@promptowl/contextnest-community 1.24.0 → 1.25.0

package/API.md

@@ -14,6 +14,70 @@ Anonymous open mode (`AUTH_MODE=open`) bypasses auth on most read endpoints.
 
 All bodies are JSON unless noted. All errors return `{ "error": "msg" }` with appropriate HTTP status.
 
+## Caller attribution (`client`)
+
+`edited_by` names a person and a read names nobody, so neither answers *which
+agent, in which session*. Every write body below, and every MCP tool call, takes
+an optional `client` object that does ([spec §9.4](https://github.com/PromptOwl/ContextNest/blob/main/CONTEXT_NEST_SPEC.md)):
+
+```json
+{ "title": "API Design", "content": "…",
+  "client": { "agent": "claude-code", "session_id": "s-9f2", "run": 7 } }
+```
+
+- `agent` and `session_id` are reserved; any other key is custom and is recorded
+  verbatim. Values are scalars (string / number / boolean).
+- A write that creates a version records it **on that version** — it comes back
+  on `GET .../versions` and on MCP `context_versions` (in the prose and the
+  structured payload). Every path that seals a version takes it: create, edit,
+  approve, revert, and import (`POST /nests/import`, `POST /nests/unsynced/sync`,
+  which stamp every row they seed), plus `POST /review-queue/bulk`, whose one
+  block rides every approval in the batch. `POST .../submit-review` seals it
+  into the engine's own version chain (`history.yaml`), which is the entry that
+  submission appends. Every MCP tool call, and every REST
+  call that accepts `client`, records it on the activity trace
+  (`GET /admin/trace`, `GET /nests/:nestId/trace`, where it comes back as a
+  parsed `client` object) — which is where a call that seals no version is
+  attributed: a **read**, and a **rejection**, which commits no content.
+- **Entirely optional.** No endpoint requires it and an unattributed call is a
+  valid call. A call that carries none stores nothing rather than an empty
+  object — "not attributed" and "attributed to nobody" are different claims.
+- **A label, not an identity.** It is never authenticated, never used to
+  authorize, and never an input to a hash chain, so histories written before the
+  field existed keep verifying byte for byte. `editedBy` remains the
+  authoritative authoring record.
+- **Bounded**, because an untrusted caller writes it into an append-only audit
+  trail: values ≤512 chars, ≤16 custom keys, scalars only → `400` otherwise. A
+  near-miss on a reserved key (`sessionId`, `Agent`) is refused rather than
+  filed as a custom key, which would look attributed and not be.
+- The server fills what the transport already knows, **per key, under** anything
+  the caller sent. Precedence is caller > env > connection: on MCP the
+  connection means the `initialize` handshake's `clientInfo.name` and the
+  transport's session id; behind that sits the label the operator gave the API
+  key. `CONTEXTNEST_AGENT` / `CONTEXTNEST_SESSION_ID` are the env layer;
+  `CONTEXTNEST_NO_ATTRIBUTION=1` derives nothing (a `client` the caller sent
+  explicitly is still honoured). See `CONFIGURATION.md`.
+- Note the `/mcp` endpoints are **stateless** — one server per request, no
+  session issued — so a handshake's `clientInfo` is not in scope by the time a
+  tool call arrives, and `agent` comes from the key label in practice. An agent
+  that wants to name itself exactly should send `client` rather than rely on
+  what the connection happens to report.
+
+- **Treat a recorded `client` as untrusted text when you read it back.** The
+  values are whatever the caller sent, stored verbatim and unescaped by design —
+  an audit record that rewrites what the caller said is worth less than none —
+  and `context_versions` prints `agent` into the prose an LLM client reads
+  (`[via claude-code]`). That is the same standing as every other caller-written
+  string this server serves back: document titles, bodies, change notes and
+  review notes all reach an agent's context the same way. Bounds (≤512 chars,
+  scalars) cap the size, not the content. Render it as data, never as
+  instructions, and the usual rule applies to anything downstream: escape at the
+  point of use. This server's own UI does — React escapes it as a text node, and
+  nothing interpolates it into SQL (`client_json` is always a bound parameter).
+
+Distinct from `metadata`, which is frontmatter: `metadata` describes the
+document, `client` describes the call that touched it.
+
 ---
 
 ## 1. Auth
@@ -182,7 +246,7 @@ Related `/admin/settings` fields (GET/PATCH, superadmin only): `sso_token_exchan
 A nest = a context vault (folder of markdown documents + governance state).
 
 ### GET `/nests`
-Returns owned + shared nests. Archived nests are **absent** — as they are from every other listing, the work inbox, cross-nest search and the MCP index. Each row carries `pinned` — the calling user's own bookmark (see `POST /nests/:nestId/pin`).
+Returns owned + shared nests. Archived nests are **absent** — as they are from every other listing, the work inbox, cross-nest search and the MCP index. Each row carries `pinned` — the calling user's own bookmark (see `POST /nests/:nestId/pin`). Nests reachable through `org`/`public` visibility alone are included too and carry `discovered: true` (owned and shared rows carry `false`) — the dashboard's default *My nests* scope leaves them out.
 ```json
 { "nests": [{ "id": "...", "user_id": "...", "name": "...", "slug": "...", "visibility": "private", "created_at": "..." }] }
 ```
@@ -235,7 +299,8 @@ Pins are per `(user, nest)` in the `nest_pins` table and cascade with the nest.
   "stewardship_enabled": false,
   "allow_self_approve": false,
   "prime_only_review": false,
-  "prime_tags": ["prime-document"]
+  "prime_tags": ["prime-document"],
+  "creator_is_reviewer": false
 }
 ```
 
@@ -249,6 +314,7 @@ Every field is optional; only the ones present are changed.
 - `allow_self_approve` — owner/admin writes publish immediately instead of drafting.
 - `prime_only_review` — in a governed nest, only **prime** documents need approval; everything else self-publishes. Off by default.
 - `prime_tags` — tags that mark a document prime. Accepts an array or a comma-separated string; stored and returned normalized (no leading `#`, lowercased, deduped). See `STEWARDSHIP.md → Prime documents`.
+- `creator_is_reviewer` — in a governed nest, whoever creates a document becomes its document-scope `reviewer` and v1 publishes immediately; later changes go through review as usual (the creator approves teammates' changes, another reviewer approves the creator's). Prime documents still draft. Future creates only. Off by default. See `STEWARDSHIP.md → Creators review their own documents`.
 
 Turning stewardship **off** wipes stewards and pending reviews and is owner-only; the other fields are non-destructive and never change the state of anything already published.
 
@@ -264,7 +330,7 @@ Turning stewardship **off** wipes stewards and pending reviews and is owner-only
   | `public` | anyone, including anonymous callers |
   `org` and `public` readers see **approved content only** — drafts and pending versions stay with collaborators and stewards.
   Under `AUTH_MODE=open` every caller resolves to the anonymous user, so there is no "other authenticated user" for `org` to admit: on an open-mode deployment `org` behaves as `private`. Use it on a deployment with real logins.
-- **Outside-org publish guardrail.** Setting `visibility: "public"` **requires** `acknowledge_public: true` (`org` does not — it stays inside the deployment, so it crosses no organizational boundary). Without it the request is rejected `409`:
+- **Outside-org publish guardrail.** Setting `visibility: "public"` **requires** `acknowledge_public: true`. `org` does not on a single-organization server — it stays inside the deployment, so it crosses no organizational boundary. On a **shared deployment** (`SHARED_DEPLOYMENT=true` / Settings → General → *This server hosts several organizations* — the PromptOwl-hosted service) the deployment *is* several organizations, so `org` requires the same `acknowledge_public: true` and the `warning` names that boundary. Without the acknowledgement the request is rejected `409`:
   ```json
   {
     "error": "Publishing this nest requires acknowledgement.",
@@ -272,7 +338,15 @@ Turning stewardship **off** wipes stewards and pending reviews and is owner-only
     "warning": "This makes the nest readable by anyone on the internet, outside your organization."
   }
   ```
-  Going back to `private` needs no acknowledgement.
+  On a shared deployment, `org` without the acknowledgement is rejected the same way, with its own warning:
+  ```json
+  {
+    "error": "Opening this nest to the organization requires acknowledgement.",
+    "requires_acknowledgement": true,
+    "warning": "This server is shared: 'Organization' makes the nest readable by every account on this server, including other organizations — not just yours."
+  }
+  ```
+  Going back to `private` needs no acknowledgement. `GET /health` reports `shared_deployment` so a client can word its own confirmation the same way.
 
 ### PATCH `/nests/:nestId/reader-mode` (server-admin / superadmin only)
 Configure **Public Docs Reader Mode** — a clean, read-only public docs view of the nest. Superadmin-gated via `isServerAdminUserId` (license admin OR `access.yaml` super_admins ∪ the DB-granted set; the same gate as `/nests/unsynced` and `/admin/*`). A plain nest-owner/admin who is not a superadmin gets `403`.
@@ -635,7 +709,8 @@ Optional query params, applied before the per-node enrichment:
   "scope": "team",
   "status": "draft",
   "folder": "gtm/deals",
-  "schedule": "0 6 * * *"
+  "schedule": "0 6 * * *",
+  "client": { "agent": "claude-code", "session_id": "s-9f2" }
 }
 ```
 - Slug derived from title → `nodes/<slug>`.
@@ -644,6 +719,7 @@ Optional query params, applied before the per-node enrichment:
 - Optional `schedule` (free-form cron/interval string, opaque to the server) — **only valid when `type` is `agent` or `skill`**; sent on any other type → `400`. Stored in frontmatter metadata and echoed back on every node response. See [§9 `GET /runnables`](#get-nestsnestidrunnables-read).
 - Optional `prime` (boolean) flags the document as **prime** — it then always requires steward approval, whoever writes it. Owner/admin only; any other caller sending the field gets `403`. Omit to inherit from the nest's `prime_tags`; `false` exempts this document from an otherwise-prime tag. Echoed back on every node response as `prime` (absent when inherited). See `STEWARDSHIP.md → Prime documents`.
 - If stewardship enabled → status defaults `draft`. Else `approved`.
+- Optional `client` — caller attribution, recorded on the version this create seals. See [Caller attribution](#caller-attribution-client).
 - Auto-syncs tag index for steward resolution.
 
 Response (201): `{ "node": { ... }, "stewards": [...] }`.
@@ -705,10 +781,12 @@ Headers (optional): `X-Base-Version: 3` — server returns 409 on conflict.
   "content": "...",
   "tags": ["..."],
   "changeNote": "fixed typo",
-  "schedule": "0 7 * * *"
+  "schedule": "0 7 * * *",
+  "client": { "agent": "claude-code", "session_id": "s-9f2" }
 }
 ```
 Requires nest write permission.
+- `client` — caller attribution, recorded on the version this edit seals. See [Caller attribution](#caller-attribution-client).
 - `schedule` — runnable types (`agent`/`skill`) only; sent for any other type → `400`. Send `""` to clear it.
 - `type` — re-type the node in place (the editor's "Turn into…"): `document`, `artifact`, `table`, `agent`, `skill`, `tool`, or any other engine type. Same gate as create — the artifact/table feature flags and the accepted set (`400` otherwise). The body is kept as-is. Converting to `skill` defaults the trigger from the title; converting away from a runnable type drops its `schedule`.
 - `prime` — owner/admin only (`403` otherwise). `true`/`false` set the document-scope flag, `null` clears it back to tag/nest inheritance. An edit that makes the document prime is itself gated, so it lands as a draft awaiting approval.
@@ -720,6 +798,23 @@ A node with a pending review is frozen — `423` — for callers who can't clear
 
 Purges everything keyed to the node id — version history, review requests, the approved-version pin, tag index, annotations and their comments, review comments, watchers, schedules, trigger hooks, workflow edges, document-scoped stewards and document grants — and leaves a deletion tombstone for `GET /changes`. Node ids derive from titles, so a later document can land on the same id; it must inherit none of the old one's readers, reviewers or history. Run traces are kept: they record what happened, not what exists. `POST /nests/:nestId/nodes/:nodeId/move` carries that same set to the new id instead of dropping it (folder grants excepted — they cover a path prefix, so a moved doc leaves one share and joins another).
 
+### POST `/nests/:nestId/nodes/pdf`
+Upload a PDF as a governed `pdf` document. Multipart: `file` (required), optional `title` (default: the file name), `folder`, `tags` (repeat the field or comma-separate), `nodeId`, `changeNote`. Write permission (nest-scope steward editors too, as for `POST /nodes`).
+
+The engine's `context_import_pdf` extracts the text — the node body, one `<!-- page N -->` marker per page — and stores the PDF beside the node as `<id>.pdf`, bound by sha256 in the node's `pdf:` frontmatter block. Governance is exactly a create's: in a governed nest the upload lands as a draft (or publishes when a create by that person would); without stewards it publishes.
+
+- `nodeId` of an existing `pdf` node → the PDF is replaced as a **new version** of that node (same review lock, draft/publish rule and version rows as `PATCH`). The prior binary stays in history. Identical bytes are a no-op. A replace is two engine writes (stage the new PDF, then the same update/publish a text edit makes); if the second fails, the node's previous file and PDF are put back before the error is returned.
+- `400` — no `file`, not a PDF (checked by the `%PDF-` header, not the extension), an encrypted/unreadable PDF, or `nodeId` names a node that is not a pdf. `413` — larger than `PDF_MAX_MB` (default 25 MB). Nothing is written on any refusal.
+- A PDF with no text layer (a scan) imports with an empty body and `pdf.text_layer: false`; there is no OCR.
+- Returns `201` `{ node, version, stewards? }` on create, `200` `{ node, version }` on replace. `node.pdf` is the `pdf:` block (`file`, `sha256`, `bytes`, `pages`, `text_layer`, `extractor`, `extractor_version`, `extracted_at`).
+
+A pdf node's text is read-only: `PATCH` with a `content`/`append` that changes it → `409` (re-upload instead; echoing the stored body back is accepted). A pdf node can't be converted to another type or another type to `pdf` (`400`), can't be moved to another folder yet (`400`), and `POST /nodes` with `type: "pdf"` → `400`. `POST …/revert` re-imports the target version's PDF; `POST …/discard` restores the sealed version's PDF (the response carries a `warning` if that binary can't be restored); `DELETE` removes the binary with the node.
+
+### GET `/nests/:nestId/nodes/:nodeId/pdf`
+The PDF binary, gated exactly like `GET /nodes/:nodeId`. A public reader (or `?approved_only=1`) always gets the **approved** version's bytes — never a draft's — whatever version is asked for; other readers get the current working copy, or `?version=N`. Every response is verified against the sha256 its version records (a mismatch is refused, not served).
+
+Headers: `Content-Type: application/pdf`, `Content-Disposition: inline; filename="<slug>.pdf"` (`?download=1` → `attachment`), `Content-Security-Policy: sandbox`, `X-Content-Type-Options: nosniff`, `Cache-Control: private, no-cache`, and an `ETag` of the sha256 (`If-None-Match` → `304`). `404` when the node has no such version or no approved version (public). An id that is not a pdf node falls through to the node route, so a document whose own id ends in `/pdf` still reads.
+
 ### POST `/nests/:nestId/assets`
 Multipart upload (field `file`) of an image or video referenced from documents. Write permission.
 
@@ -1103,6 +1198,11 @@ Each version may also include `resolvedBy` + `resolutionStatus`, the steward who
 approved or rejected it, joined from `review_requests` (`node_versions` stores
 the status but not the resolver's email).
 
+`client` is the caller attribution the write carried — which agent, in which
+session (see [Caller attribution](#caller-attribution-client)). Absent on every
+version whose write sent none, which includes every version written before the
+field existed.
+
 `externalEditVerdicts` carries the verdicts on out-of-band (direct filesystem)
 edits, oldest first, read from the engine's append-only chain-event log. They sit
 beside the version list rather than inside it because a **rejection commits no
@@ -1127,6 +1227,7 @@ approved version.
       "status": "pending_review",
       "changeNote": "...",
       "content": "",
+      "client": { "agent": "claude-code", "session_id": "s-9f2" },
       "diff": "Index: v2\n===...\n--- v2\tv2\n+++ v2\tv3\n@@ -1,4 +1,5 @@\n title: doc\n-old line\n+new line\n"
     },
     {
@@ -1852,6 +1953,8 @@ Model Context Protocol endpoints — JSON-RPC over HTTP. Not exercised manually;
 
 **Denials are JSON-RPC.** Gate rejections on the MCP transport path return a JSON-RPC error envelope — `{ "jsonrpc": "2.0", "id": <echoed>, "error": { "code": -32000, "message": "<what failed — actionable reason>" } }` — instead of plain `{error}` JSON, so external clients (PromptOwl, Claude Desktop, Cursor) surface *why* a connection failed: key scoped to a different nest, server suspended, license required, or nest not found / no access.
 
+**Every tool takes `client`.** The `{ agent, session_id, …custom }` block described in [Caller attribution](#caller-attribution-client) is advertised on every tool's input schema, reads included — a write that seals a version records it there (`context_versions` serves it back), and every call records it on the activity trace. It is never authenticated and never used to authorize. Omitted, the server fills what the connection reports (the API key's label, an `Mcp-Session-Id` header) under anything the caller sent, per key.
+
 **Titles are unique on this surface.** `context_get`, `context_update`, `context_versions`, `context_delete`, and `context_move` each resolve a document by title or by id (an id wins when both are sent, and an ambiguous title refuses rather than guessing). Title addressing is what makes uniqueness matter, so `context_create` refuses a title already used anywhere in the nest — including in another folder — and answers with the existing node's id plus what to do instead (`context_update` to change it, `context_move` to refile it). A duplicate would otherwise be unreachable by every tool here. REST `POST /nodes` keeps the looser rule (same title in a different folder is fine); both surfaces refuse a create whose id is already taken.
 
 **`context_search` is the REST search.** The tool runs the same index-backed match as `GET /nests/:id/search` — terms against the cached discovery set (title, body, type, tags), title hits first — and gates the *hits* with the same `filterAccessible` rule (public readers: approved-only; governed nests: steward coverage or a share grant), so the two surfaces return the same documents in the same order. It takes an optional `limit` (default 20, max 200) and answers `{ results, count }`: `count` is everything found, `results` the first `limit` hits, each with its LLM-visible body (approved version under stewardship; a hit with no approved version yet is listed but carries no body). It used to resolve every document's gated body *before* matching — one permission lookup plus one version reconstruction per node — which is what timed out `ctx search --vault <remote>` on large governed nests.

package/CONFIGURATION.md

@@ -60,7 +60,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `MANUAL_SIGN_IN` | `open` | Email + password sign-in mode. `open` = anyone may log in and self-register a new account; `invite-only` = existing/invited users may log in but brand-new self-registration returns `403` (the admin provisions accounts via invite/share/steward and shares the password — there is no self-service "set password", which would be account takeover without email verification); `disabled` = no email/password sign-in at all (`POST /auth/login` and `POST /auth/register` return `403`). Independent of `PROMPTOWL_SIGN_IN_GATE`, so the two methods are controlled separately (e.g. `invite-only` manual + `admin-only` PromptOwl). Also settable from Settings → General. The server refuses `disabled` while PromptOwl sign-in is also `disabled` (that would leave no way to log in). Unknown values fall back to `open`. |
 | `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Legacy — official deployment only, leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. Superseded by the DB-backed **Settings → Community sites** list (`/admin/community-sites`), which supports multiple official sites each with their own name/url/secret/active flag — this env var still works as an implicit extra site for backward compatibility. When no site is configured (env var unset and no DB rows), `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. See `API.md → Community sites`. |
-| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — whenever a ticket-signing secret is set (`OFFICIAL_COMMUNITY_SSO_SECRET` on the official deployment, `MCP_SIGNING_SECRET` on a self-hosted one); with neither set no ticket verifies at all, so the audience check is moot. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever email- or invite-gated publish links are used.** The magic link mailed by `POST /p/:slug/gate` is built from it; unset, it falls back to the request origin, so a proxy forwarding an attacker-supplied `Host` would send the recipient a one-time access token pointing at the attacker's domain — the classic reset-link poisoning. (4) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — whenever a ticket-signing secret is set (`OFFICIAL_COMMUNITY_SSO_SECRET` on the official deployment, `MCP_SIGNING_SECRET` on a self-hosted one); with neither set no ticket verifies at all, so the audience check is moot. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever email- or invite-gated publish links are used.** The magic link mailed by `POST /p/:slug/gate` is built from it; unset, it falls back to the request origin, so a proxy forwarding an attacker-supplied `Host` would send the recipient a one-time access token pointing at the attacker's domain — the classic reset-link poisoning. (4) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. (5) It is rendered into the copy-paste setup snippets on **Settings → Connecting agents** — a `bash` block and quoted strings in `config.toml` / `config.yaml` / `mcp.json`. Because those are pasted verbatim into other people's terminals, `PATCH /admin/settings` refuses a value that is not a plain `http(s)` URL, or that contains whitespace, quotes or shell characters (`" ' ` \ $ ; | & < > ( ) { }`). A value stored before that check is not rewritten, so re-save it if the panel shows it oddly. |
 | `OIDC_ENABLED` | `false` | Turn on generic OIDC single sign-on (`GET /auth/oidc/login` / `GET /auth/oidc/callback`). Requires `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET` — the login-page button only appears once all three are set. Also editable from Settings → Single sign-on. See [Single sign-on (OIDC)](#single-sign-on-oidc). |
 | `OIDC_ISSUER` | `""` | OIDC issuer URL, e.g. `https://login.microsoftonline.com/<tenant>/v2.0` (Microsoft Entra ID) or `https://accounts.google.com` (Google). **`https://` only** — a non-https value is rejected with a warning and SSO stays off. Must serve `<issuer>/.well-known/openid-configuration`. |
 | `OIDC_CLIENT_ID` | `""` | Application (client) ID from your IdP app registration. |
@@ -68,6 +68,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `OIDC_ALLOWED_DOMAINS` | `""` (any) | Comma-separated email-domain allowlist, e.g. `acme.com, contractors.acme.com`. When set, only accounts whose asserted email is on a listed domain may sign in (others bounce with `domain_not_allowed`). Empty allows any domain the IdP asserts. |
 | `OIDC_AUTO_PROVISION` | `true` | Create a user automatically on first successful OIDC sign-in (display name from the `name` claim). Set `false` to allow only pre-existing (invited/registered) users — unknown emails bounce with `not_invited`. |
 | `PEOPLE_SUGGEST_ALL_USERS` | `false` | Widen the add-a-person suggestions (`GET /people/suggest`, behind every "add a person" field) and the `@mention` pickers from *people the caller already shares a nest or team with* to **every registered account on this server**. **Leave this off on a server that hosts more than one organisation** — the PromptOwl-hosted deployment does, and turning it on there would offer one customer's staff another customer's email addresses. On a single-company self-hosted server the whole directory is the useful answer, which is what this is for. Suggestions never gate the invite either way: an address that appears in no list is still valid to type. In the `@` pickers the widening is an invite: a write+ author mentioning someone off the nest adds them as a `read` collaborator before notifying (a read-only author's mention of an outsider reaches nobody). A server admin always sees every account (they administer them). Also editable from **Settings → General → People directory**. |
+| `SHARED_DEPLOYMENT` | `false` | This server hosts **several unrelated organizations** (the PromptOwl-hosted deployment) rather than one company. A nest's `org` visibility means *every authenticated account on this deployment* — on a single-company self-hosted server that is the organization, so the tier flips in one click; on a shared server it is every customer. With this on: `PATCH /nests/:id/visibility` to `org` requires `acknowledge_public: true` exactly as `public` always does (enforced by the server, not only the UI), and the UI's visibility picker confirms before *Organization* and words both tiers to say who they really reach. Reported on `GET /health` as `shared_deployment`. Also editable from **Settings → General → This server hosts several organizations**. **Turning it on guards future changes only** — nests already at `org` stay readable by every account until their admins reconfirm or narrow them. On an already-populated server, audit them first: the dashboard's *Organization* scope lists every one, or `SELECT id, name, user_id FROM nests WHERE visibility = 'org'`. |
 | `OIDC_DEPARTMENT_TAGGING` | `false` | Auto-tag newly **created** documents with the creator's directory department: `dept:<slugified-department>` (lowercase, spaces → dashes, e.g. `dept:customer-success`) is appended to the document's tags, deduped against user-supplied tags. Applies on create only — never on update, never retroactively — and a user without a stored department is a silent no-op. The department is captured from the OIDC `department` ID-token claim on every SSO login (a login without the claim clears it, so directory moves propagate), so this is only meaningful when your IdP emits that claim — see [Department auto-tagging](#department-auto-tagging). Also editable from Settings → Single sign-on. |
 | `SSO_TOKEN_EXCHANGE_ENABLED` | `false` | Master switch for `POST /auth/token-exchange` — an external agent exchanges an IdP ID token for a short-lived MCP bearer. Also needs `MCP_SIGNING_SECRET` and at least one provider; otherwise the endpoint returns `404`. Security-critical — see [Agent SSO (token exchange)](#agent-sso-token-exchange). |
 | `MCP_SIGNING_SECRET` | `""` | HMAC secret **this** server signs its minted MCP bearers with (distinct from `OFFICIAL_COMMUNITY_SSO_SECRET`, so self-hosted deployments can issue their own). Long random string. `/index` and `/mcp` accept a ticket signed with either secret. Write-only on the Settings API. **Clearing it is the revocation switch** — turning `SSO_TOKEN_EXCHANGE_ENABLED` off stops minting but already-minted bearers stay valid until they expire. |
@@ -81,10 +82,14 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `POSTHOG_HOST` | `https://us.i.posthog.com` | PostHog ingestion host. Set it to your own region or self-hosted PostHog. Also editable from Settings → Advanced. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `DRIFT_SCAN_INTERVAL_MS` | `30000` (30 s) | How often the drift scanner walks every nest for files edited outside the app (external edits) and stages them as suggestions for review. Set `0` to disable — do this on a GCS FUSE or other network mount, where the walk is slow and costly. Unset, empty or non-numeric falls back to the default. |
+| `CONTEXTNEST_AGENT` | `""` | Overrides the `agent` this server derives for caller attribution (`client`, spec §9.4) when a call sends none of its own. Without it the name comes from the MCP `initialize` handshake's `clientInfo.name` when the connection reports one, else the label of the API key the call authenticated with. A caller's own `client.agent` always wins. |
+| `CONTEXTNEST_SESSION_ID` | `""` | Same, for `session_id` — otherwise the MCP transport's session id, or an `Mcp-Session-Id` request header when the client sends one. Left absent when nothing reports one: the `/mcp` endpoints are stateless and issue no session, and a placeholder would be indistinguishable from a real id. |
+| `CONTEXTNEST_NO_ATTRIBUTION` | `""` | Set to `1` to derive nothing at all. What this server derives lands in an append-only version history, so an operator who does not want an agent's name recorded there permanently needs to say so before the first write. A `client` the caller sent explicitly is still recorded — that is the caller's own record to make. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `FRAME_ANCESTORS` | `'self'` | Which origins may embed this server in an iframe, sent as CSP `frame-ancestors`. The default lets nothing but this origin frame the UI, which blocks clickjacking. Deployments that are meant to be embedded list the embedding origin — e.g. the PromptOwl Data Room iframes ContextNest, so that install sets `FRAME_ANCESTORS="https://app.promptowl.ai"`. Comma-separated; `'self'` is always included; `*` allows any site and disables the protection. Note the embedding page must be **same-site** (a sibling subdomain) for the session cookie to survive inside the frame — a genuinely cross-domain embed will render the login page no matter what this is set to. |
-| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below. |
+| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below, and the PDF upload route (`POST /nests/:id/nodes/pdf`) up to `PDF_MAX_MB`. |
 | `VIDEO_MAX_MB` | `30` | Max size (in MB) of a video uploaded into a doc. Default `30` keeps it under Cloud Run's ~32 MiB HTTP/1 request-body limit, so an oversized video is rejected with a clear message instead of a bare `413` from the platform. Raise only where the deployment can actually accept larger request bodies (not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload). Images are fixed at 10 MB. |
+| `PDF_MAX_MB` | `25` | Max size (in MB) of a PDF uploaded as a `pdf` document (`POST /nests/:id/nodes/pdf`). A larger file is refused with `413` and nothing is written. Default `25` keeps the request under Cloud Run's ~32 MiB HTTP/1 limit; raise it only where the deployment accepts larger request bodies. The PDF route is exempt from `MAX_BODY_BYTES` up to this cap. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 | `PROMPTOWL_TEAMS_ENABLED` | _(unset — off)_ | Lets users who signed in with PromptOwl import their PromptOwl teams as local teams. Off by default; set `true` to enable, or toggle from Settings → Advanced. When off, `GET/POST /teams/promptowl` return `404` and the PromptOwl Teams panel is hidden. Independent of `PROMPTOWL_SIGN_IN_GATE`. |
 | `TYPE_ARTIFACT_ENABLED` | `true` | Set `false` to disable creation of **artifact** nodes server-wide (existing artifact nodes stay readable — never data loss). Runnable types (agent/skill/tool) are gated by `FEATURE_WORKFLOW_PLANE`, not here. Also editable from Settings (`/admin/settings`). |

package/README.md

@@ -134,7 +134,7 @@ Keys are minted in the app (Workspace → API keys, or the Connect dialog) — o
 | Custom logo / branding | ✅ | ✅ |
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload, YouTube / Vimeo embeds | ✅ | ✅ |
 | Folder organization — nested folders, move documents, lazy folder tree | ✅ | ✅ |
 | Scales to large vaults — nest listings served from a document index, not a disk crawl | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |

package/STEWARDSHIP.md

@@ -90,6 +90,30 @@ Prime documents carry a **Prime** badge in the nest's document list, with a tool
 
 Flipping any of this only affects **future** writes. Marking a published document prime doesn't unpublish it; the next edit is what needs approval.
 
+## Creators review their own documents (`creator_is_reviewer`)
+
+A per-nest flag (**off** by default; nest Settings → "Creators review their own documents") for the GitHub posture: anyone with write access creates documents, and the person who created a document is the one who approves changes to it.
+
+When it's on, creating a document in a governed nest does two things:
+
+1. **The author is stewarded as a document-scope `reviewer`** of that document — exactly the row an admin would otherwise add by hand (`POST /nests/:id/stewards` with `scope: "document"`, or the `documents:` section of `stewards.yaml`). The nest owner is skipped; they already approve everything.
+2. **The first version publishes immediately.** The author is the document's reviewer, so nobody else needs to bless v1. This holds for the owner too: with this on, the owner's own new documents publish at v1 whether or not `allow_self_approve` is on — the two settings are independent, and this one only ever touches v1.
+
+The row is written **before** the publish decision, so v1 only publishes when the author really can approve the next change. If a document-scope row for the author already exists on that id with a lesser role (an admin stewarded the id ahead of time), it is left alone and v1 lands as a draft instead. If the row can't be written, the create fails with nothing written.
+
+Everything after v1 is the ordinary review cycle, and separation of duties is untouched:
+
+| | Who approves |
+|---|---|
+| A teammate edits the document | The creator (plus any tag- or nest-level reviewer, and admins) |
+| The creator edits their own document | Another reviewer — the creator can't approve their own submission |
+
+**Prime wins.** A prime document still lands as a draft: its creator is made its reviewer, but someone else has to approve the first version.
+
+Only **future** creates are affected. Turning it on doesn't steward anyone on existing documents, and turning it off leaves every steward row it created in place — remove them from the Stewards tab like any other. Every create surface participates (the editor, the REST and MCP APIs, and `ctx push` — the pusher authored what they pushed); the derived annotations document is the one exception, since nobody authored it.
+
+Like prime, this only applies to **governed** nests. With stewardship off there is nothing to review, so the flag is inert until you turn stewardship on.
+
 ## Who sees what
 
 Governance gates two things: who can **approve**, and who can **read**.

package/dist/{chunk-2TPQTN4Y.js → chunk-2KHM5C7V.js}

@@ -1,5 +1,6 @@
 import {
   buildTitleMap,
+  canApproveWith,
   canEditWith,
   canViewWith,
   collabPermToRole,
@@ -12,16 +13,16 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-KIAAEHWL.js";
+} from "./chunk-7FROMOZM.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-JDAOA5KP.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -283,6 +284,38 @@ async function createStewardRecord(params) {
   }
   return results;
 }
+async function stewardDocumentCreator(nestId, nodeId, userEmail) {
+  const email = userEmail.trim().toLowerCase();
+  if (!email) return { canApprove: false };
+  const ownerEmail = (await getNestOwnerEmail(nestId) || "").toLowerCase();
+  if (email === ownerEmail) return { canApprove: true };
+  const row = {
+    nestId,
+    scope: "document",
+    nodePattern: nodeId,
+    userEmail: email,
+    userId: await userIdForEmail(email),
+    role: "reviewer",
+    assignedBy: email,
+    assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    isActive: true
+  };
+  try {
+    const created = await assignSteward(row);
+    return { canApprove: true, insertedId: created.id };
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+  }
+  return {
+    canApprove: canApproveWith(
+      await resolveUserRoles(nestId, email, { nodeId })
+    )
+  };
+}
+function isUniqueViolation(err) {
+  const code = err?.code;
+  return code === "SQLITE_CONSTRAINT_UNIQUE" || code === "23505";
+}
 async function resolveStewardsForNode(nestId, nodeId) {
   return (await resolve(nestId, nodeId)).stewards;
 }
@@ -638,6 +671,7 @@ export {
   getStewardsForScope,
   listStewards,
   createStewardRecord,
+  stewardDocumentCreator,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   getStewardRolesForUser,

package/dist/{chunk-XUIWAWDO.js → chunk-32SZCH36.js}

@@ -6,10 +6,10 @@ import {
   markIndexStale,
   resolveNestPath,
   syncSuggestionRows
-} from "./chunk-KIAAEHWL.js";
+} from "./chunk-7FROMOZM.js";
 import {
   getDb
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-JDAOA5KP.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -83,7 +83,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-KIOQME6U.js");
+  const { hasUnsealedDraft } = await import("./version-service-X4FAG2OZ.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -254,7 +254,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-KIOQME6U.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-X4FAG2OZ.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{chunk-KIAAEHWL.js → chunk-7FROMOZM.js}

@@ -3,12 +3,12 @@ import {
   ForbiddenError,
   NotFoundError,
   ValidationError
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-JDAOA5KP.js";
 import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
@@ -2066,6 +2066,21 @@ async function setPrimeOnlyReview(nestId, enabled) {
     nestId
   ]);
 }
+async function nestCreatorIsReviewer(nestId) {
+  const db = getDb();
+  const row = await db.get(
+    "SELECT creator_is_reviewer FROM nests WHERE id = ?",
+    [nestId]
+  );
+  return !!row?.creator_is_reviewer;
+}
+async function setCreatorIsReviewer(nestId, enabled) {
+  const db = getDb();
+  await db.run("UPDATE nests SET creator_is_reviewer = ? WHERE id = ?", [
+    enabled ? 1 : 0,
+    nestId
+  ]);
+}
 async function nestPrimeTags(nestId) {
   const db = getDb();
   const row = await db.get("SELECT prime_tags FROM nests WHERE id = ?", [
@@ -2622,8 +2637,8 @@ async function ensureNodeIndex(nestId) {
   return run;
 }
 async function rebuildNodeIndex(nestId) {
-  const { engineCache: engineCache2 } = await import("./engine-S3QBQ7LH.js");
-  const { documentsWithSuggestions } = await import("./external-edit-service-6FNFPOJJ.js");
+  const { engineCache: engineCache2 } = await import("./engine-TER6FDBP.js");
+  const { documentsWithSuggestions } = await import("./external-edit-service-CAGENHDJ.js");
   const { storage, dropDiscoveryCache } = await engineCache2.get(nestId);
   dropDiscoveryCache();
   const startedAt = writeGeneration.get(nestId) ?? 0;
@@ -2869,7 +2884,8 @@ var engineCache = new NestEngineCache();
 var engineApi = createEngineApi();
 async function opContext(nestId, actor, onProgress) {
   const { storage, query, versions } = await engineCache.get(nestId);
-  return { storage, query, versions, actor, onProgress };
+  const limits = { pdfMaxBytes: config.PDF_MAX_BYTES };
+  return { storage, query, versions, actor, onProgress, limits };
 }
 
 export {
@@ -2917,6 +2933,8 @@ export {
   setAllowSelfApprove,
   nestReviewsPrimeOnly,
   setPrimeOnlyReview,
+  nestCreatorIsReviewer,
+  setCreatorIsReviewer,
   nestPrimeTags,
   setPrimeTags,
   disableStewardshipAndWipeGovernance,

package/dist/{chunk-5EZOPA47.js → chunk-DTLMBF4W.js}

@@ -4,19 +4,19 @@ import {
   resolveNestWideRoles,
   resolveStewardsForNode,
   stewardCoverageForUser
-} from "./chunk-2TPQTN4Y.js";
+} from "./chunk-2KHM5C7V.js";
 import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-I3CSD6CK.js";
+} from "./chunk-KPGNZLZL.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-ZTT4U4NE.js";
+} from "./chunk-TI7HMP64.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -37,16 +37,16 @@ import {
   resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-KIAAEHWL.js";
+} from "./chunk-7FROMOZM.js";
 import {
   ConflictError,
   NotFoundError,
   ValidationError
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
 import {
   config,
   getDb
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-JDAOA5KP.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -788,7 +788,8 @@ async function submitForReview(params) {
         );
         if (!alreadySealed) {
           await versionManager.createVersion(node, params.requestedBy, {
-            note: params.note || "Submitted for review"
+            note: params.note || "Submitted for review",
+            ...params.client ? { client: params.client } : {}
           });
         }
       } catch (err) {
@@ -955,7 +956,8 @@ async function approve(params) {
           author: params.approvedBy,
           status: "published",
           tags,
-          changeNote: note
+          changeNote: note,
+          client: params.client
         });
         await setApprovedVersion(
           params.nestId,

package/dist/{chunk-LA3VTQ22.js → chunk-JDAOA5KP.js}

@@ -356,6 +356,22 @@ var config = {
   get PEOPLE_SUGGEST_ALL_USERS() {
     return process.env.PEOPLE_SUGGEST_ALL_USERS === "true";
   },
+  /**
+   * This server hosts several unrelated organizations (the PromptOwl-hosted
+   * deployment) rather than one company (a self-hosted install).
+   *
+   * OFF BY DEFAULT. Nest visibility 'org' means "every authenticated account
+   * on this deployment" (src/shared/access.ts) — on a single-company server
+   * that IS the organization, so the tier is safe to flip in one click. On a
+   * shared server it is every customer, so with this on: flipping a nest to
+   * 'org' needs the same explicit acknowledgement 'public' always needs
+   * (PATCH /nests/:id/visibility 409s without it — the server enforces it, not only the UI), and
+   * the UI words both tiers to say so. Exposed on /health as
+   * `shared_deployment`. Superadmin-togglable at runtime via /admin/settings.
+   */
+  get SHARED_DEPLOYMENT() {
+    return process.env.SHARED_DEPLOYMENT === "true";
+  },
   /**
    * Path to the .env file the server reads its config from and the license
    * install flow persists PROMPTOWL_KEY into. Defaults UNDER DATA_ROOT (not
@@ -640,6 +656,17 @@ var config = {
   get VIDEO_MAX_BYTES() {
     const mb = parseInt(process.env.VIDEO_MAX_MB || "30", 10);
     return (Number.isFinite(mb) && mb > 0 ? mb : 30) * 1024 * 1024;
+  },
+  /**
+   * Max PDF upload size in bytes (POST /nests/:id/nodes/pdf). Default 25 MB —
+   * under Cloud Run's 32 MiB HTTP/1 request-body limit, with room for the
+   * multipart framing, so an oversized PDF is refused by our own check (413
+   * with a clear message) rather than by the platform. Read per request, so a
+   * change takes effect without a restart. Override via PDF_MAX_MB.
+   */
+  get PDF_MAX_BYTES() {
+    const mb = parseInt(process.env.PDF_MAX_MB || "25", 10);
+    return (Number.isFinite(mb) && mb > 0 ? mb : 25) * 1024 * 1024;
   }
 };
 
@@ -828,6 +855,9 @@ function runMigrations(db) {
   if (!nestCols.includes("prime_tags")) {
     db.exec("ALTER TABLE nests ADD COLUMN prime_tags TEXT NOT NULL DEFAULT 'prime-document'");
   }
+  if (!nestCols.includes("creator_is_reviewer")) {
+    db.exec("ALTER TABLE nests ADD COLUMN creator_is_reviewer INTEGER NOT NULL DEFAULT 0");
+  }
   if (!nestCols.includes("index_synced_at")) {
     db.exec("ALTER TABLE nests ADD COLUMN index_synced_at TEXT");
   }
@@ -1781,6 +1811,18 @@ function runMigrations(db) {
       recordMigration("043_node_suggestion_details");
     })();
   }
+  if (!hasMigration("044_client_attribution")) {
+    for (const [table, col] of [
+      ["node_versions", "client_json"],
+      ["api_events", "client_json"]
+    ]) {
+      const cols = db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+      if (cols.length && !cols.includes(col)) {
+        db.exec(`ALTER TABLE ${table} ADD COLUMN ${col} TEXT`);
+      }
+    }
+    recordMigration("044_client_attribution");
+  }
 }
 function fkViolationCounts(db) {
   const rows = db.pragma("foreign_key_check");
@@ -2055,7 +2097,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-AIQ7WSU7.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-23VJJJJX.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);

package/dist/{chunk-I3CSD6CK.js → chunk-KPGNZLZL.js}

@@ -1,9 +1,9 @@
 import {
   ValidationError
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
 import {
   getDb
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-JDAOA5KP.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";