@promptowl/contextnest-community 1.2.0 → 1.4.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-E7E3JMQR.js";
+} from "./chunk-TTXTEUFT.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +25,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-LO54V4AU.js";
+} from "./chunk-HIH7I232.js";
 import {
   AppError,
   ConflictError,
@@ -67,6 +67,7 @@ import {
   nestAllowsSelfApprove,
   permissionLevel,
   removeSteward,
+  renameNest,
   resolveNestPermission,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
@@ -77,21 +78,22 @@ import {
   startTelemetryLoop,
   syncFromConfig,
   trackEvent,
+  uniqueNestName,
   updateSteward,
   validateLicense
-} from "./chunk-5MT4ZBVF.js";
+} from "./chunk-XNPD2Q6E.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-G62P54ET.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono9 } from "hono";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
 
@@ -210,6 +212,11 @@ var authMiddleware = createMiddleware(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 
+// src/shared/email.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function liveBucket(key, cutoff) {
@@ -242,11 +249,60 @@ function clear(key) {
   buckets.delete(key);
 }
 
+// src/auth/sso-token.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function b64urlToBuffer(input) {
+  const pad = input.length % 4 === 0 ? "" : "=".repeat(4 - input.length % 4);
+  return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+var SsoTokenError = class extends Error {
+};
+function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
+  if (!secret) throw new SsoTokenError("SSO secret not configured");
+  if (!token || typeof token !== "string") {
+    throw new SsoTokenError("Missing ticket");
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new SsoTokenError("Malformed ticket");
+  const [headerB64, payloadB64, sigB64] = parts;
+  let header;
+  try {
+    header = JSON.parse(b64urlToBuffer(headerB64).toString("utf8"));
+  } catch {
+    throw new SsoTokenError("Invalid ticket header");
+  }
+  if (header.alg !== "HS256") {
+    throw new SsoTokenError(`Unsupported alg: ${header.alg}`);
+  }
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const expected = createHmac("sha256", secret).update(signingInput).digest();
+  const provided = b64urlToBuffer(sigB64);
+  if (expected.length !== provided.length || !timingSafeEqual(expected, provided)) {
+    throw new SsoTokenError("Bad signature");
+  }
+  let claims;
+  try {
+    claims = JSON.parse(b64urlToBuffer(payloadB64).toString("utf8"));
+  } catch {
+    throw new SsoTokenError("Invalid ticket payload");
+  }
+  const LEEWAY = 30;
+  if (typeof claims.exp !== "number") {
+    throw new SsoTokenError("Ticket missing exp");
+  }
+  if (nowSec > claims.exp + LEEWAY) {
+    throw new SsoTokenError("Ticket expired");
+  }
+  if (!claims.sub) throw new SsoTokenError("Ticket missing sub");
+  return claims;
+}
+
 // src/auth/routes.ts
 import { getConnInfo } from "@hono/node-server/conninfo";
 var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+var warnedMissingSsoAudience = false;
 function clientIp(c) {
   const xff = c.req.header("x-forwarded-for");
   if (xff) return xff.split(",")[0].trim();
@@ -294,18 +350,67 @@ function clearSessionCookie(c) {
     buildClearSessionCookie({ secure: isSecureRequest(c) })
   );
 }
+async function provisionPromptowlUser(c, rawEmail, rawName) {
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate !== "open") {
+    if (gate === "disabled" || !isLicenseAdminEmail(rawEmail)) {
+      return {
+        ok: false,
+        status: 403,
+        error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
+        gate
+      };
+    }
+  }
+  const db = getDb();
+  const meEmail = normalizeEmail(rawEmail);
+  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
+  if (!user) {
+    const userId = uuid();
+    const placeholderHash = await hashPassword(uuid());
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, meEmail, rawName || null, placeholderHash);
+    user = { id: userId, email: meEmail, name: rawName || null };
+    trackEvent("user.register", {
+      userId,
+      email: rawEmail,
+      method: "promptowl"
+    });
+  } else {
+    trackEvent("user.login", { userId: user.id, method: "promptowl" });
+  }
+  let claimBlocked = null;
+  const lic = getCurrentLicense();
+  let isAdmin = false;
+  if (!lic?.valid) {
+    claimBlocked = { reason: "license_required" };
+  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === rawEmail.toLowerCase()) {
+    isAdmin = true;
+    trackEvent("admin.claim", { userId: user.id, email: user.email });
+  } else {
+    claimBlocked = {
+      reason: "email_mismatch",
+      license_owner_email: lic.ownerEmail
+    };
+  }
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
+  return { ok: true, user, isAdmin, claimBlocked };
+}
 var authRoutes = new Hono();
 authRoutes.post("/register", async (c) => {
   const body = await c.req.json();
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  const email = normalizeEmail(body.email);
   const ip = clientIp(c);
   if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
     return c.json({ error: "Too many registration attempts, try again later" }, 429);
   }
   const db = getDb();
-  const existing = db.prepare("SELECT id, is_invited FROM users WHERE email = ?").get(body.email);
+  const existing = db.prepare("SELECT id, is_invited FROM users WHERE LOWER(email) = ?").get(email);
   let userId;
   const passwordHash = await hashPassword(body.password);
   if (existing && existing.is_invited === 1) {
@@ -313,15 +418,15 @@ authRoutes.post("/register", async (c) => {
     db.prepare(
       "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?"
     ).run(passwordHash, body.name || null, userId);
-    trackEvent("user.register", { userId, email: body.email, claimed: true });
+    trackEvent("user.register", { userId, email, claimed: true });
   } else if (existing) {
     throw new ValidationError("Email already registered");
   } else {
     userId = uuid();
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, body.email, body.name || null, passwordHash);
-    trackEvent("user.register", { userId, email: body.email });
+    ).run(userId, email, body.name || null, passwordHash);
+    trackEvent("user.register", { userId, email });
   }
   const sessionId = createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
@@ -329,9 +434,9 @@ authRoutes.post("/register", async (c) => {
     {
       user: {
         id: userId,
-        email: body.email,
+        email,
         name: body.name || null,
-        is_admin: isLicenseAdminEmail(body.email)
+        is_admin: isLicenseAdminEmail(email)
       }
     },
     201
@@ -352,8 +457,8 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = db.prepare(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE email = ?"
-  ).get(body.email);
+    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?"
+  ).get(emailLower);
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
   if (!user || !check.ok) {
     if (hasIp) recordFailure(ipKey, LOGIN_LIMIT);
@@ -525,61 +630,76 @@ authRoutes.post("/promptowl", async (c) => {
       401
     );
   }
-  const gate = config.PROMPTOWL_SIGN_IN_GATE;
-  if (gate !== "open") {
-    if (gate === "disabled" || !isLicenseAdminEmail(me.email)) {
-      return c.json(
-        {
-          error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
-          gate
-        },
-        403
-      );
-    }
-  }
-  const db = getDb();
-  let user = db.prepare("SELECT id, email, name FROM users WHERE email = ?").get(me.email);
-  if (!user) {
-    const userId = uuid();
-    const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, me.email, me.name || null, placeholderHash);
-    user = { id: userId, email: me.email, name: me.name || null };
-    trackEvent("user.register", {
-      userId,
-      email: me.email,
-      method: "promptowl"
-    });
-  } else {
-    trackEvent("user.login", { userId: user.id, method: "promptowl" });
+  const result = await provisionPromptowlUser(c, me.email, me.name);
+  if (!result.ok) {
+    return c.json({ error: result.error, gate: result.gate }, result.status);
   }
-  let claimBlocked = null;
-  const lic = getCurrentLicense();
-  let isAdmin = false;
-  if (!lic?.valid) {
-    claimBlocked = { reason: "license_required" };
-  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === me.email.toLowerCase()) {
-    isAdmin = true;
-    trackEvent("admin.claim", { userId: user.id, email: user.email });
-  } else {
-    claimBlocked = {
-      reason: "email_mismatch",
-      license_owner_email: lic.ownerEmail
-    };
-  }
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
-  setSessionCookie(c, sessionId);
   return c.json({
     user: {
-      id: user.id,
-      email: user.email,
-      name: user.name,
-      is_admin: isAdmin
+      id: result.user.id,
+      email: result.user.email,
+      name: result.user.name,
+      is_admin: result.isAdmin
     },
-    ...claimBlocked ? { claim_blocked: claimBlocked } : {}
+    ...result.claimBlocked ? { claim_blocked: result.claimBlocked } : {}
   });
 });
+authRoutes.get("/sso", async (c) => {
+  const ssoError = (code) => c.redirect(`/?sso_error=${code}`, 302);
+  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+  if (!secret) return ssoError("not_supported");
+  if (!tryConsume(`sso:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
+    return ssoError("rate_limited");
+  }
+  const ticket = c.req.query("ticket");
+  if (!ticket) return ssoError("missing_ticket");
+  let claims;
+  try {
+    claims = verifySsoTicket(ticket, secret);
+  } catch {
+    return ssoError("invalid_ticket");
+  }
+  const expectedAud = config.PUBLIC_BASE_URL;
+  if (!expectedAud && !warnedMissingSsoAudience) {
+    warnedMissingSsoAudience = true;
+    console.warn(
+      "[sso] OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is empty \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL so a ticket minted for another server cannot be replayed against this one."
+    );
+  }
+  if (expectedAud) {
+    const aud = (claims.aud || "").replace(/\/$/, "");
+    if (aud !== expectedAud) return ssoError("bad_audience");
+  }
+  const sub = (claims.sub || "").trim();
+  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(sub) || sub.length > 254) {
+    return ssoError("invalid_ticket");
+  }
+  if (!claims.jti) return ssoError("invalid_ticket");
+  const db = getDb();
+  db.prepare("DELETE FROM sso_used_jti WHERE expires_at < datetime('now')").run();
+  const expiresAtIso = new Date((claims.exp ?? 0) * 1e3).toISOString();
+  try {
+    db.prepare(
+      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)"
+    ).run(claims.jti, expiresAtIso);
+  } catch (err) {
+    if (err?.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+      return ssoError("ticket_used");
+    }
+    console.error("[sso] failed to record ticket jti:", err);
+    return ssoError("service_error");
+  }
+  let result;
+  try {
+    result = await provisionPromptowlUser(c, sub, claims.name);
+  } catch (err) {
+    db.prepare("DELETE FROM sso_used_jti WHERE jti = ?").run(claims.jti);
+    console.error("[sso] provisioning failed; released jti for retry:", err);
+    return ssoError("service_error");
+  }
+  if (!result.ok) return ssoError("sign_in_restricted");
+  return c.redirect("/", 302);
+});
 authRoutes.get("/admin-status", async (c) => {
   const db = getDb();
   const lic = getCurrentLicense();
@@ -727,6 +847,7 @@ authRoutes.delete("/users/:userId", async (c) => {
 authRoutes.post("/invite", async (c) => {
   const body = await c.req.json();
   if (!body.email) throw new ValidationError("email is required");
+  const email = normalizeEmail(body.email);
   const callerId = resolveCallerUserId(c);
   if (!callerId) {
     return c.json(
@@ -745,14 +866,14 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = db.prepare("SELECT id, email FROM users WHERE email = ?").get(body.email);
+  let user = db.prepare("SELECT id, email FROM users WHERE LOWER(email) = ?").get(email);
   if (!user) {
     const userId = uuid();
     const placeholderHash = await hashPassword(uuid());
     db.prepare(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-    ).run(userId, body.email, null, placeholderHash);
-    user = { id: userId, email: body.email };
+    ).run(userId, email, null, placeholderHash);
+    user = { id: userId, email };
   }
   const apiKey = generateApiKey();
   const keyId = uuid();
@@ -1069,7 +1190,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1225,7 +1346,7 @@ async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = engineCache.get(nestId);
   const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  const id = `nodes/${slug}`;
+  const id = input.id ?? `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
   const hasStewards = isStewardshipEnabled(nestId);
@@ -1449,6 +1570,185 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   return { node, version: responseVersion };
 }
 
+// src/nests/unsynced-service.ts
+import { readdirSync, readFileSync, rmSync, statSync } from "fs";
+import { join as join2, relative } from "path";
+var RESERVED = /* @__PURE__ */ new Set(["nests"]);
+function scanMarkdown(dir) {
+  let count = 0;
+  let size = 0;
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return { count, size };
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      const sub = scanMarkdown(full);
+      count += sub.count;
+      size += sub.size;
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        size += statSync(full).size;
+        count++;
+      } catch {
+      }
+    }
+  }
+  return { count, size };
+}
+function hasDirectMarkdown(dir) {
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  return entries.some(
+    (e) => e.isFile() && e.name.toLowerCase().endsWith(".md")
+  );
+}
+function collectLeafFolders(rel, abs) {
+  if (hasDirectMarkdown(abs)) {
+    const { count, size } = scanMarkdown(abs);
+    const segments = rel.split("/").filter(Boolean);
+    return [
+      {
+        name: rel,
+        label: segments[segments.length - 1] || rel,
+        mdCount: count,
+        sizeBytes: size
+      }
+    ];
+  }
+  let entries = [];
+  try {
+    entries = readdirSync(abs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    out.push(
+      ...collectLeafFolders(`${rel}/${e.name}`, join2(abs, e.name))
+    );
+  }
+  return out;
+}
+function listUnsyncedFolders() {
+  const root = config.DATA_ROOT;
+  let entries = [];
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    if (e.name.startsWith(".")) continue;
+    if (RESERVED.has(e.name)) continue;
+    out.push(...collectLeafFolders(e.name, join2(root, e.name)));
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name));
+  console.log(
+    `[unsynced] discovered ${out.length} candidate folder(s) under ${root}`
+  );
+  return out;
+}
+function assertSafeFolderName(name) {
+  if (!name || name.includes("\\")) {
+    throw new ValidationError("Invalid folder name");
+  }
+  const segments = name.split("/").filter(Boolean);
+  if (segments.length === 0) {
+    throw new ValidationError("Invalid folder name");
+  }
+  if (RESERVED.has(segments[0])) {
+    throw new ValidationError("Folder is not eligible for sync");
+  }
+  for (const seg of segments) {
+    if (seg === ".." || seg.startsWith(".") || seg === "node_modules") {
+      throw new ValidationError("Folder is not eligible for sync");
+    }
+  }
+}
+function collectMarkdownFiles(dir, root) {
+  const out = [];
+  let entries = [];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    if (e.name.startsWith(".") || e.name === "node_modules") continue;
+    const full = join2(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...collectMarkdownFiles(full, root));
+    } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
+      try {
+        const rel = relative(root, full);
+        out.push({ path: rel, content: readFileSync(full, "utf-8") });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+async function syncUnsyncedFolder(userId, folderName, callerEmail) {
+  console.log(
+    `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
+  );
+  assertSafeFolderName(folderName);
+  const src = join2(config.DATA_ROOT, folderName);
+  let stat;
+  try {
+    stat = statSync(src);
+  } catch {
+    console.warn(`[unsynced] source missing: ${src}`);
+    throw new NotFoundError(`Folder not found: ${folderName}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new ValidationError(`Not a directory: ${folderName}`);
+  }
+  const files = collectMarkdownFiles(src, src);
+  console.log(
+    `[unsynced] collected ${files.length} markdown file(s) from ${src}`
+  );
+  if (files.length === 0) {
+    throw new ValidationError(`Folder has no markdown to sync: ${folderName}`);
+  }
+  const segments = folderName.split("/").filter(Boolean);
+  const baseName = segments[segments.length - 1] || folderName;
+  const nestName = uniqueNestName(userId, baseName);
+  if (nestName !== baseName) {
+    console.log(
+      `[unsynced] name "${baseName}" already in use, using "${nestName}" instead`
+    );
+  }
+  const nest = await importNest(userId, nestName, files);
+  console.log(
+    `[unsynced] nest created id=${nest.id} name="${nest.name}" from folder="${folderName}"`
+  );
+  const documents = await registerImportedDocuments(nest.id, callerEmail);
+  console.log(
+    `[unsynced] registered ${documents} document(s) for nest ${nest.id}`
+  );
+  try {
+    rmSync(src, { recursive: true, force: true });
+    console.log(`[unsynced] removed source folder ${src}`);
+  } catch (err) {
+    console.error("[unsynced] failed to remove source folder", src, err);
+  }
+  return { nest, documents };
+}
+
 // src/nests/routes.ts
 function effectivePermission(nestId, userId) {
   if (config.AUTH_MODE === "open") {
@@ -1511,6 +1811,29 @@ nestRoutes.post("/import", async (c) => {
   );
   return c.json({ nest, documents }, 201);
 });
+nestRoutes.get("/unsynced", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can list unsynced folders");
+  }
+  return c.json({ folders: listUnsyncedFolders() });
+});
+nestRoutes.post("/unsynced/sync", async (c) => {
+  const userId = c.get("userId");
+  if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+    throw new ForbiddenError("Only the server admin can sync folders");
+  }
+  const body = await c.req.json();
+  if (!body?.name) {
+    throw new ValidationError("name is required");
+  }
+  const result = await syncUnsyncedFolder(
+    userId,
+    body.name,
+    resolveCallerEmail(userId)
+  );
+  return c.json(result, 201);
+});
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1527,6 +1850,25 @@ nestRoutes.get("/:nestId", async (c) => {
   const nest = getNest(nestId);
   return c.json({ nest, permission, roles, myStewards });
 });
+nestRoutes.patch("/:nestId", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const permission = effectivePermission(nestId, userId);
+  if (permission === "none") {
+    throw new NotFoundError("Nest not found");
+  }
+  if (permission !== "owner" && permission !== "admin") {
+    throw new ForbiddenError(
+      "Only the nest owner or an admin can rename a nest."
+    );
+  }
+  const body = await c.req.json();
+  const nest = renameNest(nestId, {
+    name: body.name,
+    description: body.description
+  });
+  return c.json({ nest });
+});
 nestRoutes.delete("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -1599,10 +1941,16 @@ async function addCollaborator(params) {
   if (!params.permission || !VALID_PERMISSIONS.includes(params.permission)) {
     throw new ValidationError("permission must be read, write, or admin");
   }
+  if (params.callerPermission && permissionLevel(params.permission) > permissionLevel(params.callerPermission)) {
+    throw new ForbiddenError(
+      `You can only grant access up to your own level ('${params.callerPermission}'). Ask a nest admin to grant '${params.permission}'.`
+    );
+  }
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
-    const existing = db.prepare("SELECT id FROM users WHERE email = ?").get(params.email);
+    const email = normalizeEmail(params.email);
+    const existing = db.prepare("SELECT id FROM users WHERE LOWER(email) = ?").get(email);
     if (existing) {
       userId = existing.id;
     } else {
@@ -1610,7 +1958,7 @@ async function addCollaborator(params) {
       userId = uuid2();
       db.prepare(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)"
-      ).run(userId, params.email, null, await hashPassword2(uuid2()));
+      ).run(userId, email, null, await hashPassword2(uuid2()));
     }
   }
   if (!userId) {
@@ -1673,7 +2021,10 @@ sharingRoutes.post("/collaborators", async (c) => {
     email: body.email,
     userId: body.user_id,
     permission: body.permission ?? "",
-    grantedByUserId: c.get("userId")
+    grantedByUserId: c.get("userId"),
+    // Enforce the escalation cap against the caller's own nest permission
+    // (set by the access guard) — a write collaborator can't grant admin.
+    callerPermission: c.get("nestPermission")
   });
   return c.json({ collaborator: collab }, 201);
 });
@@ -1683,17 +2034,22 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
     throw new ValidationError("permission must be read, write, or admin");
   }
   const db = getDb();
-  db.prepare("UPDATE nest_collaborators SET permission = ? WHERE id = ?").run(
-    body.permission,
-    c.req.param("collabId")
-  );
+  const info = db.prepare(
+    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?"
+  ).run(body.permission, c.req.param("collabId"), c.req.param("nestId"));
+  if (info.changes === 0) {
+    throw new NotFoundError("Collaborator not found");
+  }
   return c.json({ updated: true });
 });
 sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   const db = getDb();
-  db.prepare("DELETE FROM nest_collaborators WHERE id = ?").run(
-    c.req.param("collabId")
-  );
+  const info = db.prepare(
+    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?"
+  ).run(c.req.param("collabId"), c.req.param("nestId"));
+  if (info.changes === 0) {
+    throw new NotFoundError("Collaborator not found");
+  }
   return c.json({ removed: true });
 });
 sharingRoutes.patch("/visibility", async (c) => {
@@ -1781,7 +2137,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VOD5HY3I.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-HFQPGASU.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -1802,7 +2158,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-OCZUV2QP.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -1833,7 +2189,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GYX3AW6E.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-ZBYZYH5H.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -2027,8 +2383,407 @@ function getUserEmail(c) {
   return user?.email || "anonymous@localhost";
 }
 
-// src/nodes/query-routes.ts
+// src/annotations/routes.ts
 import { Hono as Hono5 } from "hono";
+
+// src/annotations/service.ts
+import { v4 as uuid3 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
+}
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
+  }
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
+}
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
+  });
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
+  );
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
+  });
+  for (const key of keys) {
+    lines.push(`## ${snapshotLabel(key)}`);
+    lines.push("");
+    for (const thread of orderThreads(buckets2.get(key))) {
+      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
+      lines.push(renderAnchor(thread.anchor));
+      for (const comment of thread.comments) {
+        lines.push(
+          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/annotations/service.ts
+function loadComments(threadId) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC"
+  ).all(threadId);
+  return rows.map((r) => ({
+    id: r.id,
+    author: r.author,
+    body: r.body,
+    createdAt: r.created_at
+  }));
+}
+function rowToThread(row) {
+  let anchor = null;
+  if (row.anchor_json) {
+    try {
+      anchor = JSON.parse(row.anchor_json);
+    } catch {
+      anchor = null;
+    }
+  }
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    snapshotVersion: row.snapshot_version,
+    anchor,
+    status: row.status,
+    createdBy: row.created_by,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by,
+    resolvedAt: row.resolved_at,
+    comments: loadComments(row.id)
+  };
+}
+function getThreadRow(threadId) {
+  return getDb().prepare("SELECT * FROM annotation_threads WHERE id = ?").get(threadId);
+}
+function listThreads(nestId, nodeId) {
+  const rows = getDb().prepare(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC"
+  ).all(nestId, nodeId);
+  return rows.map(rowToThread);
+}
+function createThread(nestId, nodeId, input, authorEmail) {
+  const body = (input.body ?? "").trim();
+  if (!body) {
+    throw new Error("comment body is required");
+  }
+  const db = getDb();
+  const id = uuid3();
+  const anchor = clampAnchor(input.anchor);
+  const snapshot = input.snapshotVersion ?? getApprovedVersion(nestId, nodeId) ?? null;
+  const tx = db.transaction(() => {
+    db.prepare(
+      `INSERT INTO annotation_threads
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`
+    ).run(
+      id,
+      nestId,
+      nodeId,
+      snapshot,
+      anchor ? JSON.stringify(anchor) : null,
+      authorEmail
+    );
+    db.prepare(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
+    ).run(uuid3(), id, authorEmail, body);
+  });
+  tx();
+  return rowToThread(getThreadRow(id));
+}
+function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = getThreadRow(threadId);
+  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
+    throw new NotFoundError(`Thread not found: ${threadId}`);
+  }
+  return row;
+}
+function addComment(nestId, nodeId, threadId, authorEmail, body) {
+  const trimmed = (body ?? "").trim();
+  if (!trimmed) {
+    throw new Error("comment body is required");
+  }
+  getScopedThreadRow(threadId, nestId, nodeId);
+  getDb().prepare(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
+  ).run(uuid3(), threadId, authorEmail, trimmed);
+  return rowToThread(getThreadRow(threadId));
+}
+function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  getScopedThreadRow(threadId, nestId, nodeId);
+  if (status === "resolved") {
+    getDb().prepare(
+      "UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now') WHERE id = ?"
+    ).run(byEmail, threadId);
+  } else {
+    getDb().prepare(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?"
+    ).run(threadId);
+  }
+  return rowToThread(getThreadRow(threadId));
+}
+async function readArtifact(nestId, nodeId, version) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const target = version ?? getApprovedVersion(nestId, nodeId) ?? null;
+  let title = nodeId;
+  let type = null;
+  let liveHtml = "";
+  let liveExists = true;
+  try {
+    const node = await storage.readDocument(nodeId);
+    title = node.frontmatter?.title || nodeId;
+    type = node.frontmatter?.type || null;
+    liveHtml = node.body || "";
+  } catch {
+    liveExists = false;
+  }
+  if (target != null) {
+    try {
+      const raw = await versionManager.reconstructVersion(nodeId, target);
+      return { title, html: bodyOnly(nodeId, raw), version: target, type };
+    } catch (err) {
+      console.warn(
+        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
+        err
+      );
+    }
+  }
+  if (!liveExists) {
+    throw new NotFoundError(`Artifact not found: ${nodeId}`);
+  }
+  return { title, html: liveHtml, version: target, type };
+}
+function derivedAnnotationsId(sourceNodeId) {
+  const base = sourceNodeId.replace(/^nodes\//, "");
+  return `nodes/${base}--annotations`;
+}
+async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  try {
+    let title = nodeId;
+    try {
+      const { storage } = engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+    } catch {
+    }
+    const threads = listThreads(nestId, nodeId);
+    const derivedTitle = `${title} \u2014 Annotations`;
+    const markdown = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
+    );
+  }
+}
+
+// src/annotations/types.ts
+var ARTIFACT_NODE_TYPE = "artifact";
+
+// src/annotations/routes.ts
+var annotationRoutes = new Hono5();
+function getNodeId(c) {
+  const raw = c.req.param("nodeId");
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+annotationRoutes.get("/:nodeId{.+}/annotations", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  return c.json({ threads: listThreads(nestId, nodeId) });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const input = await c.req.json();
+  if (!input.body || !input.body.trim()) {
+    throw new ValidationError("body is required");
+  }
+  const thread = createThread(
+    nestId,
+    nodeId,
+    {
+      body: input.body,
+      anchor: input.anchor ?? null,
+      snapshotVersion: input.snapshotVersion ?? null
+    },
+    userEmail
+  );
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread }, 201);
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const input = await c.req.json();
+  if (!input.body || !input.body.trim()) {
+    throw new ValidationError("body is required");
+  }
+  const thread = addComment(nestId, nodeId, threadId, userEmail, input.body);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/resolve", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const thread = setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/reopen", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const thread = setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const vRaw = c.req.query("v");
+  const vNum = vRaw !== void 0 ? Number(vRaw) : NaN;
+  const version = Number.isFinite(vNum) && vNum > 0 ? Math.floor(vNum) : void 0;
+  const { html, version: served, type } = await readArtifact(
+    nestId,
+    nodeId,
+    version
+  );
+  if (type !== null && type !== ARTIFACT_NODE_TYPE) {
+    return c.json({ error: "Not a hosted artifact" }, 404);
+  }
+  c.header(
+    "Content-Security-Policy",
+    [
+      "sandbox allow-scripts allow-popups allow-modals",
+      "default-src 'none'",
+      "script-src 'unsafe-inline'",
+      "style-src 'unsafe-inline'",
+      "img-src data: blob:",
+      "font-src data:",
+      "connect-src 'none'",
+      "base-uri 'none'",
+      "form-action 'none'"
+    ].join("; ")
+  );
+  c.header("X-Content-Type-Options", "nosniff");
+  c.header("Referrer-Policy", "no-referrer");
+  if (served != null) c.header("X-Artifact-Snapshot", String(served));
+  return c.html(html);
+});
+
+// src/nodes/query-routes.ts
+import { Hono as Hono6 } from "hono";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 
 // src/nodes/prompt-compiler.ts
@@ -2246,8 +3001,158 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
   }
 }
 
+// src/nodes/graph-service.ts
+var MAX_GRAPH_NODES = 150;
+var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
+function extractWikiTargets(body) {
+  const out = [];
+  if (!body) return out;
+  WIKILINK_RE.lastIndex = 0;
+  let m;
+  while ((m = WIKILINK_RE.exec(body)) !== null) {
+    const t = (m[1] || "").trim();
+    if (t) out.push(t);
+  }
+  return out;
+}
+async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const accessible = filterAccessible(nestId, userId, userEmail, docs);
+  const idSet = new Set(accessible.map((d) => d.id));
+  const titleToId = /* @__PURE__ */ new Map();
+  for (const d of accessible) {
+    const t = (d.frontmatter?.title || "").toLowerCase().trim();
+    if (t && !titleToId.has(t)) titleToId.set(t, d.id);
+  }
+  const allNodes = accessible.map((d) => ({
+    id: d.id,
+    title: d.frontmatter?.title || d.id,
+    type: d.frontmatter?.type || "document",
+    tags: (d.frontmatter?.tags || []).map(normalizeTag)
+  }));
+  const allLinks = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const d of accessible) {
+    for (const raw of extractWikiTargets(d.body || "")) {
+      const targetId = idSet.has(raw) ? raw : titleToId.get(raw.toLowerCase().trim());
+      if (!targetId || targetId === d.id) continue;
+      const key = `${d.id}->${targetId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      allLinks.push({ source: d.id, target: targetId });
+    }
+  }
+  const tagCounts = /* @__PURE__ */ new Map();
+  const tagToDocs = /* @__PURE__ */ new Map();
+  for (const n of allNodes) {
+    for (const t of n.tags) {
+      tagCounts.set(t, (tagCounts.get(t) || 0) + 1);
+      let s = tagToDocs.get(t);
+      if (!s) tagToDocs.set(t, s = /* @__PURE__ */ new Set());
+      s.add(n.id);
+    }
+  }
+  const tags = [...tagCounts.entries()].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count);
+  const exposeStewards = isStewardshipEnabled(nestId) && !isPublicReader(nestId, userId);
+  const stewardRows = exposeStewards ? (await listStewards({ nestId })).filter(
+    // Drop document-scoped rows whose node the caller can't see.
+    (s) => s.scope !== "document" || idSet.has(s.nodePattern || "")
+  ) : [];
+  const maskId = /* @__PURE__ */ new Map();
+  if (!canSeeIdentities) {
+    const emails = [...new Set(stewardRows.map((s) => s.userEmail))].sort();
+    emails.forEach((e, i) => maskId.set(e, `s${i + 1}`));
+  }
+  const identity = (email) => {
+    if (canSeeIdentities) return { id: email, label: email };
+    const id = maskId.get(email);
+    return { id, label: `Steward ${id.slice(1)}` };
+  };
+  const stewardRowsMapped = stewardRows.map((s) => {
+    const { id, label } = identity(s.userEmail);
+    return {
+      id,
+      label,
+      role: s.role,
+      scope: s.scope,
+      target: s.scope === "document" ? s.nodePattern || "" : s.scope === "tag" ? normalizeTag(s.tagName || "") : "*"
+    };
+  });
+  const stewardEdges = stewardRowsMapped.map((s) => ({
+    steward: s.id,
+    target: s.scope === "tag" ? `tag:${s.target}` : s.scope === "document" ? s.target : "*",
+    scope: s.scope
+  }));
+  const seenSteward = /* @__PURE__ */ new Set();
+  const stewards = stewardRowsMapped.filter(
+    (s) => seenSteward.has(s.id) ? false : (seenSteward.add(s.id), true)
+  );
+  const linkedIds = /* @__PURE__ */ new Set();
+  for (const l of allLinks) {
+    linkedIds.add(l.source);
+    linkedIds.add(l.target);
+  }
+  const orphans = allNodes.filter((n) => !linkedIds.has(n.id));
+  const stewardedTags = new Set(
+    stewardRows.filter((s) => s.scope === "tag").map((s) => normalizeTag(s.tagName || ""))
+  );
+  const unstewardedTags = tags.filter((t) => !stewardedTags.has(t.name));
+  const coveredBySteward = /* @__PURE__ */ new Map();
+  const labelById = /* @__PURE__ */ new Map();
+  for (const s of stewardRowsMapped) {
+    labelById.set(s.id, s.label);
+    let cov = coveredBySteward.get(s.id);
+    if (!cov) coveredBySteward.set(s.id, cov = /* @__PURE__ */ new Set());
+    if (s.scope === "nest") for (const id of idSet) cov.add(id);
+    else if (s.scope === "tag")
+      for (const id of tagToDocs.get(s.target) || []) cov.add(id);
+    else if (idSet.has(s.target)) cov.add(s.target);
+  }
+  const denom = idSet.size;
+  const bottlenecks = denom === 0 ? [] : [...coveredBySteward.entries()].map(([steward, cov]) => ({
+    steward,
+    label: labelById.get(steward) || steward,
+    share: Math.round(cov.size / denom * 100)
+  })).filter((b) => b.share >= 50).sort((a, b) => b.share - a.share);
+  const signals = { orphans, unstewardedTags, bottlenecks };
+  const truncated = allNodes.length > MAX_GRAPH_NODES;
+  let nodes = allNodes;
+  let links = allLinks;
+  if (truncated) {
+    const degree = /* @__PURE__ */ new Map();
+    for (const l of allLinks) {
+      degree.set(l.source, (degree.get(l.source) || 0) + 1);
+      degree.set(l.target, (degree.get(l.target) || 0) + 1);
+    }
+    nodes = [...allNodes].sort(
+      (a, b) => (degree.get(b.id) || 0) - (degree.get(a.id) || 0) || (a.id < b.id ? -1 : 1)
+    ).slice(0, MAX_GRAPH_NODES);
+    const kept = new Set(nodes.map((n) => n.id));
+    links = allLinks.filter((l) => kept.has(l.source) && kept.has(l.target));
+  }
+  return {
+    nodes,
+    links,
+    stewards,
+    stewardEdges,
+    tags,
+    signals,
+    truncated,
+    totalNodes: allNodes.length
+  };
+}
+
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono5();
+var queryRoutes = new Hono6();
+queryRoutes.get("/graph", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
+  return c.json(graph);
+});
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -2566,7 +3471,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -2798,6 +3703,26 @@ var TOOL_DEFINITIONS = [
       },
       required: ["email"]
     }
+  },
+  // ─── Unsynced Folder Tools ─────────────────────────────────────────
+  {
+    name: "context_unsynced_list",
+    description: "List folders under the data root that are sync candidates \u2014 dropped in by the starter CLI or copied in manually, not yet converted into a nest. Server-admin only in non-open mode.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_sync_folder",
+    description: "Convert a sibling folder under the data root into a real nest. Imports its markdown, seeds governance, and removes the source folder. Use context_unsynced_list to discover folder names. Server-admin only in non-open mode.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Folder path relative to the data root (e.g. 'nodes/architecture'), as returned by context_unsynced_list."
+        }
+      },
+      required: ["name"]
+    }
   }
 ];
 async function resolveLlmBody(ctx, node) {
@@ -2812,7 +3737,7 @@ async function resolveLlmBody(ctx, node) {
   }
 }
 async function handleToolCall(toolName, args, ctx) {
-  const { storage, queryEngine, versionManager, nestId, userEmail } = ctx;
+  const { storage, queryEngine, versionManager, nestId, userId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
       const content = await storage.readContextMd();
@@ -3158,7 +4083,7 @@ ${list}`;
     case "context_share_nest": {
       const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
       if (!canManageWith(roles)) {
-        return "You don't have permission to share this nest. Only the nest owner or an admin can add people.";
+        return "You don't have permission to share this nest via this tool (admin only). You can still invite from the UI with write access, or ask a nest admin.";
       }
       const permission = args.permission || "read";
       try {
@@ -3174,6 +4099,34 @@ ${list}`;
         return `Failed to share nest: ${err.message}`;
       }
     }
+    case "context_unsynced_list": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to list unsynced folders. Server admin only.";
+      }
+      const folders = listUnsyncedFolders();
+      if (!folders.length) return "No unsynced folders found.";
+      const list = folders.map(
+        (f, i) => `${i + 1}. **${f.label}** \`${f.name}\` \u2014 ${f.mdCount} md file(s), ${f.sizeBytes} bytes`
+      ).join("\n");
+      return `# Unsynced Folders (${folders.length})
+
+${list}`;
+    }
+    case "context_sync_folder": {
+      if (config.AUTH_MODE !== "open" && !isLicenseAdminUserId(userId)) {
+        return "You don't have permission to sync folders. Server admin only.";
+      }
+      try {
+        const { nest, documents } = await syncUnsyncedFolder(
+          userId,
+          args.name,
+          userEmail
+        );
+        return `Synced folder "${args.name}" \u2192 nest **${nest.name}** (${nest.id}) with ${documents} document(s).`;
+      } catch (err) {
+        return `Failed to sync folder: ${err.message}`;
+      }
+    }
     default:
       return `Unknown tool: ${toolName}`;
   }
@@ -3181,13 +4134,13 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono6();
+var mcpRoutes = new Hono7();
 function getUserEmail2(userId) {
   const db = getDb();
   const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
   return user?.email || "anonymous@localhost";
 }
-function createMcpServerForNest(nestId, userEmail) {
+function createMcpServerForNest(nestId, userId, userEmail) {
   const server = new McpServer(
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
@@ -3212,6 +4165,7 @@ function createMcpServerForNest(nestId, userEmail) {
         queryEngine: engine.query,
         versionManager: engine.versions,
         nestId,
+        userId,
         userEmail
       });
       return { content: [{ type: "text", text }] };
@@ -3223,7 +4177,7 @@ mcpRoutes.all("/", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
   const userEmail = getUserEmail2(userId);
-  const server = createMcpServerForNest(nestId, userEmail);
+  const server = createMcpServerForNest(nestId, userId, userEmail);
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
     enableJsonResponse: true
@@ -3239,11 +4193,218 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/governance/routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
+
+// src/governance/comment-service.ts
+import { v4 as uuid4 } from "uuid";
+function createComment(params) {
+  const db = getDb();
+  const body = (params.body ?? "").trim();
+  if (!body) {
+    throw new Error("Comment body is required");
+  }
+  if (params.parentId) {
+    const parent = db.prepare(
+      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
+    ).get(params.parentId, params.nestId, params.nodeId);
+    if (!parent) {
+      throw new Error("Parent comment not found on this node");
+    }
+  }
+  const id = uuid4();
+  db.prepare(
+    `INSERT INTO comments
+       (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
+        parent_id, author, body)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    params.nestId,
+    params.nodeId,
+    params.version ?? null,
+    params.anchor?.start ?? null,
+    params.anchor?.end ?? null,
+    params.anchor?.text ?? null,
+    params.parentId ?? null,
+    params.author,
+    body
+  );
+  return getComment(id);
+}
+function listComments(nestId, nodeId, opts = {}) {
+  const db = getDb();
+  const args = [nestId, nodeId];
+  let statusClause = "";
+  if (opts.status) {
+    statusClause = " AND status = ?";
+    args.push(opts.status);
+  }
+  const rows = db.prepare(
+    `SELECT * FROM comments
+        WHERE nest_id = ? AND node_id = ?${statusClause}
+        ORDER BY created_at ASC`
+  ).all(...args);
+  return rows.map(rowToComment);
+}
+function getComment(id) {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM comments WHERE id = ?").get(id);
+  return row ? rowToComment(row) : null;
+}
+function resolveComment(params) {
+  const db = getDb();
+  const existing = db.prepare(
+    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
+  ).get(params.commentId, params.nestId, params.nodeId);
+  if (!existing) {
+    throw new Error("Comment not found");
+  }
+  if (existing.status === "resolved") {
+    throw new Error("Comment is already resolved");
+  }
+  db.prepare(
+    `UPDATE comments
+        SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now')
+      WHERE id = ?`
+  ).run(params.resolvedBy, params.commentId);
+  return getComment(params.commentId);
+}
+async function getActivity(params) {
+  const db = getDb();
+  const limit = Number.isFinite(params.limit) && params.limit > 0 ? Math.min(params.limit, 1e3) : 100;
+  const entries = [];
+  const nodeFilter = params.nodeId ? " AND node_id = ?" : "";
+  const baseArgs = params.nodeId ? [params.nestId, params.nodeId] : [params.nestId];
+  const commentRows = db.prepare(
+    `SELECT id, node_id, author, body, status, created_at, resolved_by, resolved_at
+         FROM comments
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY COALESCE(resolved_at, created_at) DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of commentRows) {
+    entries.push({
+      type: "comment",
+      nodeId: r.node_id,
+      actor: r.author,
+      at: r.created_at,
+      detail: excerpt(r.body),
+      refId: r.id
+    });
+    if (r.status === "resolved" && r.resolved_by && r.resolved_at) {
+      entries.push({
+        type: "comment_resolved",
+        nodeId: r.node_id,
+        actor: r.resolved_by,
+        at: r.resolved_at,
+        detail: excerpt(r.body),
+        refId: r.id
+      });
+    }
+  }
+  const versionRows = db.prepare(
+    `SELECT node_id, version, author, change_note, created_at
+         FROM node_versions
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY created_at DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of versionRows) {
+    entries.push({
+      type: "edit",
+      nodeId: r.node_id,
+      actor: r.author,
+      at: r.created_at,
+      detail: r.change_note || `v${r.version}`,
+      refId: String(r.version)
+    });
+  }
+  const reviewRows = db.prepare(
+    `SELECT id, node_id, requested_by, requested_at, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY COALESCE(resolved_at, requested_at) DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of reviewRows) {
+    entries.push({
+      type: "review_requested",
+      nodeId: r.node_id,
+      actor: r.requested_by,
+      at: r.requested_at,
+      detail: "requested review",
+      refId: r.id
+    });
+    if (r.resolved_by && r.resolved_at) {
+      entries.push({
+        type: "review_resolved",
+        nodeId: r.node_id,
+        actor: r.resolved_by,
+        at: r.resolved_at,
+        detail: r.status,
+        // approved | rejected | cancelled
+        refId: r.id
+      });
+    }
+  }
+  try {
+    const pending = await listNestExternalEdits(params.nestId);
+    for (const e of pending) {
+      if (params.nodeId && e.document_id !== params.nodeId) continue;
+      entries.push({
+        type: "edit_proposed",
+        nodeId: e.document_id,
+        actor: e.actor,
+        at: e.detected_at,
+        detail: e.note || `proposed an edit (${e.source})`,
+        refId: e.suggestion_id
+      });
+    }
+  } catch (err) {
+    console.error(
+      `[comments] failed to load pending external edits for activity feed (nest ${params.nestId}):`,
+      err
+    );
+  }
+  const ms = (at) => {
+    if (!at) return 0;
+    const norm = at.includes("T") ? at : at.replace(" ", "T") + "Z";
+    const t = Date.parse(norm);
+    return Number.isNaN(t) ? 0 : t;
+  };
+  entries.sort((a, b) => ms(b.at) - ms(a.at));
+  return entries.slice(0, limit);
+}
+function excerpt(body, max = 80) {
+  const s = (body || "").replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function rowToComment(row) {
+  const hasOffsets = row.anchor_start !== null && row.anchor_end !== null;
+  const hasText = row.anchor_text !== null && row.anchor_text !== void 0;
+  const anchor = hasOffsets || hasText ? {
+    ...hasOffsets ? { start: row.anchor_start, end: row.anchor_end } : {},
+    ...hasText ? { text: row.anchor_text } : {}
+  } : void 0;
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    version: row.version ?? void 0,
+    anchor,
+    parentId: row.parent_id ?? void 0,
+    author: row.author,
+    body: row.body,
+    status: row.status,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by ?? void 0,
+    resolvedAt: row.resolved_at ?? void 0
+  };
+}
 
 // src/governance/stewards-parser.ts
-import { readFileSync, existsSync } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { join as join3 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -3308,15 +4469,15 @@ function parseEntry(str) {
 }
 function loadStewardsConfig(nestId) {
   const dataRoot = config.DATA_ROOT;
-  const nestPath = join2(dataRoot, "nests", nestId);
+  const nestPath = join3(dataRoot, "nests", nestId);
   const candidates = [
-    join2(nestPath, "stewards.yaml"),
-    join2(nestPath, "stewards.yml"),
-    join2(nestPath, ".context", "stewards.yaml")
+    join3(nestPath, "stewards.yaml"),
+    join3(nestPath, "stewards.yml"),
+    join3(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
-      const content = readFileSync(candidatePath, "utf-8");
+      const content = readFileSync2(candidatePath, "utf-8");
       return parseStewardsYaml(content);
     }
   }
@@ -3324,7 +4485,12 @@ function loadStewardsConfig(nestId) {
 }
 
 // src/governance/routes.ts
-var governanceRoutes = new Hono7();
+function parseLimit(raw, def = 100, max = 1e3) {
+  const n = parseInt(raw ?? "", 10);
+  if (Number.isNaN(n) || n < 1) return def;
+  return Math.min(n, max);
+}
+var governanceRoutes = new Hono8();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -3427,7 +4593,17 @@ governanceRoutes.get("/review-queue", async (c) => {
     limit,
     offset
   });
-  return c.json(result);
+  const email = getUserEmail3(c);
+  const canReviewCache = /* @__PURE__ */ new Map();
+  const requests = result.requests.map((r) => {
+    let canReview = canReviewCache.get(r.nodeId);
+    if (canReview === void 0) {
+      canReview = canUserApprove(nestId, r.nodeId, email).allowed;
+      canReviewCache.set(r.nodeId, canReview);
+    }
+    return { ...r, canReview };
+  });
+  return c.json({ ...result, requests });
 });
 governanceRoutes.get("/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3444,7 +4620,13 @@ governanceRoutes.post("/external-edits/scan", async (c) => {
   const result = await scanNestForDrift(nestId, actor);
   return c.json(result);
 });
-var governanceNodeRoutes = new Hono7();
+governanceRoutes.get("/activity", async (c) => {
+  const nestId = c.req.param("nestId");
+  const limit = parseLimit(c.req.query("limit"));
+  const activity = await getActivity({ nestId, limit });
+  return c.json({ activity });
+});
+var governanceNodeRoutes = new Hono8();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3490,6 +4672,68 @@ governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const history = getReviewHistory(nestId, nodeId);
   return c.json({ reviews: history });
 });
+governanceNodeRoutes.get("/:nodeId{.+}/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const status = c.req.query("status");
+  const list = listComments(nestId, nodeId, {
+    status: status === "open" || status === "resolved" ? status : void 0
+  });
+  return c.json({ comments: list });
+});
+governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const author = getUserEmail3(c);
+  try {
+    const comment = createComment({
+      nestId,
+      nodeId,
+      author,
+      body: body.body ?? "",
+      version: body.version,
+      anchor: body.anchor,
+      parentId: body.parentId
+    });
+    return c.json({ comment }, 201);
+  } catch (err) {
+    throw new ValidationError(
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+});
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/comments/:commentId/resolve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const commentId = c.req.param("commentId");
+    const resolvedBy = getUserEmail3(c);
+    try {
+      const comment = resolveComment({
+        nestId,
+        nodeId,
+        commentId,
+        resolvedBy
+      });
+      return c.json({ comment });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg === "Comment not found") return c.json({ error: msg }, 404);
+      if (msg === "Comment is already resolved")
+        return c.json({ error: msg }, 409);
+      throw err;
+    }
+  }
+);
+governanceNodeRoutes.get("/:nodeId{.+}/activity", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const limit = parseLimit(c.req.query("limit"));
+  const activity = await getActivity({ nestId, nodeId, limit });
+  return c.json({ activity });
+});
 governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3707,15 +4951,15 @@ function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join3, relative } from "path";
+import { dirname, join as join4, relative as relative2 } from "path";
 import { existsSync as existsSync2 } from "fs";
 var HERE = dirname(fileURLToPath(import.meta.url));
 var UI_DIR_CANDIDATES = [
-  join3(HERE, "web3"),
-  join3(process.cwd(), "dist", "web3")
+  join4(HERE, "web3"),
+  join4(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
-var UI_DIR_REL = relative(process.cwd(), UI_DIR_ABS) || ".";
+var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
 var openModeMiddleware = createMiddleware2(async (c, next) => {
   const anonId = ensureAnonymousUser();
   c.set("userId", anonId);
@@ -3748,7 +4992,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
-  const app = new Hono8();
+  const app = new Hono9();
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -3847,7 +5091,14 @@ function createApp() {
         valid: true,
         tier: info.tier,
         org: info.org,
-        limits: info.limits
+        limits: info.limits,
+        // The key validated and is live now, but if it couldn't be written to
+        // disk it'll be lost on restart — surface that instead of pretending
+        // the setup is durable (the old behavior silently swallowed this).
+        persisted: info.persisted,
+        ...info.persisted ? {} : {
+          warning: `License validated, but it could not be saved to disk (${info.persistError || "unknown error"}). It will be LOST on the next restart. Set ENV_FILE_PATH to a writable, persisted path (e.g. under DATA_ROOT) or provide PROMPTOWL_KEY via the container environment.`
+        }
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to install key";
@@ -3876,12 +5127,13 @@ function createApp() {
       users: usersRow.c
     });
   });
-  const nestsApp = new Hono8();
+  const nestsApp = new Hono9();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
     const localPath = c.req.path.replace(/^\/nests\//, "");
     const parts = localPath.split("/").filter(Boolean);
     if (parts.length < 2) return next();
+    if (parts[0] === "unsynced") return next();
     const nestId = parts[0];
     const userId = c.get("userId");
     const nestScope = c.get("nestScope");
@@ -3900,7 +5152,9 @@ function createApp() {
     }
     {
       const path2 = c.req.path;
-      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit");
+      const isCommentPath = /\/comments$/.test(path2) || /\/comments\/[^/]+\/resolve$/.test(path2);
+      const isActivityPath = /\/activity$/.test(path2);
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath;
       const needsLicense = c.req.method !== "GET" || isGovernance;
       if (needsLicense) {
         const lic = getCurrentLicense();
@@ -3927,6 +5181,8 @@ function createApp() {
     let required = "read";
     const path = c.req.path;
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
+    const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
+    const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
     if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
       return c.json(
@@ -3936,9 +5192,12 @@ function createApp() {
         403
       );
     }
-    if (path.includes("/collaborators") || path.includes("/visibility")) {
+    const resource = parts[1];
+    if (resource === "visibility") {
       required = "admin";
-    } else if (c.req.method !== "GET" && !isStewardActionPath) {
+    } else if (resource === "collaborators") {
+      required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction) {
       required = "write";
     }
     const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
@@ -3980,6 +5239,7 @@ function createApp() {
   nestsApp.route("/", nestRoutes);
   nestsApp.route("/:nestId", governanceRoutes);
   nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
+  nestsApp.route("/:nestId/nodes", annotationRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
@@ -4065,7 +5325,7 @@ function createApp() {
 
 // src/db/backfill.ts
 import { NestStorage } from "@promptowl/contextnest-engine";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var MIGRATION_ID = "005_backfill_node_versions_from_history";
 async function backfillNodeVersionsFromHistory(db) {
   const already = db.prepare("SELECT id FROM schema_migrations WHERE id = ?").get(MIGRATION_ID);
@@ -4086,7 +5346,7 @@ async function backfillNodeVersionsFromHistory(db) {
   let totalInserted = 0;
   let totalDocs = 0;
   for (const { id: nestId } of nests) {
-    const nestPath = join4(config.DATA_ROOT, "nests", nestId);
+    const nestPath = join5(config.DATA_ROOT, "nests", nestId);
     const storage = new NestStorage(nestPath);
     let docs;
     try {
@@ -4184,6 +5444,13 @@ async function main() {
        or set PROMPTOWL_KEY=pk_... in your environment and restart.
 `);
   }
+  if (config.OFFICIAL_COMMUNITY_SSO_SECRET && !config.PUBLIC_BASE_URL) {
+    console.warn(`
+      WARNING: OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is not.
+      One-click SSO will skip the audience check, weakening cross-server replay
+      protection. Set PUBLIC_BASE_URL to this server's public URL.
+    `);
+  }
   const app = createApp();
   startLicenseSafetyPoll();
   const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;