    fallbackToOwner,
+    ownerEmail
+  });
+});
+nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-TJRHRMMZ.js");
+  const history = await getReviewHistory2(nestId, nodeId);
+  return c.json({ reviews: history });
+});
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
     );
   }
-  return rowToThread(await getThreadRow(threadId));
-}
-async function readArtifact(nestId, nodeId, version) {
-  const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const target = version ?? await getApprovedVersion(nestId, nodeId) ?? null;
-  let title = nodeId;
-  let type = null;
-  let liveHtml = "";
-  let liveExists = true;
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
   try {
-    const node = await storage.readDocument(nodeId);
-    title = node.frontmatter?.title || nodeId;
-    type = node.frontmatter?.type || null;
-    liveHtml = node.body || "";
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
   } catch {
-    liveExists = false;
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
   }
-  if (target != null) {
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
+nodeRoutes.post("/:nodeId{.+}/move", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  if (typeof body.folder !== "string") {
+    throw new ValidationError('folder (a string; "" for the nest root) is required');
+  }
+  const { node, previousId } = await moveNode(nestId, nodeId, body.folder, userEmail);
+  return c.json({ ok: true, node: toNodeResponse(node), previousId });
+});
+nodeRoutes.get("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  return c.json({ watchers: await listWatchers(nestId, nodeId) });
+});
+nodeRoutes.post("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json().catch(() => ({}));
+  const email = typeof body.email === "string" ? body.email.trim() : "";
+  if (!email || !email.includes("@")) {
+    throw new ValidationError("email is required");
+  }
+  await addWatcher(nestId, nodeId, email, await getUserEmail(c));
+  return c.json({ watchers: await listWatchers(nestId, nodeId) }, 201);
+});
+nodeRoutes.delete("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const email = c.req.query("email")?.trim() ?? "";
+  if (!email) throw new ValidationError("email query param is required");
+  if (!await removeWatcher(nestId, nodeId, email)) {
+    throw new NotFoundError("Not watching");
+  }
+  return c.json({ watchers: await listWatchers(nestId, nodeId) });
+});
+nodeRoutes.get("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  let node = await getNodeForCaller(
+    nestId,
+    { id: nodeId },
+    userId,
+    userEmail,
+    { verifyChecksum: true }
+  );
+  if (node.pendingChange) {
     try {
-      const raw = await versionManager.reconstructVersion(nodeId, target);
-      return { title, html: bodyOnly(nodeId, raw), version: target, type };
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
     } catch (err) {
-      console.warn(
-        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
-        err
-      );
+      console.error("[external-edit] stage-on-read failed:", err);
+    }
+    try {
+      const latest = await loadLatestApprovedNode(nestId, nodeId);
+      if (latest) {
+        node = { ...latest, pendingChange: node.pendingChange };
+      }
+    } catch (err) {
+      console.error("[external-edit] reconstruct-latest failed:", err);
+    }
+  }
+  const response = toNodeResponse(node);
+  const publicReader = await isPublicReader(nestId, userId);
+  if (!publicReader) {
+    const people = (await resolveAuthorship(nestId, [
+      { id: nodeId, frontmatterAuthor: node.frontmatter?.author ?? null }
+    ])).get(nodeId);
+    if (people) {
+      response.author = people.author;
+      response.collaborators = people.collaborators;
+    }
+  }
+  response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
+  if (publicReader) {
+    const approved = await getApprovedVersion(nestId, nodeId);
+    if (approved != null) {
+      let approvedRaw = "";
+      try {
+        approvedRaw = await versionManager.reconstructVersion(
+          nodeId,
+          approved
+        );
+        response.content = bodyOnly(nodeId, approvedRaw);
+      } catch (err) {
+        console.error(
+          "reconstructVersion failed (public single)",
+          nodeId,
+          approved,
+          err
+        );
+        response.content = "";
+      }
+      response.version = approved;
+      response.status = "published";
+      if (isRawFormat(c)) {
+        return rawNodeBody(c, response, approvedRaw);
+      }
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
+      }
+      return c.json({ node: response });
     }
   }
-  if (!liveExists) {
-    throw new NotFoundError(`Artifact not found: ${nodeId}`);
+  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
+  if (response.status === "pending_review") {
+    const pending = await getPendingReview(nestId, nodeId);
+    response.pendingReviewBy = pending?.requestedBy ?? null;
   }
-  return { title, html: liveHtml, version: target, type };
-}
-function derivedAnnotationsId(sourceNodeId) {
-  const base = sourceNodeId.replace(/^nodes\//, "");
-  return `nodes/${base}--annotations`;
-}
-async function syncAnnotationsNode(nestId, nodeId, userEmail) {
-  try {
-    let title = nodeId;
-    let type = null;
-    try {
-      const { storage } = await engineCache.get(nestId);
-      const node = await storage.readDocument(nodeId);
-      title = node.frontmatter?.title || nodeId;
-      type = node.frontmatter?.type || "document";
-    } catch {
-    }
-    if (type !== null && type !== "artifact") return;
-    const threads = await listThreads(nestId, nodeId);
-    const derivedTitle = `${title.slice(0, 100)} \u2014 Annotations`;
-    const markdown = projectThreadsToMarkdown(title, threads);
-    const derivedId = derivedAnnotationsId(nodeId);
-    try {
-      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        await createNode(
-          nestId,
-          {
-            id: derivedId,
-            title: derivedTitle,
-            content: markdown,
-            type: "document",
-            tags: ["annotations"]
-          },
-          userEmail
-        );
-      } else {
-        throw err;
-      }
+  response.deletionRequest = await getLatestDeletionRequest(
+    nestId,
+    nodeId
+  );
+  if (isRawFormat(c)) {
+    return rawNodeBody(c, response, node.rawContent);
+  }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
+  return c.json({ node: response });
+});
+nodeRoutes.patch("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const baseVersionHeader = c.req.header("X-Base-Version");
+  if (baseVersionHeader) {
+    const baseVersion = parseInt(baseVersionHeader, 10);
+    const conflict = await checkConflict(nestId, nodeId, baseVersion);
+    if (conflict.conflict) {
+      return c.json(
+        {
+          error: "Version conflict",
+          your_version: baseVersion,
+          current_version: conflict.currentVersion,
+          updated_by: conflict.updatedBy,
+          updated_at: conflict.updatedAt,
+          rejected_content: body.content || body.append || null
+        },
+        409
+      );
     }
-  } catch (err) {
-    console.warn(
-      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
-      err
-    );
   }
+  const authorEmail = await getUserEmail(c);
+  const { node, version: responseVersion } = await updateNode(
+    nestId,
+    nodeId,
+    {
+      content: body.content,
+      append: body.append,
+      tags: body.tags,
+      title: body.title,
+      status: body.status,
+      changeNote: body.changeNote,
+      schedule: body.schedule,
+      prime: body.prime
+    },
+    authorEmail
+  );
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
+});
+nodeRoutes.delete("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  await deleteNode(nestId, nodeId, await getUserEmail(c));
+  return c.json({ deleted: true });
+});
+async function getUserEmail(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  return user?.email || "anonymous@localhost";
 }
 
+// src/annotations/routes.ts
+import { Hono as Hono11 } from "hono";
+
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono9();
+var annotationRoutes = new Hono11();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -4888,8 +5896,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono10 } from "hono";
-import { serializeDocument as serializeDocument3 } from "@promptowl/contextnest-engine";
+import { Hono as Hono12 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -5390,7 +6397,9 @@ function extractWikiTargets(body) {
 }
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   const { storage } = await engineCache.get(nestId);
-  const docs = await storage.discoverDocuments();
+  const docs = (await storage.discoverDocuments()).filter(
+    (d) => !isDerivedAnnotationsNode(d.id)
+  );
   const accessible = await filterAccessible(nestId, userId, userEmail, docs);
   const idSet = new Set(accessible.map((d) => d.id));
   const titleToId = /* @__PURE__ */ new Map();
@@ -5521,7 +6530,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono10();
+var queryRoutes = new Hono12();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -5649,11 +6658,15 @@ queryRoutes.get("/graph", async (c) => {
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
-function formatContextBlock(node) {
+function formatContextBlock(node, url) {
   const tags = (node.frontmatter.tags || []).join(" ");
-  const header = tags ? `# ${node.frontmatter.title}
+  const meta = [
+    tags ? `_tags: ${tags}_` : null,
+    url ? `_source: ${url}_` : null
+  ].filter(Boolean);
+  const header = meta.length ? `# ${node.frontmatter.title}
 
-_tags: ${tags}_
+${meta.join("\n")}
 
 ` : `# ${node.frontmatter.title}
 
@@ -5666,6 +6679,7 @@ queryRoutes.post("/context", async (c) => {
     throw new ValidationError("prompt or selector is required");
   }
   const nestId = c.req.param("nestId");
+  const baseUrl = requestBaseUrl(c.req.url);
   const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const hops = body.hops ?? 2;
@@ -5774,20 +6788,21 @@ queryRoutes.post("/context", async (c) => {
   const readable = await Promise.all(
     accessible.map(async (doc) => ({
       ...doc,
-      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || "")
+      body: await resolveReadableBody(nestId, doc.id, userId, doc.body || ""),
+      url: resolveNodeUrl(doc, { nestId, baseUrl })
     }))
   );
   const included = [];
   let tokenCount = 0;
   for (const doc of readable) {
-    const block = formatContextBlock(doc);
+    const block = formatContextBlock(doc, doc.url);
     const blockTokens = approxTokens(block);
     if (tokenCount + blockTokens > maxTokens && included.length > 0) break;
     included.push(doc);
     tokenCount += blockTokens;
   }
   const truncatedByBudget = accessible.length - included.length;
-  const contextMarkdown = included.map(formatContextBlock).join("\n\n---\n\n");
+  const contextMarkdown = included.map((n) => formatContextBlock(n, n.url)).join("\n\n---\n\n");
   trackEvent("context.resolve", {
     nestId,
     selector_from_prompt: !!compileDetail,
@@ -5800,6 +6815,7 @@ queryRoutes.post("/context", async (c) => {
     nodes: included.map((n) => ({
       id: n.id,
       title: n.frontmatter.title,
+      url: n.url,
       tags: n.frontmatter.tags || [],
       type: n.frontmatter.type || "document"
     })),
@@ -5867,7 +6883,9 @@ queryRoutes.get("/search", async (c) => {
   }
   const nestId = c.req.param("nestId");
   const { storage } = await engineCache.get(nestId);
-  const matches = matchDocuments(await discoverForSearch(storage), q);
+  const matches = matchDocuments(await discoverForSearch(storage), q).filter(
+    (n) => !isDerivedAnnotationsNode(n.id)
+  );
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const accessible = await filterAccessible(nestId, userId, userEmail, matches);
@@ -5879,7 +6897,9 @@ queryRoutes.get("/search", async (c) => {
 });
 queryRoutes.get("/overview", async (c) => {
   const { storage } = await engineCache.get(c.req.param("nestId"));
-  const documents = await storage.discoverDocuments();
+  const documents = (await storage.discoverDocuments()).filter(
+    (d) => !isDerivedAnnotationsNode(d.id)
+  );
   const types = {};
   const tags = {};
   for (const node of documents) {
@@ -5914,6 +6934,14 @@ queryRoutes.get("/folders", async (c) => {
   });
   return c.json({ folders });
 });
+queryRoutes.post("/folders", async (c) => {
+  const body = await c.req.json().catch(() => ({}));
+  if (typeof body.folder !== "string" || !body.folder.trim()) {
+    throw new ValidationError('folder (a string like "gtm/deals") is required');
+  }
+  const folder = await createEmptyFolder(c.req.param("nestId"), body.folder);
+  return c.json({ folder }, 201);
+});
 queryRoutes.post("/reindex", async (c) => {
   if (permissionLevel(c.get("nestPermission")) < permissionLevel("write")) {
     throw new ForbiddenError("Reindexing a nest requires write access");
@@ -6013,55 +7041,58 @@ queryRoutes.post("/publish", async (c) => {
     }
   }
   const nestId = c.req.param("nestId");
-  const { storage } = await engineCache.get(nestId);
+  const userEmail = await resolveCallerEmail(c.get("userId"));
   const created = [];
+  const skipped = [];
+  const failed = [];
   if (body.context_md) {
+    const { storage } = await engineCache.get(nestId);
     await storage.writeContextMd(body.context_md);
+    await storage.regenerateIndex();
   }
   for (const doc of body.documents || []) {
     if (!doc.title || !doc.content) continue;
-    const slug = doc.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-    const id = `nodes/${slug}`;
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const tags = doc.tags?.map((t) => t.startsWith("#") ? t : `#${t}`) || [];
-    const node = {
-      id,
-      filePath: "",
-      frontmatter: {
+    try {
+      const result = await createNode(
+        nestId,
+        {
+          title: doc.title,
+          content: doc.content,
+          type: doc.type,
+          tags: doc.tags,
+          scope: doc.scope
+        },
+        userEmail
+      );
+      created.push(result.node.id);
+    } catch (err) {
+      if (err instanceof ConflictError) {
+        skipped.push(doc.title);
+        continue;
+      }
+      if (isVaultLockTimeout(err) || err instanceof VaultBusyError) throw err;
+      if (!(err instanceof AppError)) console.error("bulk publish row failed", err);
+      failed.push({
         title: doc.title,
-        type: doc.type || "document",
-        tags,
-        status: "draft",
-        version: 1,
-        created_at: now,
-        updated_at: now,
-        metadata: {
-          owners: ["*"],
-          scope: doc.scope || "team"
-        }
-      },
-      body: doc.content,
-      rawContent: ""
-    };
-    const serialized = serializeDocument3(node);
-    await storage.writeDocument(id, serialized);
-    await syncNodeTags(nestId, id, tags);
-    created.push(id);
+        error: err instanceof AppError ? err.message : "Could not create this document"
+      });
+    }
   }
-  if (created.length > 0 || body.context_md) await storage.regenerateIndex();
   trackEvent("nest.publish", { nestId, count: created.length });
   return c.json(
     {
       published: created.length,
       context_md_updated: !!body.context_md,
-      node_ids: created
+      node_ids: created,
+      skipped,
+      failed
     },
     201
   );
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono14 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -6141,10 +7172,10 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid10 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid6 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -6274,7 +7305,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid6()}`;
+  const id = `run_${uuid8()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -6460,8 +7491,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono11 } from "hono";
-import { v4 as uuid7 } from "uuid";
+import { Hono as Hono13 } from "hono";
+import { v4 as uuid9 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -6575,7 +7606,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono11();
+var edgeRoutes = new Hono13();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -6643,7 +7674,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid7();
+  const id = uuid9();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -7044,7 +8075,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid8();
+  const id = uuid10();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -7108,7 +8139,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid8(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid10(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -7664,6 +8695,13 @@ async function handleToolCall(toolName, args, ctx) {
   try {
     return await runTool(toolName, args, ctx);
   } catch (err) {
+    if (isVaultLockTimeout(err) || err instanceof VaultBusyError) {
+      status = 503;
+      return toolError(
+        "The vault is busy with another write. Retry in a few seconds.",
+        "VAULT_BUSY"
+      );
+    }
     status = 500;
     throw err;
   } finally {
@@ -8554,19 +9592,19 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-ME7HIVHU.js");
-        const db = (await import("./client-SW5I6ZBK.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-WC27TRY3.js");
+        const db = (await import("./client-7Z2IVCPW.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
           const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid16 } = await import("uuid");
-          const id = uuid16();
+          const { v4: uuid18 } = await import("uuid");
+          const id = uuid18();
           await db.run(
             "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid16())]
+            [id, e, null, await hashPassword2(uuid18())]
           );
           row = { id };
         }
@@ -8621,7 +9659,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono12();
+var mcpRoutes = new Hono14();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -8687,8 +9725,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono13 } from "hono";
-import { v4 as uuid9 } from "uuid";
+import { Hono as Hono15 } from "hono";
+import { v4 as uuid11 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -8806,7 +9844,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono13();
+var runTriggerRoutes = new Hono15();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -8885,7 +9923,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid9()}`;
+  const id = `run_${uuid11()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -8914,7 +9952,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono13();
+var runListRoutes = new Hono15();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -8946,7 +9984,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono13();
+var runDetailRoutes = new Hono15();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -9097,8 +10135,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono14 } from "hono";
-import { v4 as uuid10 } from "uuid";
+import { Hono as Hono16 } from "hono";
+import { v4 as uuid12 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -9135,7 +10173,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono14();
+var scheduleRoutes = new Hono16();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -9176,7 +10214,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid10()}`;
+  const id = `sch_${uuid12()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -9231,8 +10269,8 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono15 } from "hono";
-import { v4 as uuid11 } from "uuid";
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
@@ -9278,7 +10316,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono15();
+var connectorRoutes = new Hono17();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -9297,7 +10335,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid11()}`;
+  const id = `con_${uuid13()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -9340,7 +10378,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono18 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -9363,7 +10401,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono16();
+var hookNestRoutes = new Hono18();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -9437,7 +10475,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono16();
+var hookFireRoutes = new Hono18();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -9537,9 +10575,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid12 } from "uuid";
-var definitionRoutes = new Hono17();
+import { Hono as Hono19 } from "hono";
+import { v4 as uuid14 } from "uuid";
+var definitionRoutes = new Hono19();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -9618,7 +10656,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid12();
+      targetId = uuid14();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -9647,11 +10685,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono18 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono20 } from "hono";
+import { v4 as uuid15 } from "uuid";
 import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
 import { join as join4 } from "path";
-var assetRoutes = new Hono18();
+var assetRoutes = new Hono20();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -9697,7 +10735,7 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid13()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const name = `${uuid15()}.${ext === "jpeg" ? "jpg" : ext}`;
   const dir = join4(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
   await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
@@ -9738,7 +10776,7 @@ assetRoutes.get("/:file", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono21 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
@@ -10037,7 +11075,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono19();
+var serverMcpRoutes = new Hono21();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -10059,7 +11097,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono19();
+var nestIndexRoutes = new Hono21();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -10178,14 +11216,14 @@ npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono19();
+var llmsTxtRoutes = new Hono21();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono20 } from "hono";
+import { Hono as Hono22 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -10316,7 +11354,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid14 } from "uuid";
+import { v4 as uuid16 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -10332,7 +11370,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid14();
+  const id = uuid16();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -10617,7 +11655,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono20();
+var governanceRoutes = new Hono22();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -10736,6 +11774,60 @@ governanceRoutes.get("/review-queue", async (c) => {
   }
   return c.json({ ...result, requests });
 });
+var BULK_REVIEW_LIMIT = 50;
+governanceRoutes.post("/review-queue/bulk", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const nodeIds = [...new Set(body.nodeIds ?? [])].map(assertSafeNodeId);
+  if (nodeIds.length === 0) {
+    throw new ValidationError("Select at least one document to review");
+  }
+  if (nodeIds.length > BULK_REVIEW_LIMIT) {
+    throw new ValidationError(
+      `Up to ${BULK_REVIEW_LIMIT} documents at a time \u2014 you selected ${nodeIds.length}.`
+    );
+  }
+  if (body.action !== "approve" && body.action !== "reject") {
+    throw new ValidationError("action must be approve or reject");
+  }
+  if (body.action === "reject" && !body.note) {
+    throw new ValidationError("Rejection note is required");
+  }
+  const userEmail = await getUserEmail4(c);
+  const baseUrl = requestBaseUrl(c.req.url);
+  const results = [];
+  for (const nodeId of nodeIds) {
+    try {
+      if (body.action === "approve") {
+        await approve({
+          nestId,
+          nodeId,
+          approvedBy: userEmail,
+          note: body.note,
+          override: false,
+          baseUrl
+        });
+      } else {
+        await reject({
+          nestId,
+          nodeId,
+          rejectedBy: userEmail,
+          note: body.note,
+          baseUrl
+        });
+      }
+      results.push({ nodeId, ok: true });
+    } catch (err) {
+      results.push({ nodeId, ok: false, error: err?.message || "Failed" });
+    }
+  }
+  return c.json({
+    action: body.action,
+    succeeded: results.filter((r) => r.ok).length,
+    failed: results.filter((r) => !r.ok).length,
+    results
+  });
+});
 function denyUnlessNestManager(c, what) {
   const permission = c.get("nestPermission");
   if (permission === "owner" || permission === "admin") return null;
@@ -10928,7 +12020,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono20();
+var governanceNodeRoutes = new Hono22();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -11326,12 +12418,16 @@ governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const userEmail = await getUserEmail4(c);
-  const request = await cancelReview({
-    nestId,
-    nodeId,
-    cancelledBy: userEmail
-  });
-  return c.json({ review: request });
+  try {
+    const request = await cancelReview({
+      nestId,
+      nodeId,
+      cancelledBy: userEmail
+    });
+    return c.json({ review: request });
+  } catch (err) {
+    return c.json({ error: err.message }, 403);
+  }
 });
 async function getUserEmail4(c) {
   const userId = c.get("userId");
@@ -11419,13 +12515,23 @@ var flexAuthWithPromptowlTicket = createMiddleware2(
   async (c, next) => {
     const header = c.req.header("Authorization") || "";
     const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
-    const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+    const secrets = [
+      config.OFFICIAL_COMMUNITY_SSO_SECRET,
+      config.MCP_SIGNING_SECRET
+    ].filter(Boolean);
     const looksLikeJwt = !!token && !token.startsWith("cnst_") && token.split(".").length === 3;
-    if (!looksLikeJwt || !secret) return flexAuthMiddleware(c, next);
-    let claims;
-    try {
-      claims = verifySsoTicket(token, secret);
-    } catch {
+    if (!looksLikeJwt || secrets.length === 0) {
+      return flexAuthMiddleware(c, next);
+    }
+    let claims = null;
+    for (const secret of secrets) {
+      try {
+        claims = verifySsoTicket(token, secret);
+        break;
+      } catch {
+      }
+    }
+    if (!claims) {
       return c.json({ error: "Invalid service ticket" }, 401);
     }
     if (claims.scope !== "mcp" || claims.jti) {
@@ -11472,7 +12578,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono21({ router: new LinearRouter() });
+  const app = new Hono23({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -11529,6 +12635,9 @@ function createApp() {
       // Presence only, never the value: lets the UI stop prompting for a
       // runner key once the server-wide one exists.
       runner_key_configured: !!process.env.ANTHROPIC_API_KEY,
+      // Presence only: the publish dialog hides the email/invite gates when
+      // this server cannot send mail, because their only way in is a mailed link.
+      email_configured: isEmailConfigured(),
       promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
       // Manual (email/password) sign-in mode (open | invite-only | disabled).
       // The login page reads this to show/hide the credential form, and to
@@ -11672,6 +12781,16 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
+    // presence is reported, never the value (same discipline as the OIDC secret).
+    sso_token_exchange_enabled: config.SSO_TOKEN_EXCHANGE_ENABLED,
+    mcp_signing_secret_set: !!config.MCP_SIGNING_SECRET,
+    mcp_token_ttl_seconds: config.MCP_TOKEN_TTL_SECONDS,
+    ms_token_exchange_enabled: config.MS_TOKEN_EXCHANGE_ENABLED,
+    ms_client_id: config.MS_CLIENT_ID,
+    ms_tenant_id: config.MS_TENANT_ID,
+    google_token_exchange_enabled: config.GOOGLE_TOKEN_EXCHANGE_ENABLED,
+    google_client_id: config.GOOGLE_CLIENT_ID,
     // Live readiness (enabled AND issuer+id+secret present) — the SAVED state,
     // i.e. whether the login button is currently live. The Settings UI derives
     // its own "enabled but not configured" warning from the unsaved draft
@@ -11872,6 +12991,67 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("sso_token_exchange_enabled" in body) {
+      pending.push({
+        name: "SSO_TOKEN_EXCHANGE_ENABLED",
+        value: body.sso_token_exchange_enabled ? "true" : null
+      });
+    }
+    if ("mcp_signing_secret" in body) {
+      const v = body.mcp_signing_secret;
+      if (v === null || v === "") {
+        pending.push({ name: "MCP_SIGNING_SECRET", value: null });
+      } else if (typeof v !== "string") {
+        addError("mcp_signing_secret", "MCP signing secret must be a string (or empty to clear it).");
+      } else if (v.trim().length < 16) {
+        addError("mcp_signing_secret", "MCP signing secret should be a long random string (16+ characters).");
+      } else {
+        pending.push({ name: "MCP_SIGNING_SECRET", value: v.trim() });
+      }
+    }
+    if ("mcp_token_ttl_seconds" in body) {
+      const n = Number(body.mcp_token_ttl_seconds);
+      if (!Number.isFinite(n) || n < 30 || n > 3600) {
+        addError("mcp_token_ttl_seconds", "Token lifetime must be between 30 and 3600 seconds.");
+      } else {
+        pending.push({ name: "MCP_TOKEN_TTL_SECONDS", value: String(Math.floor(n)) });
+      }
+    }
+    if ("ms_token_exchange_enabled" in body) {
+      pending.push({
+        name: "MS_TOKEN_EXCHANGE_ENABLED",
+        value: body.ms_token_exchange_enabled ? "true" : null
+      });
+    }
+    if ("ms_client_id" in body) {
+      pending.push({ name: "MS_CLIENT_ID", value: String(body.ms_client_id ?? "").trim() || null });
+    }
+    if ("ms_tenant_id" in body) {
+      pending.push({ name: "MS_TENANT_ID", value: String(body.ms_tenant_id ?? "").trim() || null });
+    }
+    if ("google_token_exchange_enabled" in body) {
+      pending.push({
+        name: "GOOGLE_TOKEN_EXCHANGE_ENABLED",
+        value: body.google_token_exchange_enabled ? "true" : null
+      });
+    }
+    if ("google_client_id" in body) {
+      pending.push({ name: "GOOGLE_CLIENT_ID", value: String(body.google_client_id ?? "").trim() || null });
+    }
+    const effAllowedDomains = "oidc_allowed_domains" in body ? String(body.oidc_allowed_domains ?? "").split(",").map((d) => d.trim()).filter(Boolean) : config.OIDC_ALLOWED_DOMAINS;
+    const effAutoProvision = "oidc_auto_provision" in body ? !!body.oidc_auto_provision : config.OIDC_AUTO_PROVISION;
+    if (effAutoProvision && effAllowedDomains.length === 0) {
+      for (const field of [
+        "ms_token_exchange_enabled",
+        "google_token_exchange_enabled"
+      ]) {
+        if (body[field])
+          addError(
+            field,
+            "Set allowed email domains (or turn auto-provision off) before enabling token exchange \u2014 otherwise anyone with an account at that provider can sign themselves up and mint a token."
+          );
+      }
+    }
     const effOidcIssuer = "oidc_issuer" in body ? String(body.oidc_issuer ?? "").trim() : config.OIDC_ISSUER;
     const effOidcClientId = "oidc_client_id" in body ? String(body.oidc_client_id ?? "").trim() : config.OIDC_CLIENT_ID;
     const effOidcSecret = "oidc_client_secret" in body ? String(body.oidc_client_secret ?? "").trim() : config.OIDC_CLIENT_SECRET;
@@ -12301,11 +13481,12 @@ function createApp() {
   app.route("/runs", runDetailRoutes);
   app.route("/hooks", hookFireRoutes);
   app.route("/llms.txt", llmsTxtRoutes);
+  app.route("/p", publishRenderRoutes);
   app.use("/index", flexAuthWithPromptowlTicket);
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono21();
+  const nestsApp = new Hono23();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -12396,7 +13577,7 @@ function createApp() {
     }
     let required = "read";
     const path = c.req.path;
-    const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
+    const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review") || /\/review-queue\/bulk$/.test(path);
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isDeletionRequestAction = /\/request-deletion$/.test(path) || /\/deletion-requests\/[^/]+\/withdraw$/.test(path);
@@ -12410,7 +13591,7 @@ function createApp() {
       );
     }
     const resource = parts[1];
-    if (resource === "visibility") {
+    if (resource === "visibility" || resource === "reader-mode") {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
@@ -12498,6 +13679,7 @@ function createApp() {
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);
+  nestsApp.route("/:nestId/publications", publishRoutes);
   nestsApp.route("/:nestId/teams", nestTeamRoutes);
   nestsApp.route("/:nestId/edge-types", edgeTypeRoutes);
   nestsApp.route("/:nestId/edges", edgeRoutes);
@@ -12534,6 +13716,12 @@ function createApp() {
   );
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
+    if (isVaultLockTimeout(err) || err instanceof VaultBusyError) {
+      const busy = err instanceof VaultBusyError ? err : new VaultBusyError();
+      return c.json({ error: busy.message }, 503, {
+        "Retry-After": String(busy.retryAfterSeconds)
+      });
+    }
     if (err instanceof AppError) {
       return c.json({ error: err.message }, err.statusCode);
     }
@@ -12812,7 +14000,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid15 } from "uuid";
+import { v4 as uuid17 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -12836,21 +14024,21 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid15()}`;
-      const nowIso = new Date(now).toISOString();
+      const id = `run_${uuid17()}`;
+      const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
          VALUES (?, ?, ?, ?, 'running', NULL, ?, NULL, 0)`,
         // triggered_by names the schedule's creator with a schedule: prefix —
         // honest provenance ("this fired on X's schedule, not X clicking").
-        [id, s.nest_id, s.agent_node, `schedule:${s.created_by}`, nowIso]
+        [id, s.nest_id, s.agent_node, `schedule:${s.created_by}`, nowIso2]
       );
       const fired = s.runs_created + 1;
       const done = s.max_runs !== null && fired >= s.max_runs;
       await db.run(
         `UPDATE schedules SET last_run_at = ?, runs_created = ?, enabled = ?, updated_at = ?
           WHERE id = ?`,
-        [nowIso, fired, done ? 0 : s.enabled, nowIso, s.id]
+        [nowIso2, fired, done ? 0 : s.enabled, nowIso2, s.id]
       );
       created.push(id);
     } catch (err) {