@promptowl/contextnest-community 1.21.0 → 1.22.0

package/CONFIGURATION.md

@@ -76,6 +76,8 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to an optional `.env` file the server reads at boot (in addition to `$cwd/.env`). **No longer used for persistence** — the License Setup Page and Settings page now write to the database, not this file (see [Runtime settings persistence](#runtime-settings-persistence)). Kept for operators who bootstrap config from a mounted `.env`. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
+| `POSTHOG_KEY` | `""` | PostHog project API key for product analytics in the UI. Empty = analytics off (the default — a self-hosted install brings its own project). Served to the browser via `/health`, but only while `TELEMETRY_ENABLED` is on, so that switch turns off everything this server sends outward. Also editable from Settings → Advanced. |
+| `POSTHOG_HOST` | `https://us.i.posthog.com` | PostHog ingestion host. Set it to your own region or self-hosted PostHog. Also editable from Settings → Advanced. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `FRAME_ANCESTORS` | `'self'` | Which origins may embed this server in an iframe, sent as CSP `frame-ancestors`. The default lets nothing but this origin frame the UI, which blocks clickjacking. Deployments that are meant to be embedded list the embedding origin — e.g. the PromptOwl Data Room iframes ContextNest, so that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`. Comma-separated; `'self'` is always included; `*` allows any site and disables the protection. Note the embedding page must be **same-site** (a sibling subdomain) for the session cookie to survive inside the frame — a genuinely cross-domain embed will render the login page no matter what this is set to. |

package/dist/{adapter.postgres-YOODX2BI.js → adapter.postgres-6VZCMPQL.js}

@@ -5,7 +5,17 @@ function translatePlaceholders(sql) {
   let n = 0;
   for (let i = 0; i < sql.length; i++) {
     const ch = sql[i];
-    if (ch === "'") {
+    if (!inStr && ch === "-" && sql[i + 1] === "-") {
+      const end = sql.indexOf("\n", i);
+      const stop = end === -1 ? sql.length : end;
+      out += sql.slice(i, stop);
+      i = stop - 1;
+    } else if (!inStr && ch === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      const stop = end === -1 ? sql.length : end + 2;
+      out += sql.slice(i, stop);
+      i = stop - 1;
+    } else if (ch === "'") {
       inStr = !inStr;
       out += ch;
     } else if (ch === "?" && !inStr) {

package/dist/{chunk-IGPJ74O4.js → chunk-6WESEA75.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import {
   getDb
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-LPPKPEYI.js → chunk-J2OQ3MEB.js}

@@ -351,6 +351,19 @@ var config = {
   get TELEMETRY_INTERVAL_MS() {
     return parseInt(process.env.TELEMETRY_INTERVAL_MS || "3600000", 10);
   },
+  /**
+   * PostHog product analytics. Empty key = off, which is the default: a
+   * self-hosted operator brings their own project. The key is a public client
+   * key by design (the browser sends it), so /health may hand it out — but
+   * only while TELEMETRY_ENABLED is on, so one switch stops all outbound
+   * usage data. Editable at runtime from the admin Settings page.
+   */
+  get POSTHOG_KEY() {
+    return (process.env.POSTHOG_KEY || "").trim();
+  },
+  get POSTHOG_HOST() {
+    return (process.env.POSTHOG_HOST || "").trim() || "https://us.i.posthog.com";
+  },
   /**
    * Activity-trace retention window in days (the api_events table behind
    * GET /admin/trace and GET /nests/:id/trace). 0 = keep forever (pruning is
@@ -626,7 +639,7 @@ function runMigrations(db) {
       slug TEXT NOT NULL,
       description TEXT,
       visibility TEXT NOT NULL DEFAULT 'private'
-        CHECK(visibility IN ('private', 'public')),
+        CHECK(visibility IN ('private', 'org', 'public')),
       created_at TEXT NOT NULL DEFAULT (datetime('now')),
       UNIQUE(user_id, slug)
     );
@@ -1702,6 +1715,67 @@ function runMigrations(db) {
     })();
     recordMigration("039_nest_pins");
   }
+  if (!hasMigration("041_nest_visibility_org")) {
+    widenNestVisibilityWithGuard(db);
+    recordMigration("041_nest_visibility_org");
+  }
+}
+function fkViolationCounts(db) {
+  const rows = db.pragma("foreign_key_check");
+  const counts = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const key = `${r.table}|${r.parent}|${r.fkid}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return counts;
+}
+function widenNestVisibilityWithGuard(db) {
+  const before = fkViolationCounts(db);
+  const fkWasOn = db.pragma("foreign_keys", { simple: true }) === 1;
+  if (fkWasOn) db.pragma("foreign_keys = OFF");
+  try {
+    db.transaction(() => {
+      widenNestVisibilityCheck(db);
+    })();
+    const after = fkViolationCounts(db);
+    const introduced = [...after].filter(
+      ([key, n]) => n > (before.get(key) ?? 0)
+    );
+    if (introduced.length > 0) {
+      throw new Error(
+        `041_nest_visibility_org introduced foreign-key violations: ${introduced.map(([key]) => key).join(", ")}`
+      );
+    }
+  } finally {
+    if (fkWasOn) db.pragma("foreign_keys = ON");
+  }
+}
+function widenNestVisibilityCheck(db) {
+  const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'nests'").get();
+  const ddl = row?.sql;
+  if (!ddl) return;
+  const checkRe = /CHECK\s*\(\s*visibility\s+IN\s*\([^)]*\)\s*\)/i;
+  const current = ddl.match(checkRe);
+  if (!current) return;
+  if (/'org'/i.test(current[0])) return;
+  const newDdl = ddl.replace(
+    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`\[]?nests["'`\]]?/i,
+    "CREATE TABLE nests_new"
+  ).replace(checkRe, "CHECK(visibility IN ('private', 'org', 'public'))");
+  if (!newDdl.startsWith("CREATE TABLE nests_new")) {
+    throw new Error("041: could not rewrite the nests CREATE TABLE statement");
+  }
+  const cols = db.prepare("PRAGMA table_info(nests)").all().map((c) => `"${c.name}"`).join(", ");
+  const indexes = db.prepare(
+    "SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'nests' AND sql IS NOT NULL"
+  ).all().map((r) => `${r.sql};`);
+  db.exec(`
+    ${newDdl};
+    INSERT INTO nests_new (${cols}) SELECT ${cols} FROM nests;
+    DROP TABLE nests;
+    ALTER TABLE nests_new RENAME TO nests;
+    ${indexes.join("\n    ")}
+  `);
 }
 function mergeCaseCollidingUsers(db) {
   const groups = db.prepare(
@@ -1918,8 +1992,8 @@ async function initDb() {
   if (adapter) return adapter;
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
-    const { PostgresAdapter } = await import("./adapter.postgres-YOODX2BI.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-JA2YGLS3.js");
+    const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-KKICIH2C.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-XWGEXQU3.js → chunk-MY4JIWQD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-YVMSM7LS.js";
 import {
   getDb
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-4KJGQHWB.js → chunk-OQXZ43HG.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-N2DTJFCD.js";
+} from "./chunk-PX3P4FTU.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-XWGEXQU3.js";
+} from "./chunk-MY4JIWQD.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-IGPJ74O4.js";
+} from "./chunk-6WESEA75.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -36,7 +36,7 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import {
   ConflictError,
   NotFoundError,
@@ -45,7 +45,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -131,7 +131,17 @@ async function nodeTrail(db, nestId, ids) {
     for (const r of rows) if (r.title) titles.set(r.node_id, r.title);
   } catch {
   }
-  return ids.map((id) => `"${titles.get(id) ?? id}"`).join(" \u2192 ");
+  const label = (id) => titles.get(id) ?? id;
+  const idsPerLabel = /* @__PURE__ */ new Map();
+  for (const id of unique) {
+    const l = label(id);
+    (idsPerLabel.get(l) ?? idsPerLabel.set(l, /* @__PURE__ */ new Set()).get(l)).add(id);
+  }
+  return ids.map((id) => {
+    const l = label(id);
+    const ambiguous = (idsPerLabel.get(l)?.size ?? 0) > 1;
+    return ambiguous && l !== id ? `"${l}" (${id})` : `"${l}"`;
+  }).join(" \u2192 ");
 }
 async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   const db = getDb();
@@ -147,7 +157,7 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   for (const r of rows) {
     if (r.from_node === r.to_node) {
       throw new ConflictError(
-        `cycle: ${await nodeTrail(db, nestId, [r.from_node])} cannot flow into itself`
+        `This step loops back on itself: ${await nodeTrail(db, nestId, [r.from_node])}. A flow can't return to a step it already ran.`
       );
     }
     nodes.add(r.from_node);
@@ -170,7 +180,7 @@ async function assertFlowGraphAcyclic(nestId, extraFlowTypeId) {
   }
   if (removed < nodes.size) {
     throw new ConflictError(
-      "cycle: enabling flow on this edge type would create a cycle in the flow graph \u2014 flow edges must form a DAG"
+      "Making this connection type a flow would loop these steps back on each other. A flow can't return to a step it already ran."
     );
   }
 }

package/dist/{chunk-N2DTJFCD.js → chunk-PX3P4FTU.js}

@@ -11,7 +11,7 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import {
   ConflictError,
   ValidationError
@@ -20,7 +20,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-6JGQX4GA.js → chunk-W5ILNGPD.js}

@@ -8,7 +8,7 @@ import {
   config,
   getDb,
   isEmailish
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -1879,8 +1879,9 @@ async function resolveNestAccessRaw(nestId, userId) {
     return { ...base, permission: best, isPublicReader: false };
   }
   if (base.isSteward) best = higher(best, "read");
-  if (row.visibility === "public") best = higher(best, "read");
-  const isPublicReader2 = row.visibility === "public" && !row.collab_permission && !base.isSteward;
+  const visibilityRead = row.visibility === "public" || row.visibility === "org" && userId !== ANON_USER_ID;
+  if (visibilityRead) best = higher(best, "read");
+  const isPublicReader2 = visibilityRead && !row.collab_permission && !base.isSteward;
   return { ...base, permission: best, isPublicReader: isPublicReader2 };
 }
 async function resolveNestPermission(nestId, userId) {
@@ -2309,11 +2310,13 @@ async function listSharedNests(userId) {
 async function listVisibleNests(userId, opts = {}) {
   const db = getDb();
   const includeAnon = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  const visibleByVisibility = userId === ANON_USER_ID ? ["public"] : ["public", "org"];
   const params = [
     userId,
     userId,
     ...opts.readable ? [userId] : [],
     userId,
+    ...opts.readable ? visibleByVisibility : [],
     ...includeAnon ? [ANON_USER_ID] : []
   ];
   const rows = await db.all(
@@ -2329,7 +2332,7 @@ async function listVisibleNests(userId, opts = {}) {
         AND (n.user_id = ?
          OR nc.user_id IS NOT NULL
          OR s.id IS NOT NULL
-         ${opts.readable ? "OR g.id IS NOT NULL OR n.visibility = 'public'" : ""}
+         ${opts.readable ? `OR g.id IS NOT NULL OR n.visibility IN (${visibleByVisibility.map(() => "?").join(", ")})` : ""}
          ${includeAnon ? "OR n.user_id = ?" : ""})
       ORDER BY n.created_at DESC`,
     params
@@ -2345,9 +2348,10 @@ async function listVisibleNests(userId, opts = {}) {
 }
 async function listPublicNests(userId) {
   const db = getDb();
+  const visibilities = userId === ANON_USER_ID ? ["public"] : ["public", "org"];
   return await db.all(
     `SELECT n.* FROM nests n
-       WHERE n.visibility = 'public'
+       WHERE n.visibility IN (${visibilities.map(() => "?").join(", ")})
          AND ${LIVE_ONLY_N}
          AND n.user_id != ?
          AND NOT EXISTS (
@@ -2355,7 +2359,7 @@ async function listPublicNests(userId) {
            WHERE nc.nest_id = n.id AND nc.user_id = ?
          )
        ORDER BY n.created_at DESC`,
-    [userId, userId]
+    [...visibilities, userId, userId]
   );
 }
 async function getNest(nestId) {
@@ -2587,8 +2591,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-IKZQ46P7.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-LTON57HO.js");
+  const { engineCache: engineCache2 } = await import("./engine-XKRP7GOQ.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-TXW7SXSF.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;

package/dist/{chunk-6PJQSKKV.js → chunk-ZAV4QUZA.js}

@@ -5,10 +5,10 @@ import {
   markIndexStale,
   resolveNestPath,
   setSuggestionFlag
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import {
   getDb
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -82,7 +82,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-PJV74PVQ.js");
+  const { hasUnsealedDraft } = await import("./version-service-TKNYJMCM.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -259,7 +259,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-PJV74PVQ.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-TKNYJMCM.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{client-BD6PAUCZ.js → client-CSCHXUNX.js}

@@ -2,7 +2,7 @@ import {
   getDb,
   initDb,
   resetDb
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 export {
   getDb,

package/dist/{engine-IKZQ46P7.js → engine-XKRP7GOQ.js}

@@ -2,9 +2,9 @@ import {
   engineApi,
   engineCache,
   opContext
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{external-edit-service-LTON57HO.js → external-edit-service-TXW7SXSF.js}

@@ -11,10 +11,10 @@ import {
   scanNestForDrift,
   startDriftScanner,
   stopDriftScanner
-} from "./chunk-6PJQSKKV.js";
-import "./chunk-6JGQX4GA.js";
+} from "./chunk-ZAV4QUZA.js";
+import "./chunk-W5ILNGPD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{grants-service-LSNZN6NG.js → grants-service-UZ2MGDO5.js}

@@ -6,9 +6,9 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-XWGEXQU3.js";
+} from "./chunk-MY4JIWQD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 export {
   createGrant,

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-4KJGQHWB.js";
+} from "./chunk-OQXZ43HG.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -57,7 +57,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-N2DTJFCD.js";
+} from "./chunk-PX3P4FTU.js";
 import {
   createGrant,
   deleteGrant,
@@ -66,7 +66,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-XWGEXQU3.js";
+} from "./chunk-MY4JIWQD.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -92,7 +92,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-IGPJ74O4.js";
+} from "./chunk-6WESEA75.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -104,7 +104,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-6PJQSKKV.js";
+} from "./chunk-ZAV4QUZA.js";
 import {
   addMember,
   addWatcher,
@@ -208,7 +208,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-6JGQX4GA.js";
+} from "./chunk-W5ILNGPD.js";
 import {
   AppError,
   ConflictError,
@@ -226,7 +226,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-LPPKPEYI.js";
+} from "./chunk-J2OQ3MEB.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -4147,8 +4147,8 @@ sharingRoutes.delete("/collaborators/:collabId", async (c) => {
 });
 sharingRoutes.patch("/visibility", async (c) => {
   const body = await c.req.json();
-  if (!body.visibility || !["private", "public"].includes(body.visibility)) {
-    throw new ValidationError("visibility must be private or public");
+  if (!body.visibility || !["private", "org", "public"].includes(body.visibility)) {
+    throw new ValidationError("visibility must be private, org or public");
   }
   if (body.visibility === "public" && body.acknowledge_public !== true) {
     return c.json(
@@ -5817,7 +5817,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-2YKGBP63.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-5HBQGDMK.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -5838,7 +5838,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-6JK64IRT.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-XFWTENTN.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -7859,7 +7859,7 @@ async function validateCondition(nestId, mode, condition) {
 async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
   if (fromNode === toNode) {
     throw new ConflictError(
-      `cycle: ${await nodeTrail(db, nestId, [fromNode])} cannot flow into itself`
+      `This step loops back on itself: ${await nodeTrail(db, nestId, [fromNode])}. A flow can't return to a step it already ran.`
     );
   }
   const rows = await db.all(
@@ -7888,7 +7888,7 @@ async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
       }
       path.reverse().push(toNode);
       throw new ConflictError(
-        `cycle: ${await nodeTrail(db, nestId, path)} \u2014 flow edges must form a DAG`
+        `These steps loop back on each other: ${await nodeTrail(db, nestId, path)}. A flow can't return to a step it already ran.`
       );
     }
     for (const nb of adj.get(cur) ?? []) {
@@ -9927,8 +9927,8 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-LSNZN6NG.js");
-        const db = (await import("./client-BD6PAUCZ.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-UZ2MGDO5.js");
+        const db = (await import("./client-CSCHXUNX.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
@@ -13013,6 +13013,11 @@ function createApp() {
       // Presence only: the publish dialog hides the email/invite gates when
       // this server cannot send mail, because their only way in is a mailed link.
       email_configured: isEmailConfigured(),
+      // Product analytics for the SPA. The PostHog project key is a public
+      // client key, but it only ships while usage telemetry is on — one switch
+      // covers everything this server sends outward.
+      posthog_key: config.TELEMETRY_ENABLED ? config.POSTHOG_KEY || null : null,
+      posthog_host: config.POSTHOG_HOST,
       promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
       // Manual (email/password) sign-in mode (open | invite-only | disabled).
       // The login page reads this to show/hide the credential form, and to
@@ -13137,6 +13142,8 @@ function createApp() {
     manual_sign_in: config.MANUAL_SIGN_IN,
     logo_url: config.LOGO_URL,
     telemetry_enabled: config.TELEMETRY_ENABLED,
+    posthog_key: config.POSTHOG_KEY,
+    posthog_host: config.POSTHOG_HOST,
     public_base_url: config.PUBLIC_BASE_URL,
     max_body_bytes: config.MAX_BODY_BYTES,
     workflow_plane_enabled: config.FEATURE_WORKFLOW_PLANE,
@@ -13235,6 +13242,16 @@ function createApp() {
     if ("telemetry_enabled" in body) {
       pending.push({ name: "TELEMETRY_ENABLED", value: body.telemetry_enabled ? "true" : "false" });
     }
+    if ("posthog_key" in body) {
+      const v = String(body.posthog_key ?? "").trim();
+      pending.push({ name: "POSTHOG_KEY", value: v || null });
+    }
+    if ("posthog_host" in body) {
+      const v = String(body.posthog_host ?? "").trim().replace(/\/$/, "");
+      if (v && !/^https?:\/\/[^\s]+$/i.test(v))
+        addError("posthog_host", "PostHog host must be a http(s) URL, e.g. https://us.i.posthog.com");
+      else pending.push({ name: "POSTHOG_HOST", value: v || null });
+    }
     if ("workflow_plane_enabled" in body) {
       pending.push({
         name: "FEATURE_WORKFLOW_PLANE",

package/dist/{migrations.postgres-JA2YGLS3.js → migrations.postgres-KKICIH2C.js}

@@ -47,7 +47,8 @@ var HISTORICAL_MIGRATIONS = [
   "036_node_index",
   "037_publish",
   "038_nest_archive",
-  "039_nest_pins"
+  "039_nest_pins",
+  "041_nest_visibility_org"
 ];
 async function runPostgresMigrations(db) {
   await db.exec(`
@@ -74,7 +75,7 @@ async function runPostgresMigrations(db) {
       slug TEXT NOT NULL,
       description TEXT,
       visibility TEXT NOT NULL DEFAULT 'private'
-        CHECK(visibility IN ('private', 'public')),
+        CHECK(visibility IN ('private', 'org', 'public')),
       created_at TEXT NOT NULL DEFAULT ${NOW},
       stewardship_enabled INTEGER NOT NULL DEFAULT 0,
       is_imported INTEGER NOT NULL DEFAULT 0,
@@ -695,6 +696,20 @@ async function runPostgresMigrations(db) {
       [id]
     );
   }
+  const visibilityCheck = await db.get(
+    `SELECT pg_get_constraintdef(oid) AS def
+       FROM pg_constraint
+      WHERE conrelid = 'nests'::regclass
+        AND conname = 'nests_visibility_check'`
+  );
+  if (!visibilityCheck?.def?.includes("'org'")) {
+    await db.run(
+      "ALTER TABLE nests DROP CONSTRAINT IF EXISTS nests_visibility_check"
+    );
+    await db.run(
+      "ALTER TABLE nests ADD CONSTRAINT nests_visibility_check CHECK (visibility IN ('private', 'org', 'public'))"
+    );
+  }
   await db.run(
     "UPDATE nests SET visibility = 'public' WHERE user_id = ? AND visibility = 'private'",
     [ANON_USER_ID]

package/dist/{review-service-6JK64IRT.js → review-service-XFWTENTN.js}

@@ -17,15 +17,15 @@ import {
   requestDeletion,
   submitForReview,
   withdrawDeletionRequest
-} from "./chunk-4KJGQHWB.js";
+} from "./chunk-OQXZ43HG.js";
 import {
   canUserApprove
-} from "./chunk-N2DTJFCD.js";
-import "./chunk-XWGEXQU3.js";
-import "./chunk-IGPJ74O4.js";
-import "./chunk-6JGQX4GA.js";
+} from "./chunk-PX3P4FTU.js";
+import "./chunk-MY4JIWQD.js";
+import "./chunk-6WESEA75.js";
+import "./chunk-W5ILNGPD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{stewardship-service-2YKGBP63.js → stewardship-service-5HBQGDMK.js}

@@ -23,10 +23,10 @@ import {
   syncFromConfig,
   updateSteward,
   updateStewardRole
-} from "./chunk-N2DTJFCD.js";
-import "./chunk-6JGQX4GA.js";
+} from "./chunk-PX3P4FTU.js";
+import "./chunk-W5ILNGPD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {

package/dist/{version-service-PJV74PVQ.js → version-service-TKNYJMCM.js}

@@ -20,10 +20,10 @@ import {
   setApprovedVersion,
   systemAuthor,
   upsertVersion
-} from "./chunk-IGPJ74O4.js";
-import "./chunk-6JGQX4GA.js";
+} from "./chunk-6WESEA75.js";
+import "./chunk-W5ILNGPD.js";
 import "./chunk-YVMSM7LS.js";
-import "./chunk-LPPKPEYI.js";
+import "./chunk-J2OQ3MEB.js";
 import "./chunk-YB3LKF7U.js";
 import "./chunk-FRQJWGN3.js";
 export {