@promptowl/contextnest-community 1.24.0 → 1.26.0

package/dist/index.js

@@ -38,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-5EZOPA47.js";
+} from "./chunk-M6PGYMBD.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -56,9 +56,10 @@ import {
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   resolveUserRoles,
+  stewardDocumentCreator,
   syncFromConfig,
   updateSteward
-} from "./chunk-2TPQTN4Y.js";
+} from "./chunk-DGPTJXIV.js";
 import {
   createGrant,
   deleteGrant,
@@ -67,21 +68,16 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-I3CSD6CK.js";
-import {
-  generateApiKey,
-  getKeyPrefix,
-  hashApiKey,
-  hashPassword,
-  parseBearerToken,
-  verifyKeyRequest,
-  verifyPassword
-} from "./chunk-F66VCBLA.js";
+} from "./chunk-RPGFHESR.js";
 import {
+  attributeRequest,
   checkConflict,
+  clientToolField,
+  connectionClient,
   createVersion,
   deleteSupersededDrafts,
   deleteUnsealedVersions,
+  deserializeClient,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
@@ -91,9 +87,12 @@ import {
   getTrackedNodeIds,
   getVersions,
   listMyDrafts,
+  mergeClient,
+  parseClientMetadata,
+  serializeClient,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-ZTT4U4NE.js";
+} from "./chunk-IEAWRHMV.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -105,7 +104,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-XUIWAWDO.js";
+} from "./chunk-2QOJE7A5.js";
 import {
   addMember,
   addWatcher,
@@ -113,10 +112,7 @@ import {
   assertSafeNodeId,
   buildDocContext,
   buildTitleMap,
-  canApproveWith,
-  canEditWith,
   capForArchive,
-  collabPermToRole,
   createNest,
   createTeam,
   deleteNest,
@@ -139,7 +135,6 @@ import {
   insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
-  isEmailConfigured,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
   isNestArchived,
@@ -162,6 +157,7 @@ import {
   loadServerSettings,
   markNotificationsRead,
   nestAllowsSelfApprove,
+  nestCreatorIsReviewer,
   nestName,
   nestPrimeTags,
   nestReviewsPrimeOnly,
@@ -177,7 +173,6 @@ import {
   persistSetting,
   pinNest,
   pinnedNestIds,
-  primaryRole,
   readIndexedNodes,
   rebuildNodeIndex,
   removeMember,
@@ -193,8 +188,8 @@ import {
   resolveNodeUrl,
   resolveTeamRolesForUser,
   restoreNest,
-  sendEmailToRecipient,
   setAllowSelfApprove,
+  setCreatorIsReviewer,
   setPrimeOnlyReview,
   setPrimeTags,
   setReaderMode,
@@ -209,27 +204,48 @@ import {
   unpinNest,
   unshareTeamFromNest,
   updateMemberRole,
-  validateLicense,
-  verifySmtp
-} from "./chunk-KIAAEHWL.js";
+  validateLicense
+} from "./chunk-SWA5M5XX.js";
 import {
   AppError,
   ConflictError,
   ForbiddenError,
   LockedError,
   NotFoundError,
+  PayloadTooLargeError,
   UnauthorizedError,
   ValidationError,
   VaultBusyError,
   isVaultLockTimeout
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
+import {
+  createInvitedUser,
+  findOrCreateInvitedUser,
+  generateApiKey,
+  getKeyPrefix,
+  hashApiKey,
+  hashPassword,
+  parseBearerToken,
+  verifyKeyRequest,
+  verifyPassword
+} from "./chunk-PICUHQEM.js";
+import {
+  canApproveWith,
+  canEditWith,
+  collabPermToRole,
+  isEmailConfigured,
+  primaryRole,
+  sendEmailToRecipient,
+  transportSettings,
+  verifyEmailTransport
+} from "./chunk-I5EDEZBQ.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-TRSGPS27.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -243,9 +259,9 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono27 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
-import { createMiddleware as createMiddleware2 } from "hono/factory";
+import { createMiddleware as createMiddleware3 } from "hono/factory";
 import { cors } from "hono/cors";
 
 // src/shared/artifact-sandbox.ts
@@ -430,7 +446,7 @@ var authMiddleware = createMiddleware(async (c, next) => {
   if (key) {
     const keyHash = hashApiKey(key);
     const record = await db.get(
-      "SELECT user_id, nest_id FROM api_keys WHERE key_hash = ?",
+      "SELECT user_id, nest_id, label FROM api_keys WHERE key_hash = ?",
       [keyHash]
     );
     if (record) {
@@ -440,10 +456,104 @@ var authMiddleware = createMiddleware(async (c, next) => {
       );
       c.set("userId", record.user_id);
       c.set("nestScope", record.nest_id);
+      if (record.label) c.set("apiKeyLabel", record.label);
       return next();
     }
   }
-  return c.json({ error: "Missing or invalid credentials" }, 401);
+  if (sessionId) {
+    return c.json(
+      { error: "Your session has expired \u2014 sign in again.", code: "session_expired" },
+      401
+    );
+  }
+  if (key) {
+    return c.json(
+      { error: "This API key is invalid or has been revoked \u2014 generate a new one.", code: "invalid_key" },
+      401
+    );
+  }
+  return c.json(
+    { error: "Authentication required \u2014 sign in or provide an API key.", code: "missing_credentials" },
+    401
+  );
+});
+
+// src/auth/nest-scope-guard.ts
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+var NEST_SCOPED_KEY_CODE = "nest_scoped_key";
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/health",
+  "/license/status",
+  "/llms.txt",
+  "/auth/admin-status"
+]);
+function segmentMatches(seg, nestId) {
+  if (seg === nestId) return true;
+  try {
+    return decodeURIComponent(seg) === nestId;
+  } catch {
+    return false;
+  }
+}
+function nestKeyVerdict(method, rawPath, scope) {
+  const path = rawPath.length > 1 ? rawPath.replace(/\/+$/, "") : rawPath;
+  const isGet = method === "GET" || method === "HEAD";
+  if (PUBLIC_PATHS.has(path) && isGet) return { allowed: true };
+  if (path === "/mcp") return { allowed: true };
+  if (path === "/index" && isGet) return { allowed: true };
+  if ((path === "/search" || path === "/stats" || path === "/nests") && isGet) {
+    return { allowed: true };
+  }
+  if (path.startsWith("/runs/")) return { allowed: true };
+  const m = /^\/nests\/([^/]+)(\/.*)?$/.exec(path);
+  if (m) {
+    if (segmentMatches(m[1], scope)) return { allowed: true };
+    return {
+      allowed: false,
+      reason: "other_nest",
+      mcpTransport: m[2] === "/mcp"
+    };
+  }
+  return { allowed: false, reason: "outside_nest" };
+}
+async function bearerKeyScope(authorization) {
+  const key = parseBearerToken(authorization);
+  if (!key) return null;
+  const row = await getDb().get(
+    "SELECT nest_id FROM api_keys WHERE key_hash = ?",
+    [hashApiKey(key)]
+  );
+  return row?.nest_id ?? null;
+}
+var nestScopedKeyGuard = createMiddleware2(async (c, next) => {
+  const scope = await bearerKeyScope(c.req.header("Authorization"));
+  if (!scope) return next();
+  const verdict = nestKeyVerdict(c.req.method, c.req.path, scope);
+  if (verdict.allowed) return next();
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId && await resolveSession(sessionId)) return next();
+  if (verdict.reason === "other_nest") {
+    const error = `API key not authorized for this nest \u2014 this key is scoped to nest "${scope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`;
+    if (verdict.mcpTransport) {
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message: error } },
+        403
+      );
+    }
+    return c.json({ error, code: NEST_SCOPED_KEY_CODE }, 403);
+  }
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't reach account-wide or server-wide routes (API keys, admin, teams, people, your inbox). Use a key for all your nests for those.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
 });
 
 // src/shared/rate-limit.ts
@@ -1283,7 +1393,7 @@ authRoutes.post("/register", async (c) => {
   if (config.MANUAL_SIGN_IN !== "open") {
     return c.json(
       {
-        error: "Self-registration is disabled on this server. If you were invited, use \u201CSet your password\u201D to activate your account. Otherwise ask your admin for an invite."
+        error: "Self-registration is disabled on this server. If you were invited, sign in with the temporary password from your invite email, or continue with PromptOwl using that email. Otherwise ask your admin for an invite."
       },
       403
     );
@@ -1310,7 +1420,7 @@ authRoutes.post("/register", async (c) => {
     if (existing.is_invited === 1) {
       return c.json(
         {
-          error: "You've been invited to this server. Ask your admin for your temporary password, then sign in and change it \u2014 you can't set it here."
+          error: "You've been invited to this server. Sign in with the temporary password from your invite email, or continue with PromptOwl using this email. Your admin can reset the password if you don't have it."
         },
         409
       );
@@ -1407,10 +1517,36 @@ authRoutes.post("/logout", async (c) => {
   );
   return c.json({ ok: true });
 });
+function refuseNestScopedCaller(c) {
+  if (!c.get("nestScope")) return null;
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't create, rotate, list or revoke API keys. Use a key for all your nests, or the web app.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
+}
+async function checkKeyNest(userId, nestId) {
+  if (typeof nestId !== "string" || !nestId.trim()) {
+    return { error: "nest_id must be a nest id.", status: 400 };
+  }
+  const row = await getDb().get("SELECT id FROM nests WHERE id = ?", [nestId]);
+  const reachable = !!row && (config.AUTH_MODE === "open" || await resolveNestPermission(nestId, userId) !== "none");
+  if (!reachable) {
+    return {
+      error: "Nest not found \u2014 you can only scope a key to a nest you have access to.",
+      status: 404
+    };
+  }
+  return null;
+}
 authRoutes.post("/keys", authMiddleware, async (c) => {
   const body = await c.req.json().catch(
     () => ({})
   );
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1418,6 +1554,10 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     label: body.label
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
+  if (body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   await db.run(
@@ -1432,12 +1572,20 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     ]
   );
   return c.json(
-    { id: keyId, api_key: apiKey, key_prefix: getKeyPrefix(apiKey), label: check.label },
+    {
+      id: keyId,
+      api_key: apiKey,
+      key_prefix: getKeyPrefix(apiKey),
+      label: check.label,
+      nest_id: body.nest_id || null
+    },
     201
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const body = await c.req.json().catch(() => ({}));
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1447,6 +1595,10 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
+  if ("nest_id" in body && body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
@@ -1479,10 +1631,13 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
     id: keyId,
     api_key: apiKey,
     key_prefix: getKeyPrefix(apiKey),
-    label: check.label ?? prior.label
+    label: check.label ?? prior.label,
+    nest_id: nestScope
   });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, { action: "fetch" });
@@ -1494,6 +1649,8 @@ authRoutes.get("/keys", authMiddleware, async (c) => {
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1877,47 +2034,30 @@ authRoutes.post("/invite", async (c) => {
     "SELECT id, email, is_invited FROM users WHERE LOWER(email) = ?",
     [email]
   );
-  if (existing && existing.is_invited === 0) {
+  if (existing) {
     return c.json(
       {
-        error: "A user with this email already exists. Use Reset password to issue them a new password."
+        error: existing.is_invited === 0 ? `${email} is already a member of this server.` : `${email} is already invited but hasn't signed in yet. Use Reset password on their row to issue a new temporary password.`
       },
       409
     );
   }
-  const tempPassword = uuid4().replace(/-/g, "").slice(0, 16);
-  const passwordHash = await hashPassword(tempPassword);
-  let userId;
-  if (existing) {
-    userId = existing.id;
-    await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
-      passwordHash,
-      userId
-    ]);
-  } else {
-    userId = uuid4();
-    await db.run(
-      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-      [userId, email, null, passwordHash]
-    );
-  }
-  trackEvent("admin.invite", { adminId: callerId, email });
   const inviter = await db.get("SELECT email FROM users WHERE id = ?", [
     callerId
   ]);
-  void sendEmailToRecipient(email, {
-    status: "invited",
-    docTitle: "ContextNest",
-    path: "",
-    actor: email,
-    by: inviter?.email || void 0,
-    tempPassword,
-    link: requestBaseUrl(c.req.url)
+  const { id: userId, tempPassword } = await createInvitedUser(email, {
+    invitedBy: inviter?.email,
+    baseUrl: requestBaseUrl(c.req.url)
   });
+  trackEvent("admin.invite", { adminId: callerId, email });
   return c.json(
     {
       temporary_password: tempPassword,
       user: { id: userId, email },
+      // PromptOwl sign-in only counts as an option for them when it's open to all.
+      promptowl_sign_in: config.PROMPTOWL_SIGN_IN_GATE === "open",
+      // Email is configured, so the invite email (with this password) went out.
+      emailed: isEmailConfigured(),
       message: "Share this temporary password securely. Your teammate signs in with their email + this password, then can change it and create their own API key."
     },
     201
@@ -1945,7 +2085,12 @@ authRoutes.get("/teammates", async (c) => {
   const teammates = await db.all(
     `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
-         (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
+         -- Latest of API-key use and web-session activity (same text format).
+         (SELECT MAX(t) FROM (
+            SELECT last_used_at AS t FROM api_keys WHERE user_id = u.id
+            UNION ALL
+            SELECT last_seen_at FROM sessions WHERE user_id = u.id
+          ) activity) as last_active
        FROM users u
        WHERE u.id != ?
        ORDER BY u.created_at DESC`,
@@ -1986,7 +2131,9 @@ import {
   DocumentNotFoundError,
   NODE_TYPES,
   TAG_PATTERN,
-  generateIndexMd
+  generateIndexMd,
+  readPdfBinary,
+  pdfSidecarPath
 } from "@promptowl/contextnest-engine";
 import { rename, mkdir, rm, stat } from "fs/promises";
 import { dirname, join } from "path";
@@ -2566,8 +2713,20 @@ var ACCEPTED_NODE_TYPES = /* @__PURE__ */ new Set([
   ...NODE_TYPES,
   ...RUNNABLE_NODE_TYPES,
   "artifact",
-  "table"
+  "table",
+  "pdf"
 ]);
+var PDF_NODE_TYPE = "pdf";
+var PDF_UPLOAD_HINT = "upload the file to POST /nests/:nestId/nodes/pdf (the Upload PDF action)";
+function pdfEngineError(err) {
+  const code = err?.code;
+  const message = err?.message || "The PDF could not be imported.";
+  if (code === "VALIDATION_FAILED" || code === "INVALID_DOCUMENT_ID") {
+    return new ValidationError(message);
+  }
+  if (code === "DOCUMENT_ALREADY_EXISTS") return new ConflictError(message);
+  return err;
+}
 function assertAcceptedType(type) {
   if (type === "artifact" && !config.TYPE_ARTIFACT_ENABLED) {
     throw new ValidationError("Artifact nodes are disabled on this server");
@@ -2581,6 +2740,13 @@ function assertAcceptedType(type) {
     );
   }
 }
+function assertUpdatableType(storedType) {
+  const type = storedType || "document";
+  if (ACCEPTED_NODE_TYPES.has(type)) return;
+  throw new ValidationError(
+    `node has legacy type "${type}" which this server no longer accepts; include "type": "<accepted type>" in the same PATCH to migrate it (allowed: ${[...ACCEPTED_NODE_TYPES].sort().join(", ")})`
+  );
+}
 function toNodeResponse(node) {
   const fm = node.frontmatter;
   const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
@@ -2605,7 +2771,8 @@ function toNodeResponse(node) {
     // Same YAML-coercion rule as title above: `schedule: 123` parses as a
     // number — normalize to string at the API boundary.
     schedule: fm.metadata?.schedule != null ? String(fm.metadata.schedule) : void 0,
-    prime: documentPrimeFlag(fm.metadata)
+    prime: documentPrimeFlag(fm.metadata),
+    ...fm.type === "pdf" && fm.pdf ? { pdf: fm.pdf } : {}
   };
 }
 async function resolveAuthorship(nestId, nodes) {
@@ -2881,7 +3048,7 @@ async function vaultFolderPaths(nestId, opts = {}) {
   });
   return entries.map(
     (e) => prefix && e.path.startsWith(`${prefix}/`) ? e.path.slice(prefix.length + 1) : e.path
-  ).filter(Boolean);
+  ).filter((p) => p && !(!prefix && (p === "assets" || p.startsWith("assets/"))));
 }
 async function listNestFolders(nestId, opts = {}) {
   if (opts.folder !== void 0) assertSafeFolder(opts.folder);
@@ -2998,9 +3165,11 @@ async function assertMayFlagPrime(nestId, userEmail) {
     );
   }
 }
-async function autoPublishReason(nestId, userEmail, doc) {
-  if (!await isStewardshipEnabled(nestId)) return "no stewards configured";
+async function autoPublishReason(nestId, userEmail, doc, opts = {}) {
+  const governed = opts.governed ?? await isStewardshipEnabled(nestId);
+  if (!governed) return "no stewards configured";
   if (await isPrimeDocument(nestId, doc.tags, doc.metadata)) return null;
+  if (opts.creatorReviews) return "creator is the document's reviewer";
   if (await nestReviewsPrimeOnly(nestId)) {
     return "prime-only review, document is not prime";
   }
@@ -3030,8 +3199,14 @@ async function createNodeOnce(nestId, input, userEmail, opts = {}) {
     id = `${prefix}${slug || await generatedSlug(storage, prefix)}`;
   }
   const tags = requireTags(input.tags);
-  const requestedType = input.type || "document";
+  const requestedType = input.pdf ? input.type || PDF_NODE_TYPE : input.type || "document";
   assertAcceptedType(requestedType);
+  if (requestedType === PDF_NODE_TYPE && !input.pdf) {
+    throw new ValidationError(`PDF documents can't be created from text \u2014 ${PDF_UPLOAD_HINT}.`);
+  }
+  if (input.pdf && requestedType !== PDF_NODE_TYPE) {
+    throw new ValidationError(`a PDF upload creates a "pdf" node, not "${requestedType}"`);
+  }
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
       `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
@@ -3076,42 +3251,85 @@ async function createNodeOnce(nestId, input, userEmail, opts = {}) {
       ...input.schedule ? { schedule: input.schedule } : {},
       ...input.prime === void 0 ? {} : { prime: input.prime }
     };
-    const publishReason = await autoPublishReason(nestId, userEmail, {
-      tags,
-      metadata
-    });
-    const publishNote = publishReason === null ? void 0 : `Auto-published on create (${publishReason})`;
-    let published = publishReason !== null;
+    const governed = await isStewardshipEnabled(nestId);
+    const creatorReviews = opts.creatorReviews !== false && governed && await nestCreatorIsReviewer(nestId);
+    const creatorSteward = creatorReviews ? await stewardDocumentCreator(nestId, id, userEmail) : null;
+    let published = false;
+    let publishNote;
     try {
-      await engineApi.run(
-        "context_create",
-        {
-          id,
-          title: input.title,
-          content: input.content,
-          type: requestedType,
-          // A skill node is invalid without a skill block, and this surface has
-          // no field for one — default the trigger from the title, same as the
-          // CLI and mcp-server do.
-          ...requestedType === "skill" ? { trigger: `when asked to ${input.title.toLowerCase()}` } : {},
-          ...tags.length ? { tags } : {},
-          ...input.status ? { status: input.status } : {},
-          metadata,
-          publish: published,
-          ...publishNote ? { note: publishNote } : {}
-        },
-        await opContext(nestId, userEmail)
+      const publishReason = await autoPublishReason(
+        nestId,
+        userEmail,
+        { tags, metadata },
+        { creatorReviews: creatorSteward?.canApprove === true, governed }
       );
-    } catch (err) {
-      let onDisk = true;
+      publishNote = publishReason === null ? void 0 : `Auto-published on create (${publishReason})`;
+      published = publishReason !== null;
       try {
-        await storage.readDocument(id);
-      } catch {
-        onDisk = false;
+        if (input.pdf) {
+          try {
+            await engineApi.run(
+              "context_import_pdf",
+              {
+                id,
+                title: input.title,
+                bytes_base64: Buffer.from(input.pdf.bytes).toString("base64"),
+                ...input.pdf.filename ? { filename: input.pdf.filename } : {},
+                ...tags.length ? { tags } : {},
+                publish: published,
+                ...publishNote ? { note: publishNote } : {},
+                ...input.client ? { client: input.client } : {}
+              },
+              await opContext(nestId, userEmail)
+            );
+          } catch (err) {
+            throw pdfEngineError(err);
+          }
+        } else {
+          await engineApi.run(
+            "context_create",
+            {
+              id,
+              title: input.title,
+              content: input.content,
+              type: requestedType,
+              // A skill node is invalid without a skill block, and this surface
+              // has no field for one — default the trigger from the title, same
+              // as the CLI and mcp-server do.
+              ...requestedType === "skill" ? { trigger: `when asked to ${input.title.toLowerCase()}` } : {},
+              ...tags.length ? { tags } : {},
+              ...input.status ? { status: input.status } : {},
+              metadata,
+              publish: published,
+              ...publishNote ? { note: publishNote } : {}
+            },
+            await opContext(nestId, userEmail)
+          );
+        }
+      } catch (err) {
+        let onDisk = true;
+        try {
+          await storage.readDocument(id);
+        } catch {
+          onDisk = false;
+        }
+        if (!onDisk) throw err;
+        console.error("publishDocument failed (node create auto-publish)", err);
+        published = false;
+      }
+    } catch (err) {
+      if (creatorSteward?.insertedId) {
+        try {
+          await removeSteward(creatorSteward.insertedId);
+        } catch (cleanupErr) {
+          console.error(
+            "removeSteward failed while compensating a failed create",
+            id,
+            cleanupErr
+          );
+        }
       }
-      if (!onDisk) throw err;
-      console.error("publishDocument failed (node create auto-publish)", err);
-      published = false;
+      throw err;
     }
     const node = await storage.readDocument(id);
     await syncNodeTags(nestId, id, tags);
@@ -3126,7 +3344,8 @@ async function createNodeOnce(nestId, input, userEmail, opts = {}) {
         author: userEmail,
         status: "published",
         tags,
-        changeNote: publishNote
+        changeNote: publishNote,
+        client: input.client
       });
       await setApprovedVersion(nestId, id, savedVersion, userEmail);
     } else {
@@ -3134,10 +3353,12 @@ async function createNodeOnce(nestId, input, userEmail, opts = {}) {
         nestId,
         nodeId: id,
         version: 1,
-        content: input.content,
+        // A pdf node's body is what the engine extracted, not anything sent.
+        content: input.pdf ? node.body || "" : input.content,
         author: userEmail,
         status: "draft",
-        tags
+        tags,
+        client: input.client
       });
     }
     await trackEvent("node.create", { nestId, nodeId: id });
@@ -3191,7 +3412,7 @@ async function alignOnDiskStatus(nestId, documentId, status) {
     );
   }
 }
-async function registerImportedDocuments(nestId, userEmail) {
+async function registerImportedDocuments(nestId, userEmail, client) {
   const startedAt = Date.now();
   const tracked = await getTrackedNodeIds(nestId);
   (await engineCache.get(nestId)).invalidateDiscovery();
@@ -3221,7 +3442,8 @@ async function registerImportedDocuments(nestId, userEmail) {
       author: userEmail,
       status: d.status,
       changeNote: d.status === "published" ? "Imported from existing folder" : "Imported from existing folder \u2014 could not be published, kept as a draft",
-      tags
+      tags,
+      client
     });
     if (d.status === "published") {
       await setApprovedVersion(nestId, d.id, d.version, userEmail);
@@ -3243,6 +3465,44 @@ async function registerImportedDocuments(nestId, userEmail) {
   await trackEvent("nest.import.documents", { nestId, registered: docs.length });
   return docs.length;
 }
+async function stagePdfImport(nestId, nodeId, pdf, userEmail, client, priorRaw) {
+  const { storage } = await engineCache.get(nestId);
+  const sidecar = pdfSidecarPath(nodeId);
+  let priorSidecar = null;
+  try {
+    priorSidecar = await storage.readVaultBinary(sidecar);
+  } catch {
+  }
+  const sealedBefore = await storage.maxRecordedVersion(nodeId);
+  const rollback = async () => {
+    if (await storage.maxRecordedVersion(nodeId).catch(() => sealedBefore) > sealedBefore) {
+      return;
+    }
+    try {
+      await storage.writeDocument(nodeId, priorRaw);
+      if (priorSidecar) await storage.writeVaultBinary(sidecar, priorSidecar);
+      await storage.regenerateIndex();
+    } catch (err) {
+      console.error("[pdf] could not roll back a failed PDF replace", nestId, nodeId, err);
+    }
+  };
+  try {
+    const result = await engineApi.run(
+      "context_import_pdf",
+      {
+        id: nodeId,
+        bytes_base64: Buffer.from(pdf.bytes).toString("base64"),
+        ...pdf.filename ? { filename: pdf.filename } : {},
+        publish: false,
+        ...client ? { client } : {}
+      },
+      await opContext(nestId, userEmail)
+    );
+    return { unchanged: result.unchanged === true, rollback };
+  } catch (err) {
+    throw pdfEngineError(err);
+  }
+}
 async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
   return withNodeWriteLock(nodeWriteKey(nestId, nodeId), async () => {
     try {
@@ -3255,6 +3515,35 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
       } catch {
         throw new NotFoundError(`Node not found: ${nodeId}`);
       }
+      const priorRaw = node.rawContent;
+      let pdfRollback = null;
+      if (patch.type === void 0 || patch.type === node.frontmatter.type) {
+        assertUpdatableType(node.frontmatter.type);
+      }
+      const storedType = node.frontmatter.type || "document";
+      const isPdfNode = storedType === PDF_NODE_TYPE;
+      if (patch.pdf && !isPdfNode) {
+        throw new ValidationError(
+          `${nodeId} is a "${storedType}" node, not a PDF \u2014 a PDF can only replace the PDF of a pdf node.`
+        );
+      }
+      if (patch.type !== void 0 && patch.type !== storedType) {
+        if (isPdfNode || patch.type === PDF_NODE_TYPE) {
+          throw new ValidationError(
+            isPdfNode ? "A PDF document can't be converted to another type \u2014 its body is the text of its PDF." : `A document can't be converted to a PDF \u2014 ${PDF_UPLOAD_HINT}.`
+          );
+        }
+      }
+      if (isPdfNode) {
+        const readOnly = "This is a PDF document: its text is extracted from the PDF and can't be edited directly. Upload a new version of the PDF (Replace PDF) to change it.";
+        if (patch.append) throw new ConflictError(readOnly);
+        if (patch.content !== void 0) {
+          if (patch.content.trim() !== (node.body || "").trim()) {
+            throw new ConflictError(readOnly);
+          }
+          patch = { ...patch, content: void 0 };
+        }
+      }
       const previousBody = node.body || "";
       const opInput = {};
       if (patch.content !== void 0) {
@@ -3350,11 +3639,30 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
       if (publishReason === null || isAuthorEditingOwnReview) {
         const currentVersion = await getCurrentVersion(nestId, nodeId);
         const newVersion = await versionManager.nextVersion(nodeId, currentVersion);
-        await engineApi.run(
-          "context_update",
-          { id: nodeId, ...opInput, publish: false, version: newVersion },
-          await opContext(nestId, userEmail)
-        );
+        if (patch.pdf) {
+          const staged = await stagePdfImport(
+            nestId,
+            nodeId,
+            patch.pdf,
+            userEmail,
+            patch.client,
+            priorRaw
+          );
+          if (staged.unchanged && Object.keys(opInput).length === 0) {
+            return { node, version: node.frontmatter.version || currentVersion || 1 };
+          }
+          if (!staged.unchanged) pdfRollback = staged.rollback;
+        }
+        try {
+          await engineApi.run(
+            "context_update",
+            { id: nodeId, ...opInput, publish: false, version: newVersion },
+            await opContext(nestId, userEmail)
+          );
+        } catch (err) {
+          if (pdfRollback) await pdfRollback();
+          throw err;
+        }
         node = await storage.readDocument(nodeId);
         await syncNodeTags(nestId, nodeId, currentTags);
         await deleteSupersededDrafts(nestId, nodeId, newVersion);
@@ -3366,7 +3674,8 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
           author: userEmail,
           status: "draft",
           tags: currentTags,
-          changeNote: patch.changeNote
+          changeNote: patch.changeNote,
+          client: patch.client
         });
         if (isAuthorEditingOwnReview) {
           await repointPendingReview({ nestId, nodeId, newVersion });
@@ -3375,6 +3684,20 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
       } else {
         const publishNote = patch.changeNote || `Auto-published on edit (${publishReason})`;
         let publishedVersion;
+        if (patch.pdf) {
+          const staged = await stagePdfImport(
+            nestId,
+            nodeId,
+            patch.pdf,
+            userEmail,
+            patch.client,
+            priorRaw
+          );
+          if (staged.unchanged && Object.keys(opInput).length === 0) {
+            return { node, version: node.frontmatter.version || 1 };
+          }
+          if (!staged.unchanged) pdfRollback = staged.rollback;
+        }
         try {
           const result = await engineApi.run(
             "context_update",
@@ -3387,6 +3710,7 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
             "publishDocument failed (node patch auto-publish)",
             err
           );
+          if (pdfRollback) await pdfRollback();
           throw err;
         }
         node = await storage.readDocument(nodeId);
@@ -3399,7 +3723,8 @@ async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
           author: userEmail,
           status: "published",
           tags: currentTags,
-          changeNote: publishNote
+          changeNote: publishNote,
+          client: patch.client
         });
         await setApprovedVersion(
           nestId,
@@ -3505,6 +3830,11 @@ async function moveNode(nestId, nodeId, folder, userEmail) {
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
+  if (node.frontmatter.type === PDF_NODE_TYPE) {
+    throw new ValidationError(
+      "PDF documents can't be moved to another folder yet. Upload the PDF again in the destination folder instead."
+    );
+  }
   await assertNotReviewLocked(nestId, nodeId, userEmail, "moving");
   const leaf = nodeId.split("/").pop();
   const segments = folderToSegments(folder);
@@ -3601,6 +3931,16 @@ async function discardDraft(nestId, nodeId, userEmail) {
     await storage.writeDocument(nodeId, raw);
     await storage.regenerateIndex();
     const restored = parseDocument(`${nodeId}.md`, raw, nodeId);
+    let warning;
+    if (restored.frontmatter.type === PDF_NODE_TYPE) {
+      try {
+        const bytes = await readPdfBinary(storage, nodeId);
+        await storage.writeVaultBinary(pdfSidecarPath(nodeId), bytes);
+      } catch (err) {
+        console.error("[pdf] could not restore the sealed binary on discard", nestId, nodeId, err);
+        warning = `The draft was discarded, but the PDF of version ${sealed} could not be restored (its archived copy is missing or no longer matches). Upload the PDF again, or ask an admin to verify the nest.`;
+      }
+    }
     await syncNodeTags(
       nestId,
       nodeId,
@@ -3608,7 +3948,7 @@ async function discardDraft(nestId, nodeId, userEmail) {
     );
     await deleteUnsealedVersions(nestId, nodeId, sealed);
     await trackEvent("node.discard_draft", { nestId, nodeId, version: sealed });
-    return { deleted: false, version: sealed };
+    return { deleted: false, version: sealed, ...warning ? { warning } : {} };
   });
 }
 async function deleteNode(nestId, nodeId, userEmail) {
@@ -3686,6 +4026,7 @@ async function vaultFolderDir(nestId, rel) {
 }
 async function vaultFolderExists(nestId, rel) {
   if (!rel) return false;
+  assertSafeFolder(rel);
   try {
     return (await stat(await vaultFolderDir(nestId, rel))).isDirectory();
   } catch {
@@ -3835,7 +4176,7 @@ function collectMarkdownFiles(dir, root) {
   }
   return out;
 }
-async function syncUnsyncedFolder(userId, folderName, callerEmail) {
+async function syncUnsyncedFolder(userId, folderName, callerEmail, client) {
   console.log(
     `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
   );
@@ -3844,14 +4185,14 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     console.warn(`[unsynced] source missing: ${src}`);
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   const files = collectMarkdownFiles(src, src);
@@ -3876,7 +4217,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
   let documents;
   try {
     await stageImportedFiles(nest.id, files, callerEmail);
-    documents = await registerImportedDocuments(nest.id, callerEmail);
+    documents = await registerImportedDocuments(nest.id, callerEmail, client);
   } catch (err) {
     await deleteNest(nest.id).catch(() => {
     });
@@ -3900,19 +4241,226 @@ async function deleteUnsyncedFolder(folderName) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for delete");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   await rm2(src, { recursive: true, force: true });
   console.log(`[unsynced] deleted folder ${src}`);
 }
 
+// src/shared/branding.ts
+import { z } from "zod";
+var HEX_RE = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
+var IMAGE_EXT_RE = /\.(?:png|jpe?g|gif|webp)$/i;
+var ASSET_NAME_RE = /^[0-9a-f-]{36}\.(?:png|jpe?g|gif|webp)$/;
+var BRANDING_LIMITS = {
+  site_title: 120,
+  banner_headline: 120,
+  banner_subtext: 280,
+  footer_text: 280,
+  footer_link_label: 80,
+  url: 2048
+};
+var IMAGE_FIELDS = ["logo_url", "banner_url", "favicon_url"];
+var COLOR_FIELDS = ["accent_color", "header_bg_color", "page_tint_color"];
+var CONTROL_RE = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/;
+var optText = (max) => z.string().max(max).refine((s) => !CONTROL_RE.test(s), "must not contain control characters").nullable().optional();
+var optColor = z.string().regex(HEX_RE, "must be a #rgb or #rrggbb hex color").nullable().optional();
+var optUrl = z.string().max(BRANDING_LIMITS.url).nullable().optional();
+var BrandingSchema = z.strictObject({
+  logo_url: optUrl,
+  banner_url: optUrl,
+  banner_headline: optText(BRANDING_LIMITS.banner_headline),
+  banner_subtext: optText(BRANDING_LIMITS.banner_subtext),
+  accent_color: optColor,
+  header_bg_color: optColor,
+  page_tint_color: optColor,
+  site_title: optText(BRANDING_LIMITS.site_title),
+  footer_text: optText(BRANDING_LIMITS.footer_text),
+  footer_link_url: optUrl,
+  footer_link_label: optText(BRANDING_LIMITS.footer_link_label),
+  favicon_url: optUrl,
+  hide_powered_by: z.boolean().optional()
+});
+function nestAssetName(url, nestId) {
+  const prefix = `/nests/${nestId}/assets/`;
+  if (!url.startsWith(prefix)) return null;
+  const name = url.slice(prefix.length);
+  return ASSET_NAME_RE.test(name) ? name : null;
+}
+function isHttpsImageUrl(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" || u.username || u.password || !u.hostname) return false;
+  return IMAGE_EXT_RE.test(u.pathname);
+}
+function isHttpsLink(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && !u.username && !u.password && !!u.hostname;
+  } catch {
+    return false;
+  }
+}
+function normalizeHex(v) {
+  if (typeof v !== "string" || !HEX_RE.test(v)) return null;
+  let h = v.slice(1).toLowerCase();
+  if (h.length === 3) h = h.split("").map((c) => c + c).join("");
+  return "#" + h;
+}
+function compact(b) {
+  const out = {};
+  for (const [k, v] of Object.entries(b)) {
+    if (v === null || v === void 0) continue;
+    if (typeof v === "string") {
+      const t = v.trim();
+      if (t === "") continue;
+      out[k] = t;
+    } else if (v === true) {
+      out[k] = true;
+    }
+  }
+  if (Object.keys(out).length === 0) return null;
+  return out;
+}
+var BrandingValidationError = class extends Error {
+};
+async function validateBrandingInput(body, nestId, assetExists) {
+  if (body === null || body === void 0) return null;
+  const parsed = BrandingSchema.safeParse(body);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    const field2 = issue?.path?.join(".") || "branding";
+    const msg = issue?.code === "unrecognized_keys" ? `unknown branding field(s): ${issue.keys.join(", ")}` : `${field2}: ${issue?.message ?? "invalid"}`;
+    throw new BrandingValidationError(msg);
+  }
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of COLOR_FIELDS) {
+    if (b[f]) b[f] = normalizeHex(b[f]);
+  }
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (!url) continue;
+    const asset = nestAssetName(url, nestId);
+    if (asset) {
+      if (!await assetExists(asset)) {
+        throw new BrandingValidationError(`${f}: no such asset in this nest`);
+      }
+      continue;
+    }
+    if (!isHttpsImageUrl(url)) {
+      throw new BrandingValidationError(
+        `${f}: must be an image uploaded to this nest or an https:// URL ending in .png, .jpg, .gif or .webp`
+      );
+    }
+    b[f] = new URL(url).href;
+  }
+  if (b.footer_link_url) {
+    if (!isHttpsLink(b.footer_link_url)) {
+      throw new BrandingValidationError("footer_link_url: must be an https:// URL");
+    }
+    b.footer_link_url = new URL(b.footer_link_url).href;
+  }
+  return b;
+}
+function parseStoredBranding(raw, nestId) {
+  if (!raw) return null;
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const parsed = BrandingSchema.safeParse(data);
+  if (!parsed.success) return null;
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (url && !nestAssetName(url, nestId) && !isHttpsImageUrl(url)) delete b[f];
+  }
+  if (b.footer_link_url && !isHttpsLink(b.footer_link_url)) delete b.footer_link_url;
+  const kept = compact(b);
+  if (!kept) return null;
+  return { ...kept, hide_powered_by: kept.hide_powered_by === true };
+}
+function rgb(hex) {
+  const h = normalizeHex(hex).slice(1);
+  return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16));
+}
+function toHex([r, g, b]) {
+  return "#" + [r, g, b].map((n) => Math.round(Math.max(0, Math.min(255, n))).toString(16).padStart(2, "0")).join("");
+}
+function relativeLuminance(hex) {
+  const [r, g, b] = rgb(hex).map((v) => {
+    const c = v / 255;
+    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
+  });
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+function contrastRatio(a, b) {
+  const la = relativeLuminance(a);
+  const lb = relativeLuminance(b);
+  return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05);
+}
+function readableForeground(bg) {
+  return contrastRatio("#000000", bg) >= contrastRatio("#ffffff", bg) ? "#000000" : "#ffffff";
+}
+function mixHex(a, b, weight) {
+  const ca = rgb(a);
+  const cb = rgb(b);
+  return toHex([0, 1, 2].map((i) => ca[i] * weight + cb[i] * (1 - weight)));
+}
+function ensureContrast(fg, bg, min = 4.5) {
+  const start = normalizeHex(fg);
+  if (contrastRatio(start, bg) >= min) return start;
+  const target = readableForeground(bg);
+  for (let w = 0.05; w <= 1.0001; w += 0.05) {
+    const c = mixHex(target, start, w);
+    if (contrastRatio(c, bg) >= min) return c;
+  }
+  return target;
+}
+function publishBrandCssVars(b) {
+  if (!b) return "";
+  const decls = [];
+  const tint = normalizeHex(b.page_tint_color);
+  const page = tint ? mixHex(tint, "#ffffff", 0.1) : "#ffffff";
+  const accent = normalizeHex(b.accent_color);
+  if (accent) {
+    const text = ensureContrast(ensureContrast(accent, page), "#ffffff");
+    decls.push(
+      `--cn-accent:${accent}`,
+      `--cn-accent-fg:${readableForeground(accent)}`,
+      `--cn-accent-text:${text}`
+    );
+  }
+  const header = normalizeHex(b.header_bg_color);
+  if (header) decls.push(`--cn-header-bg:${header}`, `--cn-header-fg:${readableForeground(header)}`);
+  if (tint) decls.push(`--cn-page-bg:${page}`);
+  return decls.length ? `:root{${decls.join(";")}}` : "";
+}
+function cssUrl(url) {
+  const safe = url.replace(
+    /["'()\\\s\u0000-\u001f\u007f]/g,
+    (ch) => "%" + ch.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase()
+  );
+  return `url("${safe}")`;
+}
+
 // src/nests/routes.ts
 async function effectiveAccess(nestId, userId) {
   const access = await resolveNestAccess(nestId, userId);
@@ -3935,6 +4483,11 @@ function isGrantOnly(access) {
   return access.permission === "none" && access.hasGrant;
 }
 var nestRoutes = new Hono3();
+function withParsedBranding(nest) {
+  if (!nest) return nest;
+  const { branding_json, ...rest } = nest;
+  return { ...rest, branding: parseStoredBranding(branding_json, nest.id) };
+}
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const archivedOnly = c.req.query("archived") === "1";
@@ -3990,14 +4543,20 @@ nestRoutes.get("/", async (c) => {
       pinned: pinned.has(n.id)
     };
   };
+  const nestScope = c.get("nestScope");
   const seen = /* @__PURE__ */ new Set();
   const deduped = [];
   for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (nestScope && n.id !== nestScope) continue;
     if (seen.has(n.id)) continue;
     seen.add(n.id);
     deduped.push(n);
   }
-  const out = await Promise.all(deduped.map(annotate));
+  const memberIds = new Set([...owned, ...shared].map((n) => n.id));
+  const out = (await Promise.all(deduped.map(annotate))).map((row) => ({
+    ...row,
+    discovered: !memberIds.has(row.id)
+  }));
   const docRows = await db.all(
     `SELECT nest_id,
             COUNT(DISTINCT CASE
@@ -4053,7 +4612,7 @@ nestRoutes.get("/", async (c) => {
       }
     }
   }
-  const withMeta = out.map(
+  const withMeta = out.map((raw) => withParsedBranding(raw)).map(
     (n) => n.grant_only ? {
       ...n,
       document_count: grantedDocsByNest.get(n.id) ?? 0,
@@ -4079,7 +4638,7 @@ nestRoutes.post("/", async (c) => {
     throw new ValidationError("name is required");
   }
   const nest = await createNest(c.get("userId"), body.name, body.description);
-  return c.json({ nest }, 201);
+  return c.json({ nest: withParsedBranding(nest) }, 201);
 });
 nestRoutes.post("/:nestId", async (c) => {
   if (c.req.param("nestId") !== "import") {
@@ -4096,7 +4655,14 @@ nestRoutes.post("/:nestId", async (c) => {
     }
     const email2 = await resolveCallerEmail(userId);
     if (body.finalize) {
-      return c.json({ nest: nest2, documents: await registerImportedDocuments(target, email2) });
+      return c.json({
+        nest: withParsedBranding(nest2),
+        documents: await registerImportedDocuments(
+          target,
+          email2,
+          attributeRequest(c, body.client)
+        )
+      });
     }
     const registered = await getDb().get(
       "SELECT COUNT(*) AS c FROM node_versions WHERE nest_id = ?",
@@ -4121,10 +4687,14 @@ nestRoutes.post("/:nestId", async (c) => {
   try {
     const { rejected } = await stageImportedFiles(nest.id, files, email);
     if (body.partial) {
-      return c.json({ nest, rejected }, 201);
+      return c.json({ nest: withParsedBranding(nest), rejected }, 201);
     }
-    const documents = await registerImportedDocuments(nest.id, email);
-    return c.json({ nest, documents, rejected }, 201);
+    const documents = await registerImportedDocuments(
+      nest.id,
+      email,
+      attributeRequest(c, body.client)
+    );
+    return c.json({ nest: withParsedBranding(nest), documents, rejected }, 201);
   } catch (err) {
     await deleteNest(nest.id).catch(() => {
     });
@@ -4153,7 +4723,8 @@ nestRoutes.post("/:nestId/sync", async (c) => {
   const result = await syncUnsyncedFolder(
     userId,
     body.name,
-    await resolveCallerEmail(userId)
+    await resolveCallerEmail(userId),
+    attributeRequest(c, body.client)
   );
   return c.json(result, 201);
 });
@@ -4189,7 +4760,7 @@ nestRoutes.get("/:nestId", async (c) => {
   const grant_only = roles.length === 0 && isGrantOnly(access);
   const nest = await getNest(nestId);
   return c.json({
-    nest,
+    nest: withParsedBranding(nest),
     permission,
     roles: grant_only ? ["viewer"] : roles,
     myStewards,
@@ -4213,7 +4784,7 @@ nestRoutes.patch("/:nestId", async (c) => {
     name: body.name,
     description: body.description
   });
-  return c.json({ nest });
+  return c.json({ nest: withParsedBranding(nest) });
 });
 nestRoutes.post("/:nestId/pin", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4275,7 +4846,8 @@ nestRoutes.get("/:nestId/settings", async (c) => {
     stewardship_enabled: await isStewardshipEnabled(nestId),
     allow_self_approve: await nestAllowsSelfApprove(nestId),
     prime_only_review: await nestReviewsPrimeOnly(nestId),
-    prime_tags: await nestPrimeTags(nestId)
+    prime_tags: await nestPrimeTags(nestId),
+    creator_is_reviewer: await nestCreatorIsReviewer(nestId)
   });
 });
 nestRoutes.patch("/:nestId/settings", async (c) => {
@@ -4320,11 +4892,15 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
       Array.isArray(body.prime_tags) ? body.prime_tags : [body.prime_tags]
     );
   }
+  if (typeof body.creator_is_reviewer === "boolean") {
+    await setCreatorIsReviewer(nestId, body.creator_is_reviewer);
+  }
   return c.json({
     stewardship_enabled: await isStewardshipEnabled(nestId),
     allow_self_approve: await nestAllowsSelfApprove(nestId),
     prime_only_review: await nestReviewsPrimeOnly(nestId),
     prime_tags: await nestPrimeTags(nestId),
+    creator_is_reviewer: await nestCreatorIsReviewer(nestId),
     wiped
   });
 });
@@ -4351,21 +4927,10 @@ async function addCollaborator(params) {
     if (!isEmailish(params.email)) {
       throw new ValidationError("Enter a valid email address.");
     }
-    const email = normalizeEmail(params.email);
-    const existing = await db.get(
-      "SELECT id FROM users WHERE LOWER(email) = ?",
-      [email]
-    );
-    if (existing) {
-      userId = existing.id;
-    } else {
-      const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid6();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid6())]
-      );
-    }
+    userId = (await findOrCreateInvitedUser(params.email, {
+      invitedBy: params.grantedByEmail,
+      baseUrl: params.baseUrl
+    })).id;
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
@@ -4424,13 +4989,18 @@ async function addCollaborator(params) {
     // event. Slack/Teams still fire.
     { skipEmail: true }
   );
-  const inviteeEmail = params.email || (await db.get("SELECT email FROM users WHERE id = ?", [userId]))?.email;
+  const invitee = await db.get(
+    "SELECT email, is_invited FROM users WHERE id = ?",
+    [userId]
+  );
+  const inviteeEmail = params.email || invitee?.email;
   if (inviteeEmail) {
+    const nestLink = docLink(nestId, void 0, params.baseUrl);
     void sendEmailToRecipient(inviteeEmail, {
       status: "shared",
       docTitle: shareNestName,
       path: shareNestName,
-      link: docLink(nestId, void 0, params.baseUrl),
+      link: nestLink && invitee?.is_invited === 1 ? `${nestLink}&invite=${encodeURIComponent(inviteeEmail)}` : nestLink,
       actor: inviteeEmail,
       permission: params.permission,
       by: params.grantedByEmail || void 0
@@ -4539,12 +5109,24 @@ sharingRoutes.patch("/visibility", async (c) => {
   if (!body.visibility || !["private", "org", "public"].includes(body.visibility)) {
     throw new ValidationError("visibility must be private, org or public");
   }
-  if (body.visibility === "public" && body.acknowledge_public !== true) {
+  const ack = body.acknowledge_public === true;
+  const shared = config.SHARED_DEPLOYMENT;
+  if (body.visibility === "public" && !ack) {
     return c.json(
       {
         error: "Publishing this nest requires acknowledgement.",
         requires_acknowledgement: true,
-        warning: "This makes the nest readable by anyone on the internet, outside your organization."
+        warning: shared ? "This makes the nest readable by anyone on the internet \u2014 including every account on this server, which belongs to other organizations too." : "This makes the nest readable by anyone on the internet, outside your organization."
+      },
+      409
+    );
+  }
+  if (body.visibility === "org" && shared && !ack) {
+    return c.json(
+      {
+        error: "Opening this nest to the organization requires acknowledgement.",
+        requires_acknowledgement: true,
+        warning: "This server is shared: 'Organization' makes the nest readable by every account on this server, including other organizations \u2014 not just yours."
       },
       409
     );
@@ -4612,10 +5194,78 @@ sharingRoutes.patch("/reader-mode", async (c) => {
   });
 });
 
-// src/nests/grant-routes.ts
+// src/nests/branding-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid7 } from "uuid";
-var grantRoutes = new Hono5();
+import { access as fsAccess } from "fs/promises";
+import { join as join3 } from "path";
+var brandingRoutes = new Hono5();
+brandingRoutes.patch("/branding", async (c) => {
+  const userId = c.get("userId");
+  const nestId = c.req.param("nestId");
+  const isServerAdmin = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  if (!isServerAdmin) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("admin")) {
+      throw new ForbiddenError(
+        "Only the nest owner, a nest admin, or the server admin can change branding"
+      );
+    }
+  }
+  const db = getDb();
+  if (!await db.get("SELECT id FROM nests WHERE id = ?", [nestId])) {
+    throw new NotFoundError("Nest not found");
+  }
+  const text = await c.req.text();
+  let body = null;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new ValidationError("body must be JSON");
+    }
+  }
+  if (body !== null && (typeof body !== "object" || Array.isArray(body))) {
+    throw new ValidationError("branding must be an object or null");
+  }
+  const assetsDir = join3(resolveNestPath(nestId), "assets");
+  let next;
+  try {
+    next = await validateBrandingInput(body, nestId, async (name) => {
+      try {
+        await fsAccess(join3(assetsDir, name));
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  } catch (err) {
+    if (err instanceof BrandingValidationError) throw new ValidationError(err.message);
+    throw err;
+  }
+  const mentionsHide = body !== null && Object.prototype.hasOwnProperty.call(body, "hide_powered_by");
+  const stored = await db.transaction(async (tx) => {
+    const lock = db.dialect === "postgres" ? " FOR UPDATE" : "";
+    const row = await tx.get(`SELECT branding_json FROM nests WHERE id = ?${lock}`, [nestId]);
+    if (!row) throw new NotFoundError("Nest not found");
+    const wasHidden = parseStoredBranding(row.branding_json, nestId)?.hide_powered_by === true;
+    if (!isServerAdmin) {
+      if (next?.hide_powered_by === true && !wasHidden) {
+        throw new ForbiddenError(
+          'Only the server admin can hide the "Powered by ContextNest" line'
+        );
+      }
+      if (!mentionsHide && wasHidden) next = { ...next ?? {}, hide_powered_by: true };
+    }
+    const value = next ? JSON.stringify(next) : null;
+    await tx.run("UPDATE nests SET branding_json = ? WHERE id = ?", [value, nestId]);
+    return value;
+  });
+  return c.json({ branding: parseStoredBranding(stored, nestId) });
+});
+
+// src/nests/grant-routes.ts
+import { Hono as Hono6 } from "hono";
+var grantRoutes = new Hono6();
 async function requireManage(c, nestId, opts = {}) {
   if (config.AUTH_MODE === "open") return;
   const access = await resolveNestAccess(nestId, c.get("userId"));
@@ -4631,17 +5281,8 @@ async function requireManage(c, nestId, opts = {}) {
   }
 }
 async function resolveGrantee(email) {
-  const db = getDb();
-  const e = normalizeEmail(email);
-  const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-  if (existing) return existing.id;
-  const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid7();
-  await db.run(
-    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid7())]
-  );
-  return id;
+  const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+  return (await findOrCreateInvitedUser2(email)).id;
 }
 async function assertGrantAddsAccess(params) {
   const { nestId, email, userId, targetType, target, role } = params;
@@ -4738,10 +5379,10 @@ grantRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // src/nests/publish-service.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 var MODES = ["public", "email", "code", "invite"];
 var LINK_TTL_SECONDS = 60 * 60;
@@ -4810,7 +5451,7 @@ async function createPublish(params) {
     );
   }
   const db = getDb();
-  const id = uuid8();
+  const id = uuid7();
   const slug = newSlug();
   const created = nowIso();
   const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
@@ -4841,7 +5482,7 @@ async function createPublish(params) {
       await db.run(
         `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
          VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
-        [uuid8(), id, email, created]
+        [uuid7(), id, email, created]
       );
     }
   }
@@ -4896,7 +5537,7 @@ async function mintMagicLink(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, e, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, e, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4926,7 +5567,7 @@ async function createSession2(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, email, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, email, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4943,7 +5584,7 @@ async function logView(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
-    [uuid8(), publishId, email, nowIso()]
+    [uuid7(), publishId, email, nowIso()]
   );
 }
 async function listAllowlist(publishId) {
@@ -4961,7 +5602,7 @@ async function listViews(publishId) {
 }
 
 // src/nests/publish-routes.ts
-var publishRoutes = new Hono6();
+var publishRoutes = new Hono7();
 async function requireManage2(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
     throw new ForbiddenError(
@@ -4976,7 +5617,7 @@ publishRoutes.post("/", async (c) => {
   const mode = body.access_mode ?? "public";
   if ((mode === "email" || mode === "invite") && !isEmailConfigured()) {
     throw new ValidationError(
-      "Email and invite links need email set up on this server (SMTP_URL and NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
+      "Email and invite links need email set up on this server (SMTP or AWS SES, plus NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
     );
   }
   const row = await createPublish({
@@ -5032,11 +5673,11 @@ publishRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-render-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 import MarkdownIt from "markdown-it";
 
 // src/annotations/service.ts
-import { v4 as uuid9 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -5190,7 +5831,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid9();
+  const id = uuid8();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
@@ -5210,7 +5851,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     await tx.run(
       `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
        VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-      [uuid9(), id, authorEmail, body]
+      [uuid8(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -5232,7 +5873,7 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   await db.run(
     `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
      VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-    [uuid9(), threadId, authorEmail, trimmed]
+    [uuid8(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -5338,7 +5979,7 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
             tags: ["annotations"]
           },
           userEmail,
-          { notifyMentions: false }
+          { notifyMentions: false, creatorReviews: false }
         );
       } else {
         throw err;
@@ -5353,7 +5994,9 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
 }
 
 // src/nests/publish-render-routes.ts
-var publishRenderRoutes = new Hono7();
+import { readFile, stat as stat2 } from "fs/promises";
+import { join as join4 } from "path";
+var publishRenderRoutes = new Hono8();
 var SESSION_TTL_SECONDS2 = 24 * 60 * 60;
 var GATE_LIMIT = { max: 10, windowMs: 10 * 6e4 };
 var COMMENT_LIMIT = { max: 5, windowMs: 10 * 6e4 };
@@ -5410,6 +6053,114 @@ function setSessionCookie2(c, slug, token) {
 function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+var IMAGE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp"
+};
+var INLINE_CAP = { logo: 512 * 1024, favicon: 256 * 1024, banner: 2 * 1024 * 1024 };
+var INLINE_CACHE_MAX_CHARS = 24 * 1024 * 1024;
+var inlineCache = /* @__PURE__ */ new Map();
+var inlineCacheChars = 0;
+function cacheGet(key) {
+  if (!inlineCache.has(key)) return void 0;
+  const v = inlineCache.get(key);
+  inlineCache.delete(key);
+  inlineCache.set(key, v);
+  return v;
+}
+function cachePut(key, v) {
+  const size = v?.length ?? 0;
+  if (size > INLINE_CACHE_MAX_CHARS) return;
+  inlineCacheChars -= inlineCache.get(key)?.length ?? 0;
+  inlineCache.set(key, v);
+  inlineCacheChars += size;
+  for (const [k, old] of inlineCache) {
+    if (inlineCacheChars <= INLINE_CACHE_MAX_CHARS && inlineCache.size <= 512) break;
+    inlineCache.delete(k);
+    inlineCacheChars -= old?.length ?? 0;
+  }
+}
+async function inlineAsset(nestId, url, cap) {
+  if (!url) return null;
+  const name = nestAssetName(url, nestId);
+  if (!name) return null;
+  const key = `${nestId}/${name}/${cap}`;
+  const hit = cacheGet(key);
+  if (hit !== void 0) return hit;
+  let out = null;
+  try {
+    const path = join4(resolveNestPath(nestId), "assets", name);
+    if ((await stat2(path)).size <= cap) {
+      const mime = IMAGE_MIME[name.split(".").pop().toLowerCase()];
+      if (mime) out = `data:${mime};base64,${(await readFile(path)).toString("base64")}`;
+    }
+  } catch {
+    return null;
+  }
+  cachePut(key, out);
+  return out;
+}
+async function loadBrand(row) {
+  let b = null;
+  try {
+    const r = await getDb().get("SELECT branding_json FROM nests WHERE id = ?", [row.nest_id]);
+    b = parseStoredBranding(r?.branding_json, row.nest_id);
+  } catch {
+    b = null;
+  }
+  if (!b) return null;
+  const [logo, banner, favicon] = await Promise.all([
+    inlineAsset(row.nest_id, b.logo_url, INLINE_CAP.logo),
+    inlineAsset(row.nest_id, b.banner_url, INLINE_CAP.banner),
+    inlineAsset(row.nest_id, b.favicon_url, INLINE_CAP.favicon)
+  ]);
+  return { b, logo, banner, favicon };
+}
+var BRAND_CSS = `
+  .cn-brand{display:flex;align-items:center;gap:12px;padding:12px 24px;background:var(--cn-header-bg,#fff);color:var(--cn-header-fg,#1c1917);border-bottom:1px solid rgba(0,0,0,.08);font:600 16px/1.3 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-brand img{height:32px;width:auto;max-width:160px;object-fit:contain}
+  .cn-brand span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .cn-hero{position:relative;min-height:120px;max-height:220px;height:28vw;display:flex;flex-direction:column;justify-content:flex-end;padding:20px 24px;box-sizing:border-box;background:var(--cn-accent,#142a80) center/cover no-repeat;color:var(--cn-accent-fg,#fff);overflow:hidden}
+  .cn-hero.has-img{color:#fff}
+  .cn-hero.has-img::before{content:"";position:absolute;inset:0;background:linear-gradient(to top,rgba(0,0,0,.62),rgba(0,0,0,.08))}
+  .cn-hero *{position:relative;margin:0;max-width:820px}
+  .cn-hero strong{display:block;font:700 clamp(20px,4vw,30px)/1.2 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-hero p{margin-top:6px;font-size:15px;opacity:.92}
+  .cn-foot{max-width:820px;margin:0 auto;padding:20px 24px 40px;border-top:1px solid #e7e5e4;color:#78716c;font-size:13px;display:flex;flex-wrap:wrap;gap:6px 16px}
+  .cn-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function brandHead(brand, extraCss = "") {
+  if (!brand) return "";
+  const icon = brand.favicon ? `<link rel="icon" href="${esc(brand.favicon)}">` : "";
+  return `<style>${publishBrandCssVars(brand.b)}${BRAND_CSS}${extraCss}</style>${icon}`;
+}
+function brandBar(brand) {
+  if (!brand) return "";
+  const title = brand.b.site_title ? `<span>${esc(brand.b.site_title)}</span>` : "";
+  const logo = brand.logo ? `<img src="${esc(brand.logo)}" alt="">` : "";
+  if (!title && !logo) return "";
+  return `<header class="cn-brand">${logo}${title}</header>`;
+}
+function brandHero(brand) {
+  if (!brand) return "";
+  const { banner_headline: h, banner_subtext: sub } = brand.b;
+  if (!brand.banner && !h) return "";
+  const style = brand.banner ? ` style="background-image:${esc(cssUrl(brand.banner))}"` : "";
+  const cls = brand.banner ? "cn-hero has-img" : "cn-hero";
+  return `<div class="${cls}"${style}>${h ? `<strong>${esc(h)}</strong>` : ""}${sub ? `<p>${esc(sub)}</p>` : ""}</div>`;
+}
+function brandFooter(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(`<span>${esc(text)}</span>`);
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  if (!brand.b.hide_powered_by) parts.push(`<span>Secured by PromptOwl \xB7 ContextNest</span>`);
+  return parts.length ? `<footer class="cn-foot">${parts.join("")}</footer>` : "";
+}
 var NO_DOWNLOAD_CSS = `<style>
   @media print{html,body{display:none !important}}
   html,body{-webkit-user-select:none;-ms-user-select:none;user-select:none}
@@ -5481,7 +6232,10 @@ async function renderPublished(c, row, viewerEmail) {
   }
   const title = esc(artifact.title || row.node_id);
   const heading = /^\s*#\s/.test(body) ? "" : `<h1>${title}</h1>`;
-  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title><style>${PROSE_CSS}</style></head><body><main>${heading}${markdown.render(body)}</main>${overlays}</body></html>`;
+  const brand = await loadBrand(row);
+  const docTitle = brand?.b.site_title ? `${title} \xB7 ${esc(brand.b.site_title)}` : title;
+  const brandCss = brand ? `body{background:var(--cn-page-bg,#fff)}h1,h2,h3,h4,a{color:var(--cn-accent-text,#142a80)}` : "";
+  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${docTitle}</title><style>${PROSE_CSS}</style>${brandHead(brand, brandCss)}</head><body>${brandBar(brand)}${brandHero(brand)}<main>${heading}${markdown.render(body)}</main>${brandFooter(brand)}${overlays}</body></html>`;
   return c.body(shell, 200, { "Content-Type": "text/html; charset=utf-8" });
 }
 var EYE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>`;
@@ -5502,9 +6256,29 @@ var GATE_EYE_SCRIPT = `<script>
     });
   })();
 </script>`;
-function gatePage(row, message) {
+var GATE_BRAND_CSS = `
+    body{background:var(--cn-page-bg,#f4f4f5)}
+    .card{box-sizing:border-box;overflow:hidden}
+    h1{color:var(--cn-accent-text,#142a80)}
+    button[type=submit]{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}
+    .cn-brand{margin:-32px -34px 20px;border-radius:14px 14px 0 0;padding:14px 20px}
+    .cn-gate-foot{font-size:12px;color:#a8a29e;margin:10px 0 0;text-align:center}
+    .cn-gate-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function gateBrandTop(brand) {
+  return brandBar(brand);
+}
+function gateBrandFoot(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(esc(text));
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  return parts.length ? `<p class="cn-gate-foot">${parts.join(" \xB7 ")}</p>` : "";
+}
+function gatePage(row, message, brand = null) {
   const wantsCode = row.access_mode === "code";
-  const field = wantsCode ? `<label>Access code<span class="wrap">
+  const field2 = wantsCode ? `<label>Access code<span class="wrap">
         <input id="cn-code" name="code" type="password" autocomplete="off" required autofocus>
         <button type="button" id="cn-eye" class="eye" aria-label="Show code" aria-pressed="false">${EYE_SVG}</button>
       </span></label>` : `<label>Your email<input name="email" type="email" autocomplete="email" required autofocus></label>`;
@@ -5527,10 +6301,10 @@ function gatePage(row, message) {
     button.eye svg{width:18px;height:18px;display:block}
     .err{color:#be123c;font-weight:600}
     .brand{font-size:12px;color:#a8a29e;margin:18px 0 0;text-align:center}
-  </style></head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
-    <h1>Protected document</h1><p>${esc(note)}</p>${err}${field}
+  </style>${brandHead(brand, GATE_BRAND_CSS)}</head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
+    ${gateBrandTop(brand)}<h1>Protected document</h1><p>${esc(note)}</p>${err}${field2}
     <button type="submit">${cta}</button>
-    <p class="brand">Secured by PromptOwl \xB7 ContextNest</p>
+    ${brand?.b.hide_powered_by ? "" : `<p class="brand">Secured by PromptOwl \xB7 ContextNest</p>`}${gateBrandFoot(brand)}
   </form>${wantsCode ? GATE_EYE_SCRIPT : ""}</body></html>`;
 }
 function unavailablePage() {
@@ -5549,7 +6323,7 @@ function unavailablePage() {
 function sentPage() {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Check your email</title><style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}.card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:380px;text-align:center}h1{font-size:20px;color:#142a80;margin:0 0 6px}p{color:#78716c;margin:0;font-size:14px}</style></head><body><div class="card"><h1>Check your email</h1><p>If your address has access, a one-time link to open this document is on its way.</p></div></body></html>`;
 }
-function readerShell(row, title, viewerEmail) {
+function readerShell(row, title, viewerEmail, brand = null) {
   const emailField = viewerEmail ? `<p class="who">Commenting as <strong>${esc(viewerEmail)}</strong></p>` : `<label>Your email<input id="cn-email" type="email" autocomplete="email" required></label>`;
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>
     html,body{margin:0;height:100%}
@@ -5570,7 +6344,7 @@ function readerShell(row, title, viewerEmail) {
     button[disabled]{opacity:.6;cursor:default}
     .msg{font-weight:600;margin:0 0 14px;font-size:14px}
     .msg.err{color:#be123c}.msg.ok{color:#15803d}
-  </style></head><body>
+  </style>${brand ? `<style>${publishBrandCssVars(brand.b)}#cn-open,#cn-send{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}.card h2{color:var(--cn-accent-text,#142a80)}</style>` : ""}</head><body>
     <iframe id="cn-frame" src="/p/${esc(row.slug)}/view" title="${esc(title)}"></iframe>
     <button id="cn-open" type="button">Leave a comment</button>
     <div id="cn-back"><div class="card" role="dialog" aria-modal="true" aria-label="Leave a comment">
@@ -5641,12 +6415,12 @@ publishRenderRoutes.get("/:slug", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const viewer = await resolveViewer(c, row);
-  if (!viewer) return c.html(gatePage(row));
+  if (!viewer) return c.html(gatePage(row, void 0, await loadBrand(row)));
   if (row.comments_enabled !== 1) return renderPublished(c, row, viewer.email);
   const title = await publishedTitle(row);
   c.header("Content-Security-Policy", SHELL_CSP);
   c.header("Referrer-Policy", "no-referrer");
-  return c.html(readerShell(row, title, viewer.email));
+  return c.html(readerShell(row, title, viewer.email, await loadBrand(row)));
 });
 publishRenderRoutes.get("/:slug/view", async (c) => {
   const slug = c.req.param("slug");
@@ -5684,20 +6458,20 @@ publishRenderRoutes.post("/:slug/gate", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   if (!tryConsume(`publish-gate:${slug}:${clientIp(c)}`, GATE_LIMIT)) {
-    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes."), 429);
+    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes.", await loadBrand(row)), 429);
   }
   if (row.access_mode === "public") return c.redirect(`/p/${slug}`);
   const form = await c.req.parseBody();
   if (row.access_mode === "code") {
     if (!await verifyCode(row, String(form.code ?? ""))) {
-      return c.html(gatePage(row, "That code is not correct."), 401);
+      return c.html(gatePage(row, "That code is not correct.", await loadBrand(row)), 401);
     }
     setSessionCookie2(c, slug, await createSession2(row.id, null));
     return c.redirect(`/p/${slug}`);
   }
   const email = normalizeEmail(String(form.email ?? ""));
   if (!isEmailish(email)) {
-    return c.html(gatePage(row, "Enter a valid email address."), 400);
+    return c.html(gatePage(row, "Enter a valid email address.", await loadBrand(row)), 400);
   }
   const allowed = row.access_mode !== "invite" || await isAllowlisted(row.id, email);
   const linkToken = await mintMagicLink(row.id, email);
@@ -5717,15 +6491,15 @@ publishRenderRoutes.get("/:slug/verify", async (c) => {
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const email = await consumeMagicLink(row.id, c.req.query("token") ?? "");
   if (!email) {
-    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one."), 401);
+    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one.", await loadBrand(row)), 401);
   }
   setSessionCookie2(c, slug, await createSession2(row.id, email));
   return c.redirect(`/p/${slug}`);
 });
 
 // src/nests/nest-team-routes.ts
-import { Hono as Hono8 } from "hono";
-var nestTeamRoutes = new Hono8();
+import { Hono as Hono9 } from "hono";
+var nestTeamRoutes = new Hono9();
 nestTeamRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const refs = await listNestTeams(nestId);
@@ -5764,8 +6538,8 @@ nestTeamRoutes.delete("/:teamId", async (c) => {
 });
 
 // src/nests/people-routes.ts
-import { Hono as Hono9 } from "hono";
-var peopleRoutes = new Hono9();
+import { Hono as Hono10 } from "hono";
+var peopleRoutes = new Hono10();
 peopleRoutes.get("/suggest", async (c) => {
   const userId = c.get("userId");
   const q = c.req.query("q") ?? "";
@@ -5775,7 +6549,7 @@ peopleRoutes.get("/suggest", async (c) => {
 });
 
 // src/governance/team-routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/governance/promptowl-teams.ts
 var PROMPTOWL_SOURCE = "promptowl";
@@ -5922,7 +6696,7 @@ async function desiredRoster(poTeam, callerEmail) {
 }
 
 // src/governance/team-routes.ts
-var teamRoutes = new Hono10();
+var teamRoutes = new Hono11();
 var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var CONNECT_REQUIRED = "promptowl_connect_required";
 var CONNECT_REQUIRED_STATUS = 428;
@@ -6107,7 +6881,8 @@ function toSearchHit(node, query) {
 }
 
 // src/nodes/routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
+import { parseDocument as parseDocument3, readPdfBinary as readPdfBinary2 } from "@promptowl/contextnest-engine";
 
 // src/nodes/markdown-export.ts
 import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
@@ -6159,7 +6934,7 @@ ${m[1]}
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono11();
+var nodeRoutes = new Hono12();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -6224,7 +6999,8 @@ nodeRoutes.post("/", async (c) => {
       status: body.status,
       schedule: body.schedule,
       folder: body.folder,
-      prime: body.prime
+      prime: body.prime,
+      client: attributeRequest(c, body.client)
     },
     authorEmail
   );
@@ -6241,7 +7017,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-4DHNRULG.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-TDZUC2Q6.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -6262,7 +7038,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-HHGOTO6P.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2EWN7WWO.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -6283,7 +7059,7 @@ nodeRoutes.post("/:nodeId{.+}/discard", async (c) => {
 nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { versions: versionManager } = await engineCache.get(nestId);
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
@@ -6305,11 +7081,26 @@ nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
       `Version ${targetVersion} not found for ${nodeId}`
     );
   }
+  let restoredPdf = null;
+  if (pdfMetaOf(nodeId, raw)) {
+    try {
+      restoredPdf = await readPdfBinary2(storage, nodeId, {
+        version: targetVersion
+      });
+    } catch (err) {
+      console.error("[pdf] revert could not read the version's binary", nestId, nodeId, targetVersion, err);
+      throw new NotFoundError(`The PDF of version ${targetVersion} is not available to restore.`);
+    }
+  }
   const content = bodyOnly(nodeId, raw);
   const { node, version } = await updateNode(
     nestId,
     nodeId,
-    { content, changeNote: `Restored from version ${targetVersion}` },
+    {
+      ...restoredPdf ? { pdf: { bytes: new Uint8Array(restoredPdf) } } : { content },
+      changeNote: `Restored from version ${targetVersion}`,
+      client: attributeRequest(c, body.client)
+    },
     userEmail
   );
   await trackEvent("node.revert", { nestId, nodeId, targetVersion });
@@ -6412,6 +7203,10 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
           approved
         );
         response.content = bodyOnly(nodeId, approvedRaw);
+        if (response.type === "pdf") {
+          const approvedPdf = pdfMetaOf(nodeId, approvedRaw);
+          if (approvedPdf) response.pdf = approvedPdf;
+        }
       } catch (err) {
         console.error(
           "reconstructVersion failed (public single)",
@@ -6494,6 +7289,7 @@ nodeRoutes.patch("/:nodeId{.+}", async (c) => {
       changeNote: body.changeNote,
       schedule: body.schedule,
       prime: body.prime,
+      client: attributeRequest(c, body.client),
       type: body.type
     },
     authorEmail
@@ -6506,6 +7302,13 @@ nodeRoutes.delete("/:nodeId{.+}", async (c) => {
   await deleteNode(nestId, nodeId, await getUserEmail(c));
   return c.json({ deleted: true });
 });
+function pdfMetaOf(nodeId, raw) {
+  try {
+    return parseDocument3(`${nodeId}.md`, raw, nodeId).frontmatter.pdf;
+  } catch {
+    return void 0;
+  }
+}
 async function getUserEmail(c) {
   const userId = c.get("userId");
   const db = getDb();
@@ -6514,13 +7317,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono12();
+var annotationRoutes = new Hono13();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -6648,7 +7451,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -7108,7 +7911,7 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
 
 // src/nests/bundle-service.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join3, sep } from "path";
+import { join as join5, sep } from "path";
 import JSZip from "jszip";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 function walkFiles(root) {
@@ -7121,7 +7924,7 @@ function walkFiles(root) {
   }
   for (const rel of entries) {
     try {
-      if (statSync2(join3(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+      if (statSync2(join5(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
     } catch {
     }
   }
@@ -7162,13 +7965,17 @@ async function exportNestBundle(nestId, includeDrafts) {
     const segs = rel.split("/");
     const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
     if (!keep) continue;
-    zip.file(rel, readFileSync2(join3(nestPath, rel)));
+    zip.file(rel, readFileSync2(join5(nestPath, rel)));
   }
   trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
   return zip.generateAsync({ type: "arraybuffer" });
 }
 
 // src/nodes/graph-service.ts
+import {
+  contextLinkTarget,
+  extractContextLinks
+} from "@promptowl/contextnest-engine";
 var MAX_GRAPH_NODES = 150;
 var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
 function bareSlug(idOrTarget) {
@@ -7186,6 +7993,15 @@ function extractWikiTargets(body) {
   }
   return out;
 }
+function extractContextTargets(body) {
+  const out = /* @__PURE__ */ new Set();
+  if (!body) return [];
+  for (const uri of extractContextLinks(body)) {
+    const t = contextLinkTarget(uri);
+    if (t) out.add(t);
+  }
+  return [...out];
+}
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   const { storage } = await engineCache.get(nestId);
   const docs = (await storage.discoverDocuments()).filter(
@@ -7220,6 +8036,15 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
       allLinks.push({ source: d.id, target: targetId });
     }
   }
+  for (const d of accessible) {
+    for (const targetId of extractContextTargets(d.body || "")) {
+      if (!idSet.has(targetId) || targetId === d.id) continue;
+      const key = `${d.id}->${targetId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      allLinks.push({ source: d.id, target: targetId });
+    }
+  }
   const tagCounts = /* @__PURE__ */ new Map();
   const tagToDocs = /* @__PURE__ */ new Map();
   for (const n of allNodes) {
@@ -7231,6 +8056,17 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
     }
   }
   const tags = [...tagCounts.entries()].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count);
+  for (const docIds of tagToDocs.values()) {
+    const ids = [...docIds].sort();
+    for (let i = 0; i < ids.length; i++) {
+      for (let j = i + 1; j < ids.length; j++) {
+        const key = `${ids[i]}->${ids[j]}`;
+        if (seen.has(key) || seen.has(`${ids[j]}->${ids[i]}`)) continue;
+        seen.add(key);
+        allLinks.push({ source: ids[i], target: ids[j] });
+      }
+    }
+  }
   const exposeStewards = await isStewardshipEnabled(nestId) && !await isPublicReader(nestId, userId);
   const stewardRows = exposeStewards ? (await listStewards({ nestId })).filter(
     // Drop document-scoped rows whose node the caller can't see.
@@ -7321,7 +8157,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono13();
+var queryRoutes = new Hono14();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -7525,7 +8361,10 @@ queryRoutes.post("/context", async (c) => {
     hopsUsed = result.hopsUsed;
     nodesTraversed = result.nodesTraversed;
   }
-  if (titleMatches.length > 0 && hops > 0) {
+  const hopSeeds = [
+    ...new Map([...documents, ...titleMatches].map((d) => [d.id, d])).values()
+  ];
+  if (hopSeeds.length > 0 && hops > 0) {
     const byTitle = new Map(
       allDocs.map((d) => [
         String(d.frontmatter.title || "").toLowerCase(),
@@ -7543,9 +8382,13 @@ queryRoutes.post("/context", async (c) => {
         const t = byId.get(target) ?? byTitle.get(target.toLowerCase());
         if (t && t.id !== d.id) link(d.id, t.id);
       }
+      for (const target of extractContextTargets(d.body || "")) {
+        const t = byId.get(target);
+        if (t && t.id !== d.id) link(d.id, t.id);
+      }
     }
-    const seen = new Set(titleMatches.map((d) => d.id));
-    let frontier = titleMatches.map((d) => d.id);
+    const seen = new Set(hopSeeds.map((d) => d.id));
+    let frontier = hopSeeds.map((d) => d.id);
     for (let depth = 0; depth < hops && frontier.length; depth++) {
       const next = [];
       for (const id of frontier) {
@@ -7879,7 +8722,8 @@ queryRoutes.post("/publish", async (c) => {
           content: doc.content,
           type: doc.type,
           tags: doc.tags,
-          scope: doc.scope
+          scope: doc.scope,
+          folder: doc.folder
         },
         userEmail
       );
@@ -7911,10 +8755,13 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
+// src/mcp/tools.ts
+import { parseDocument as parseDocument4 } from "@promptowl/contextnest-engine";
+
 // src/telemetry/trace-log.ts
 var PRUNE_EVERY = 500;
 var insertsSincePrune = 0;
@@ -7923,8 +8770,8 @@ async function logTraceEvent(e) {
     const db = getDb();
     await db.run(
       `INSERT INTO api_events
-         (ts, kind, method, path, tool, nest_id, user_id, user_email, status, duration_ms)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+         (ts, kind, method, path, tool, nest_id, user_id, user_email, status, duration_ms, client_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         (/* @__PURE__ */ new Date()).toISOString(),
         e.kind,
@@ -7935,7 +8782,8 @@ async function logTraceEvent(e) {
         e.userId ?? null,
         e.userEmail ?? null,
         e.status ?? null,
-        e.durationMs ?? null
+        e.durationMs ?? null,
+        serializeClient(e.client)
       ]
     );
     if (++insertsSincePrune >= PRUNE_EVERY) {
@@ -7984,17 +8832,23 @@ async function listTraceEvents(filters = {}) {
         LIMIT ? OFFSET ?`,
       [...args, limit, offset]
     );
-    return { events, total };
+    return {
+      events: events.map(({ client_json, ...e }) => {
+        const client = deserializeClient(client_json);
+        return client ? { ...e, client } : e;
+      }),
+      total
+    };
   } catch {
     return { events: [], total: 0 };
   }
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid12 } from "uuid";
+import { v4 as uuid11 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid10 } from "uuid";
+import { v4 as uuid9 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -8124,7 +8978,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid10()}`;
+  const id = `run_${uuid9()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -8310,8 +9164,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono14 } from "hono";
-import { v4 as uuid11 } from "uuid";
+import { Hono as Hono15 } from "hono";
+import { v4 as uuid10 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -8429,7 +9283,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono14();
+var edgeRoutes = new Hono15();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -8497,7 +9351,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid11();
+  const id = uuid10();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8898,7 +9752,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid12();
+  const id = uuid11();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8962,7 +9816,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid12(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid11(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -9032,6 +9886,19 @@ function summarizeNode(node, body) {
     body: body ?? void 0
   };
 }
+function pdfSourceLine(node, body) {
+  if ((node.frontmatter.type || "document") !== "pdf") return null;
+  let pdf = node.frontmatter.pdf;
+  if (body && body.startsWith("---")) {
+    try {
+      pdf = parseDocument4(`${node.id}.md`, body, node.id).frontmatter.pdf ?? pdf;
+    } catch {
+    }
+  }
+  if (!pdf) return "**Source file:** PDF";
+  const pages = `${pdf.pages} page${pdf.pages === 1 ? "" : "s"}`;
+  return `**Source file:** PDF, ${pages}${pdf.text_layer ? "" : ", no text layer"}`;
+}
 var TOOL_DEFINITIONS = [
   {
     name: "context_init",
@@ -9262,7 +10129,7 @@ var TOOL_DEFINITIONS = [
         tags: {
           type: "array",
           items: { type: "string" },
-          description: "Tags to add"
+          description: "The node's full tag set \u2014 REPLACES the existing tags (same as the engine catalog). To add one, send the current tags plus the new one; to remove one, send the set without it."
         },
         status: {
           type: "string",
@@ -9431,10 +10298,14 @@ var TOOL_DEFINITIONS = [
       type: "object",
       properties: {
         title: { type: "string", description: "Title of the node to submit" },
+        id: {
+          type: "string",
+          description: 'Node id / path (e.g. "nodes/gtm/deals/win-loss-log"). Use instead of title when two nodes share a title or the title is unknown.'
+        },
         note: { type: "string", description: "Optional note for the reviewer" },
         priority: { type: "string", description: "Priority: low, normal (default), high, urgent" }
-      },
-      required: ["title"]
+      }
+      // One of id or title — see context_update.
     }
   },
   {
@@ -9572,8 +10443,30 @@ async function resolveLlmBody(ctx, node, gate) {
 async function handleToolCall(toolName, args, ctx) {
   const started = Date.now();
   let status = 200;
+  let client;
+  try {
+    client = mergeClient(ctx.client, parseClientMetadata(args.client));
+  } catch (err) {
+    void logTraceEvent({
+      kind: "mcp",
+      tool: toolName,
+      nestId: ctx.nestId,
+      userId: ctx.userId,
+      userEmail: ctx.userEmail,
+      status: 400,
+      durationMs: Date.now() - started
+    });
+    return toolError(err.message, "VALIDATION_FAILED");
+  }
+  const attributed = { ...ctx, client };
+  if ((toolName === "context_create" || toolName === "context_update") && typeof args.content === "string" && /^\s*---\r?\n[\w-]+:/.test(args.content)) {
+    return toolError(
+      "`content` is the markdown body only \u2014 it starts with a YAML frontmatter block, which would be stored as body text. Drop the `---` block and pass tags/status as parameters; the server owns the frontmatter.",
+      "VALIDATION_FAILED"
+    );
+  }
   try {
-    return await runTool(toolName, args, ctx);
+    return await runTool(toolName, args, attributed);
   } catch (err) {
     if (isVaultLockTimeout(err) || err instanceof VaultBusyError) {
       status = 503;
@@ -9592,7 +10485,10 @@ async function handleToolCall(toolName, args, ctx) {
       userId: ctx.userId,
       userEmail: ctx.userEmail,
       status,
-      durationMs: Date.now() - started
+      durationMs: Date.now() - started,
+      // Reads record attribution HERE — the activity trace is this edition's
+      // §9.2 access trace, and a read seals no version to carry it.
+      client
     });
   }
 }
@@ -9787,7 +10683,8 @@ ${list}`,
       const meta = [
         `**Title:** ${node.frontmatter.title}`,
         `**Type:** ${node.frontmatter.type || "document"}`,
-        node.frontmatter.tags?.length ? `**Tags:** ${node.frontmatter.tags.join(" ")}` : null
+        node.frontmatter.tags?.length ? `**Tags:** ${node.frontmatter.tags.join(" ")}` : null,
+        pdfSourceLine(node, body)
       ].filter(Boolean).join("\n");
       return {
         text: `${meta}
@@ -10050,7 +10947,8 @@ ${sections}`;
             type: args.type,
             tags: args.tags,
             scope: args.scope,
-            folder: args.folder
+            folder: args.folder,
+            client: ctx.client
           },
           userEmail
         );
@@ -10078,16 +10976,16 @@ ${sections}`;
           "UNAUTHORIZED_ACTION"
         );
       }
-      const mergedTags = args.tags ? [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...args.tags])] : void 0;
       const { node: updated, version } = await updateNode(
         nestId,
         node.id,
         {
           content: args.content,
           append: args.append,
-          tags: mergedTags,
+          tags: args.tags,
           status: args.status,
-          changeNote: args.changeNote
+          changeNote: args.changeNote,
+          client: ctx.client
         },
         userEmail
       );
@@ -10140,10 +11038,11 @@ Use context_request_deletion to ask a nest owner/admin to delete it, with a reas
         args.folder,
         userEmail
       );
+      const data = { id: moved.id, previous_id: previousId, title: moved.frontmatter.title };
       if (previousId === moved.id) {
-        return `**${moved.frontmatter.title}** is already at \`${moved.id}\` \u2014 nothing to move.`;
+        return { text: `**${moved.frontmatter.title}** is already at \`${moved.id}\` \u2014 nothing to move.`, data };
       }
-      return `Moved **${moved.frontmatter.title}**: \`${previousId}\` \u2192 \`${moved.id}\``;
+      return { text: `Moved **${moved.frontmatter.title}**: \`${previousId}\` \u2192 \`${moved.id}\``, data };
     }
     // ─── Governance Tool Handlers ──────────────────────────────────────
     case "context_stewards": {
@@ -10386,7 +11285,8 @@ Submit one with \`context_submit_review\`.`;
           requestedBy: ctx.userEmail,
           note: args.note,
           priority: args.priority,
-          baseUrl: ctx.baseUrl
+          baseUrl: ctx.baseUrl,
+          client: ctx.client
         });
         const resolved2 = await resolveStewardsForNode(
           ctx.nestId,
@@ -10437,7 +11337,8 @@ ${resolved2.map((r) => `- ${r.steward.userEmail} (${r.source})`).join("\n")}` :
           nodeId: node.id,
           approvedBy: ctx.userEmail,
           note: args.note,
-          baseUrl: ctx.baseUrl
+          baseUrl: ctx.baseUrl,
+          client: ctx.client
         });
         return `Approved "${args.title}" v${request.version}. This version is now live for AI queries.${args.note ? `
 Note: ${args.note}` : ""}`;
@@ -10478,7 +11379,9 @@ Reason: ${args.note}`;
         };
       }
       const list = allVersions.map(
-        (v) => `- **v${v.version}** ${v.status}${v.version === approved ? " (AI-active)" : ""} \u2014 by ${v.editedBy} at ${v.editedAt}${v.changeNote ? ` "${v.changeNote}"` : ""}`
+        (v) => `- **v${v.version}** ${v.status}${v.version === approved ? " (AI-active)" : ""} \u2014 by ${v.editedBy} at ${v.editedAt}${v.changeNote ? ` "${v.changeNote}"` : ""}${// §9.4: which agent wrote it. In the prose as well as the
+        // structured payload — a chat client reads only this half.
+        v.client?.agent ? ` [via ${v.client.agent}]` : ""}`
       ).join("\n");
       return {
         text: `# Version History: ${label}
@@ -10502,7 +11405,11 @@ ${list}`,
             status: v.status,
             edited_by: v.editedBy,
             edited_at: v.editedAt,
-            note: v.changeNote
+            note: v.changeNote,
+            // §9.4: which agent wrote this version, in which session. Omitted
+            // (not `{}`) when the write carried no attribution — "not
+            // attributed" and "attributed to nobody" are different claims.
+            ...v.client ? { client: v.client } : {}
           }))
         }
       };
@@ -10563,22 +11470,12 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-UT3EQ3R7.js");
-        const db = (await import("./client-KEY4PYJH.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-24GLUBY4.js");
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
-        let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-        if (!row) {
-          const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid20 } = await import("uuid");
-          const id = uuid20();
-          await db.run(
-            "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid20())]
-          );
-          row = { id };
-        }
+        const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+        const row = await findOrCreateInvitedUser2(e, { invitedBy: ctx.userEmail });
         await createGrant2({
           nestId: ctx.nestId,
           targetType,
@@ -10613,7 +11510,8 @@ ${list}`;
         const { nest, documents } = await syncUnsyncedFolder(
           userId,
           args.name,
-          userEmail
+          userEmail,
+          ctx.client
         );
         return `Synced folder "${args.name}" \u2192 nest **${nest.name}** (${nest.id}) with ${documents} document(s).`;
       } catch (err) {
@@ -10629,14 +11527,14 @@ ${list}`;
 }
 
 // src/mcp/routes.ts
-import { z } from "zod";
-var mcpRoutes = new Hono15();
+import { z as z2 } from "zod";
+var mcpRoutes = new Hono16();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
   return user?.email || "anonymous@localhost";
 }
-function createMcpServerForNest(nestId, userId, userEmail, baseUrl) {
+function createMcpServerForNest(nestId, userId, userEmail, baseUrl, c) {
   const server = new McpServer(
     { name: `contextnest-${nestId}`, version: "1.0.0" },
     { capabilities: { tools: {} } }
@@ -10647,16 +11545,18 @@ function createMcpServerForNest(nestId, userId, userEmail, baseUrl) {
     const required = tool.inputSchema.required || [];
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
-      let field;
-      if (def.type === "string") field = z.string();
-      else if (def.type === "number") field = z.number();
-      else if (def.type === "array") field = z.array(z.string());
-      else field = z.any();
-      if (!required.includes(key)) field = field.optional();
-      shape[key] = field;
-    }
+      let field2;
+      if (def.type === "string") field2 = z2.string();
+      else if (def.type === "number") field2 = z2.number();
+      else if (def.type === "array") field2 = z2.array(z2.string());
+      else field2 = z2.any();
+      if (!required.includes(key)) field2 = field2.optional();
+      shape[key] = field2;
+    }
+    Object.assign(shape, clientToolField);
     server.tool(tool.name, tool.description, shape, async (args) => {
       const engine = await engineCache.get(nestId);
+      const client = attributeRequest(c, void 0, connectionClient(server));
       const out = await handleToolCall(tool.name, args, {
         storage: engine.storage,
         queryEngine: engine.query,
@@ -10664,7 +11564,8 @@ function createMcpServerForNest(nestId, userId, userEmail, baseUrl) {
         nestId,
         userId,
         userEmail,
-        baseUrl
+        baseUrl,
+        client
       });
       return toCallToolResult(out);
     });
@@ -10679,7 +11580,8 @@ mcpRoutes.all("/", async (c) => {
     nestId,
     userId,
     userEmail,
-    requestBaseUrl(c.req.url)
+    requestBaseUrl(c.req.url),
+    c
   );
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
@@ -10696,8 +11598,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono16 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid12 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -10815,7 +11717,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono16();
+var runTriggerRoutes = new Hono17();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -10894,7 +11796,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid13()}`;
+  const id = `run_${uuid12()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -10923,7 +11825,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono16();
+var runListRoutes = new Hono17();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10955,7 +11857,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono16();
+var runDetailRoutes = new Hono17();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -11106,8 +12008,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid14 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -11144,7 +12046,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono17();
+var scheduleRoutes = new Hono18();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11185,7 +12087,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid14()}`;
+  const id = `sch_${uuid13()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -11240,8 +12142,8 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono18 } from "hono";
-import { v4 as uuid15 } from "uuid";
+import { Hono as Hono19 } from "hono";
+import { v4 as uuid14 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
@@ -11288,7 +12190,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono18();
+var connectorRoutes = new Hono19();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11307,7 +12209,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid15()}`;
+  const id = `con_${uuid14()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -11350,7 +12252,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -11373,7 +12275,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono19();
+var hookNestRoutes = new Hono20();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -11447,7 +12349,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono19();
+var hookFireRoutes = new Hono20();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -11549,9 +12451,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono20 } from "hono";
-import { v4 as uuid16 } from "uuid";
-var definitionRoutes = new Hono20();
+import { Hono as Hono21 } from "hono";
+import { v4 as uuid15 } from "uuid";
+var definitionRoutes = new Hono21();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11630,7 +12532,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid16();
+      targetId = uuid15();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -11659,11 +12561,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono21 } from "hono";
-import { v4 as uuid17 } from "uuid";
-import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
-import { join as join4 } from "path";
-var assetRoutes = new Hono21();
+import { Hono as Hono22 } from "hono";
+import { v4 as uuid16 } from "uuid";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { join as join6 } from "path";
+var assetRoutes = new Hono22();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -11709,10 +12611,10 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid17()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join4(resolveNestPath(nestId), "assets");
+  const name = `${uuid16()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const dir = join6(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
-  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
+  await writeFile(join6(dir, name), Buffer.from(await file.arrayBuffer()));
   const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
@@ -11734,7 +12636,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile(join4(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile2(join6(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -11749,8 +12651,185 @@ assetRoutes.get("/:file", async (c) => {
   });
 });
 
+// src/nodes/pdf-routes.ts
+import { Hono as Hono23 } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { createHash as createHash3 } from "crypto";
+import { isPdf, readPdfBinary as readPdfBinary3 } from "@promptowl/contextnest-engine";
+var pdfNodeRoutes = new Hono23();
+var PDF_UPLOAD_PATH = /^\/nests\/[^/]+\/nodes\/pdf\/?$/;
+function pdfMaxRequestBytes() {
+  return config.PDF_MAX_BYTES + 1024 * 1024;
+}
+function tooLarge(bytes) {
+  return new PayloadTooLargeError(
+    `PDF too large (${(bytes / (1024 * 1024)).toFixed(1)} MB, max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
+  );
+}
+function field(body, name) {
+  const v = body[name];
+  const one = Array.isArray(v) ? v[0] : v;
+  return typeof one === "string" ? one.trim() : "";
+}
+function tagsField(body) {
+  const v = body["tags"];
+  if (v === void 0) return void 0;
+  const raw = (Array.isArray(v) ? v : [v]).filter((x) => typeof x === "string");
+  const tags = raw.flatMap((s) => s.split(",")).map((t) => t.trim().replace(/^#/, "")).filter(Boolean);
+  return tags;
+}
+function titleFromFilename(name) {
+  return name.split(/[/\\]/).pop().replace(/\.pdf$/i, "").replace(/[_]+/g, " ").trim().slice(0, 200);
+}
+pdfNodeRoutes.post(
+  "/pdf",
+  (c, next) => bodyLimit({
+    maxSize: pdfMaxRequestBytes(),
+    onError: (c2) => c2.json(
+      {
+        error: `PDF too large (max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
+      },
+      413
+    )
+  })(c, next),
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const lenStr = c.req.header("Content-Length");
+    if (lenStr) {
+      const len = parseInt(lenStr, 10);
+      if (Number.isFinite(len) && len > pdfMaxRequestBytes()) throw tooLarge(len);
+    }
+    const body = await c.req.parseBody({ all: true });
+    const fileField = Array.isArray(body["file"]) ? body["file"][0] : body["file"];
+    if (!(fileField instanceof File)) {
+      throw new ValidationError('multipart field "file" (a PDF) is required');
+    }
+    const file = fileField;
+    if (file.size > config.PDF_MAX_BYTES) throw tooLarge(file.size);
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    if (!isPdf(bytes)) {
+      throw new ValidationError("That file is not a PDF (it does not start with %PDF-).");
+    }
+    const userEmail = await resolveCallerEmail(c.get("userId"));
+    const title = field(body, "title");
+    const tags = tagsField(body);
+    const client = attributeRequest(c, void 0);
+    const pdf = { bytes, filename: file.name || void 0 };
+    const targetId = field(body, "nodeId");
+    if (targetId) {
+      assertSafeNodeId(targetId);
+      const changeNote = field(body, "changeNote") || "Replaced the PDF";
+      const { node: node2, version: version2 } = await updateNode(
+        nestId,
+        targetId,
+        {
+          pdf,
+          ...title ? { title } : {},
+          ...tags ? { tags } : {},
+          changeNote,
+          client
+        },
+        userEmail
+      );
+      return c.json({ node: toNodeResponse(node2), version: version2 });
+    }
+    const folder = field(body, "folder");
+    const { node, version } = await createNode(
+      nestId,
+      {
+        title: title || titleFromFilename(file.name || "") || "Untitled PDF",
+        content: "",
+        type: PDF_NODE_TYPE,
+        ...tags ? { tags } : {},
+        ...folder ? { folder } : {},
+        client,
+        pdf
+      },
+      userEmail
+    );
+    const resolved = await resolveStewardsForNode(nestId, node.id);
+    return c.json(
+      {
+        node: toNodeResponse(node),
+        version,
+        stewards: resolved.length > 0 ? resolved.map((r) => ({
+          email: r.steward.userEmail,
+          role: r.steward.role,
+          source: r.source
+        })) : void 0
+      },
+      201
+    );
+  }
+);
+pdfNodeRoutes.get("/:nodeId{.+}/pdf", async (c, next) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  let node;
+  try {
+    node = await getNodeForCaller(nestId, { id: nodeId }, userId, userEmail);
+  } catch {
+    return next();
+  }
+  if (node.frontmatter.type !== PDF_NODE_TYPE) return next();
+  const requested = c.req.query("version");
+  if (requested !== void 0 && !/^[1-9]\d*$/.test(requested)) {
+    throw new ValidationError("version must be a positive integer");
+  }
+  const approvedOnly = c.req.query("approved_only") === "1" || c.req.query("approved_only") === "true";
+  let version;
+  if (approvedOnly || await isPublicReader(nestId, userId)) {
+    const approved = await getApprovedVersion(nestId, nodeId);
+    if (approved == null) {
+      throw new NotFoundError("This document has no approved version yet.");
+    }
+    version = approved;
+  } else if (requested !== void 0) {
+    version = Number(requested);
+  }
+  const { storage } = await engineCache.get(nestId);
+  let bytes;
+  try {
+    bytes = await readPdfBinary3(
+      storage,
+      nodeId,
+      version !== void 0 ? { version } : {}
+    );
+  } catch (err) {
+    const code = err?.code;
+    if (code === "INTEGRITY_ERROR") {
+      console.error("[pdf] integrity failure serving", nestId, nodeId, version, err);
+      throw new AppError(
+        500,
+        "This PDF no longer matches the version history's record of it, so it is not being served. Ask an admin to verify the nest."
+      );
+    }
+    throw new NotFoundError(
+      version !== void 0 ? `Version ${version} of this PDF was not found.` : "This document's PDF was not found."
+    );
+  }
+  const etag = `"sha256:${createHash3("sha256").update(bytes).digest("hex")}"`;
+  const leaf = (nodeId.split("/").pop() || "document").replace(/[^A-Za-z0-9._-]/g, "-");
+  const disposition = c.req.query("download") === "1" ? "attachment" : "inline";
+  const headers = {
+    "Content-Type": "application/pdf",
+    "Content-Disposition": `${disposition}; filename="${leaf}.pdf"`,
+    "Content-Security-Policy": "sandbox",
+    "X-Content-Type-Options": "nosniff",
+    "Cache-Control": "private, no-cache",
+    ETag: etag
+  };
+  const ifNoneMatch = c.req.header("If-None-Match");
+  if (ifNoneMatch && ifNoneMatch.split(",").map((t) => t.trim()).includes(etag)) {
+    return c.body(null, 304, headers);
+  }
+  return c.body(new Uint8Array(bytes), 200, headers);
+});
+
 // src/auth/community-sites-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono24 } from "hono";
 var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
 var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
 var serializeSite = (site) => ({
@@ -11762,7 +12841,7 @@ var serializeSite = (site) => ({
   created_at: site.created_at,
   updated_at: site.updated_at
 });
-var communitySiteRoutes = new Hono22();
+var communitySiteRoutes = new Hono24();
 communitySiteRoutes.get("/", async (c) => {
   if (!await serverAdminAllowed(c))
     return c.json({ error: "Only the server admin can view this." }, 403);
@@ -11850,10 +12929,10 @@ communitySiteRoutes.delete("/:id", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono25 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "nest_create",
   "context_create",
@@ -11973,116 +13052,39 @@ var NEST_ARG_OPTIONAL = {
     description: "Target nest \u2014 id or name. Omit to search/list across ALL accessible nests."
   }
 };
+var SERVER_NEST_TOOLS = [
+  // Fan-out reads — `nest` optional: omit it to span every accessible nest.
+  ...FANOUT_READ_TOOLS,
+  // Targeted reads and writes — `nest` required.
+  "context_get",
+  "context_resolve",
+  "context_comments",
+  "context_versions",
+  "context_create",
+  "context_update",
+  "context_delete",
+  "context_move",
+  "context_submit_review"
+];
+function withNestArg(tool) {
+  const fanout = FANOUT_READ_TOOLS.has(tool.name);
+  const schema = tool.inputSchema;
+  return {
+    name: tool.name,
+    description: fanout ? `${tool.description} On this server-level endpoint, omit \`nest\` to run it across ALL accessible nests (each hit names its nest).` : `${tool.description} On this server-level endpoint, \`nest\` (id, name or slug) is required.`,
+    inputSchema: {
+      ...schema,
+      properties: { ...fanout ? NEST_ARG_OPTIONAL : NEST_ARG, ...schema.properties },
+      required: [...fanout ? [] : ["nest"], ...schema.required ?? []]
+    }
+  };
+}
 var SERVER_TOOL_DEFINITIONS = [
   {
     name: "nest_index",
     description: "Grounded index of every nest these credentials can read: name, id, permission, document count. Call this FIRST.",
     inputSchema: { type: "object", properties: {} }
   },
-  // ─── Fan-out reads (nest optional) ─────────────────────────────────────
-  {
-    name: "context_query",
-    description: "Run a structured selector query. Omit `nest` to query ALL accessible nests. Selector: #tag, type:X, [[Title]], scope:X, +AND, |OR, -NOT.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG_OPTIONAL,
-        query: { type: "string", description: "Selector query" },
-        hops: {
-          type: "number",
-          description: "Graph traversal depth from the matches (default: 2)"
-        }
-      },
-      required: ["query"]
-    }
-  },
-  {
-    name: "context_search",
-    description: "Full-text keyword search. Omit `nest` to search ALL accessible nests. Returns count and first `limit` hits.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG_OPTIONAL,
-        query: { type: "string", description: "Search terms" },
-        limit: {
-          type: "number",
-          description: "Max hits to return (default 20, max 200)"
-        }
-      },
-      required: ["query"]
-    }
-  },
-  {
-    name: "context_list",
-    description: "Browse contents with optional type, tag, or limit filters. Omit `nest` to list ALL accessible nests.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG_OPTIONAL,
-        type: { type: "string", description: "Filter by node type" },
-        tag: { type: "string", description: "Filter by tag" },
-        limit: { type: "number", description: "Max nodes to return" }
-      }
-    }
-  },
-  {
-    name: "context_overview",
-    description: "Map of nests: node count, types, tags, title+snippet per node. Omit `nest` for ALL accessible nests.",
-    inputSchema: {
-      type: "object",
-      properties: { ...NEST_ARG_OPTIONAL }
-    }
-  },
-  // ─── Targeted reads (nest required) ────────────────────────────────────
-  {
-    name: "context_get",
-    description: "Get the FULL content of a node in a nest by title or id.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of the node" },
-        id: { type: "string", description: "ID of the node" }
-      },
-      required: ["nest"]
-    }
-  },
-  {
-    name: "context_resolve",
-    description: "Full deterministic context resolution against one nest \u2014 selector + hops + token budget, complete node bodies.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        selector: { type: "string", description: "Selector query string" },
-        max_tokens: {
-          type: "number",
-          description: "Approximate token budget (default: 8000)"
-        },
-        hops: {
-          type: "number",
-          description: "Graph traversal depth from the matches (default: 2)"
-        }
-      },
-      required: ["nest", "selector"]
-    }
-  },
-  {
-    // Read-only, so it belongs on this endpoint: an agent reading a nest's
-    // documents across nests also needs the feedback left on them. Writing a
-    // comment stays on the per-nest endpoint with the other write tools.
-    name: "context_comments",
-    description: "Get the review comments/annotations on a document in a nest \u2014 anchored quotes, threaded replies, and open/resolved status. Use to pull human feedback into context before acting on a document.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        nest: { type: "string", description: "Nest name or id (see nest_index)" },
-        title: { type: "string", description: "Title of the node" },
-        id: { type: "string", description: "ID of the node" }
-      },
-      required: ["nest"]
-    }
-  },
   {
     name: "nest_create",
     description: "Create a new nest owned by the caller. Returns the new nest's id \u2014 target it with the other tools afterwards.",
@@ -12095,93 +13097,18 @@ var SERVER_TOOL_DEFINITIONS = [
       required: ["name"]
     }
   },
-  // ─── Writes (nest required) ────────────────────────────────────────────
-  {
-    name: "context_create",
-    description: "Create a new document in a nest. Needs write permission. A `folder` path creates the folder implicitly.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Descriptive title" },
-        content: { type: "string", description: "Markdown content body" },
-        type: { type: "string", description: "Node type (default: document)" },
-        tags: { type: "array", items: { type: "string" }, description: "Tags" },
-        scope: { type: "string", description: "Visibility scope" },
-        folder: {
-          type: "string",
-          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified'
-        }
-      },
-      required: ["nest", "title", "content"]
-    }
-  },
-  {
-    name: "context_update",
-    description: "Update an existing node by title or id. Needs write permission. Use `content` to replace, `append` to add.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of node to update" },
-        id: { type: "string", description: "Node id (use when title is ambiguous)" },
-        content: { type: "string", description: "New content (replaces)" },
-        append: { type: "string", description: "Content to append" },
-        tags: { type: "array", items: { type: "string" }, description: "Tags to add" },
-        status: { type: "string", description: "New status: draft|pending_review|approved|published" },
-        changeNote: { type: "string", description: "Why this changed \u2014 recorded in history" }
-      },
-      required: ["nest"]
-    }
-  },
-  {
-    name: "context_delete",
-    description: "Delete a node by title or id. Needs write permission. Irreversible.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of node to delete" },
-        id: { type: "string", description: "Node id (use when title is ambiguous)" }
-      },
-      required: ["nest"]
-    }
-  },
-  {
-    name: "context_move",
-    description: "Move a node to a different folder. The id changes; history and links follow. Needs write permission.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of node to move" },
-        id: { type: "string", description: "Node id (use when title is ambiguous)" },
-        folder: { type: "string", description: 'Destination folder (e.g. "gtm/deals"); "" for root' }
-      },
-      required: ["nest", "folder"]
-    }
-  },
-  {
-    name: "context_submit_review",
-    description: "Submit a node for steward review. Stewards will be notified. Use on governed nests.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        ...NEST_ARG,
-        title: { type: "string", description: "Title of node to submit" },
-        id: { type: "string", description: "Node id (use when title is ambiguous)" },
-        note: { type: "string", description: "Note for the reviewer" },
-        priority: { type: "string", description: "Priority: low, normal, high, urgent" }
-      },
-      required: ["nest"]
-    }
-  }
+  ...SERVER_NEST_TOOLS.map((name) => {
+    const tool = TOOL_DEFINITIONS.find((t) => t.name === name);
+    if (!tool) throw new Error(`server-level tool ${name} has no per-nest definition`);
+    return withNestArg(tool);
+  })
 ];
-async function handleServerToolCall(toolName, args, userId, userEmail, nestScope, baseUrl) {
+async function handleServerToolCall(toolName, args, userId, userEmail, nestScope, baseUrl, client) {
   if (toolName === "nest_index") {
     const nests = await buildNestIndex(userId, nestScope);
-    if (!nests.length) return "No nests accessible with these credentials.";
-    return renderNestIndexMarkdown(nests, baseUrl);
+    const data = { nests };
+    if (!nests.length) return { text: "No nests accessible with these credentials.", data };
+    return { text: renderNestIndexMarkdown(nests, baseUrl), data };
   }
   if (SERVER_WRITE_TOOLS.has(toolName)) {
     if (isSuspended()) {
@@ -12204,7 +13131,7 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
       );
       return `Created nest "${nest2.name}" (id: ${nest2.id}). Add documents with context_create, retrieve with the other tools.`;
     } catch (err) {
-      if (err instanceof ValidationError) return err.message;
+      if (err instanceof ValidationError || err instanceof ForbiddenError) return err.message;
       throw err;
     }
   }
@@ -12213,9 +13140,6 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
     const nests = await buildNestIndex(userId, nestScope);
     if (!nests.length) return "No nests accessible with these credentials.";
     const nonEmpty = nests.filter((n) => (n.document_count ?? 0) > 0);
-    if (!nonEmpty.length) {
-      return "All accessible nests are empty. Use context_create to add documents first.";
-    }
     const results = await Promise.allSettled(
       nonEmpty.map(async (n) => {
         const engine2 = await engineCache.get(n.id);
@@ -12226,25 +13150,66 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
           nestId: n.id,
           userId,
           userEmail,
-          baseUrl
+          baseUrl,
+          // Same attribution the single-nest branch below passes (§9.4). A
+          // fan-out read is still one call per nest on the trace, and each row
+          // has to name the caller — without this the derived agent/session is
+          // dropped and only an explicit `client` in the args survives.
+          client
         });
         return { nest: n, result };
       })
     );
     const parts = [];
+    let firstError;
+    let firstRejection;
+    const tag = (n, items) => Array.isArray(items) ? items.map((it) => ({ ...it, nest: { id: n.id, name: n.name } })) : [];
+    const perNestDocs = [];
+    const perNestHits = [];
+    let count = 0;
+    let nodesTraversed = 0;
+    let hopsUsed = 0;
+    let mode;
     for (const r of results) {
-      if (r.status === "fulfilled") {
-        const { nest: n, result } = r.value;
-        const text = typeof result === "string" ? result : result.text;
-        parts.push(`## ${n.name} (${n.id})
+      if (r.status !== "fulfilled") {
+        firstRejection ??= r;
+        continue;
+      }
+      const { nest: n, result } = r.value;
+      if (typeof result !== "string" && result.isError) {
+        firstError ??= result;
+        continue;
+      }
+      parts.push(`## ${n.name} (${n.id})
 
-${text}`);
+${typeof result === "string" ? result : result.text}`);
+      const d = typeof result === "string" ? void 0 : result.data;
+      if (!d) continue;
+      perNestDocs.push(tag(n, d.documents));
+      perNestHits.push(tag(n, d.results));
+      count += d.count ?? 0;
+      nodesTraversed += d.traversal?.nodes_traversed ?? 0;
+      hopsUsed = Math.max(hopsUsed, d.traversal?.hops_used ?? 0);
+      mode ??= d.traversal?.mode;
+    }
+    const interleave = (lists) => {
+      const out = [];
+      for (let i = 0; lists.some((l) => i < l.length); i++) {
+        for (const l of lists) if (i < l.length) out.push(l[i]);
       }
+      return out;
+    };
+    if (!parts.length && firstError) return firstError;
+    if (!parts.length && firstRejection) throw firstRejection.reason;
+    const documents = interleave(perNestDocs);
+    const listLimit = typeof args.limit === "number" && args.limit >= 1 ? Math.floor(args.limit) : 50;
+    const data = toolName === "context_search" ? { results: interleave(perNestHits).slice(0, normalizeSearchLimit(args.limit)), count } : toolName === "context_query" ? { documents, traversal: { mode: mode ?? "selector", hops_used: hopsUsed, nodes_traversed: nodesTraversed } } : { documents: documents.slice(0, listLimit) };
+    const reply = (text) => toolName === "context_overview" ? text : { text, data };
+    if (!nonEmpty.length) {
+      return reply("All accessible nests are empty. Use context_create to add documents first.");
     }
-    if (!parts.length) {
-      return "No results found across any accessible nests.";
-    }
-    return parts.join("\n\n---\n\n");
+    if (!parts.length) return reply("No results found across any accessible nests.");
+    return reply(parts.join("\n\n---\n\n"));
   }
   const inaccessible = `Nest not found or not accessible: "${nestArg}". Use nest_index to see what these credentials can read.`;
   if (!nestArg) {
@@ -12262,10 +13227,11 @@ ${text}`);
     nestId: nest.id,
     userId,
     userEmail,
-    baseUrl
+    baseUrl,
+    client
   });
 }
-function createServerMcp(userId, userEmail, nestScope, baseUrl) {
+function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
   const server = new McpServer2(
     { name: "contextnest-server", version: "1.0.0" },
     { capabilities: { tools: {} } }
@@ -12275,14 +13241,15 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
     const required = tool.inputSchema.required || [];
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
-      let field;
-      if (def.type === "string") field = z2.string();
-      else if (def.type === "number") field = z2.number();
-      else if (def.type === "array") field = z2.array(z2.string());
-      else field = z2.any();
-      if (!required.includes(key)) field = field.optional();
-      shape[key] = field;
-    }
+      let field2;
+      if (def.type === "string") field2 = z3.string();
+      else if (def.type === "number") field2 = z3.number();
+      else if (def.type === "array") field2 = z3.array(z3.string());
+      else field2 = z3.any();
+      if (!required.includes(key)) field2 = field2.optional();
+      shape[key] = field2;
+    }
+    Object.assign(shape, clientToolField);
     server.tool(tool.name, tool.description, shape, async (args) => {
       const out = await handleServerToolCall(
         tool.name,
@@ -12290,14 +13257,15 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
         userId,
         userEmail,
         nestScope,
-        baseUrl
+        baseUrl,
+        attributeRequest(c, void 0, connectionClient(server))
       );
       return toCallToolResult(out);
     });
   }
   return server;
 }
-var serverMcpRoutes = new Hono23();
+var serverMcpRoutes = new Hono25();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -12305,7 +13273,8 @@ serverMcpRoutes.all("/", async (c) => {
     userId,
     userEmail,
     c.get("nestScope"),
-    requestBaseUrl(c.req.url)
+    requestBaseUrl(c.req.url),
+    c
   );
   const transport = new WebStandardStreamableHTTPServerTransport2({
     sessionIdGenerator: void 0,
@@ -12319,7 +13288,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono23();
+var nestIndexRoutes = new Hono25();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -12413,6 +13382,20 @@ Write endpoints (need write permission):
 - \`GET ${B}/me/drafts\` \u2014 your documents never submitted for review
 - \`GET ${B}/me/notifications\` \u2014 watcher and review notifications
 
+## Say who you are: \`client\`
+
+Every write body and every MCP tool call takes an optional
+\`client\` object \u2014 \`{ "agent": "claude-code", "session_id": "s-9f2" }\`, plus any
+custom scalar keys. A write that seals a version records it on that version
+(\`GET /nodes/<id>/versions\` and \`context_versions\` serve it back); every call
+records it on this server's activity trace, which is how a READ gets attributed.
+
+Send it. Nothing requires it and no call is refused for omitting it, but a vault
+serving several agents cannot otherwise tell which of you wrote what. It is a
+label, never an identity claim: it is not authenticated, grants nothing, and is
+never part of a hash. Bounded \u2014 scalar values up to 512 chars, at most 16 custom
+keys beyond \`agent\` and \`session_id\`.
+
 ## MCP (Model Context Protocol)
 
 Streamable HTTP, stateless. Two endpoints:
@@ -12421,7 +13404,7 @@ Streamable HTTP, stateless. Two endpoints:
   Tools: \`nest_index\` (call first), then:
   - Fan-out reads (omit \`nest\` to search/list ALL nests): \`context_search\`,
     \`context_list\`, \`context_query\`, \`context_overview\`
-  - Targeted reads (\`nest\` required): \`context_get\`, \`context_resolve\`, \`context_comments\`
+  - Targeted reads (\`nest\` required): \`context_get\`, \`context_resolve\`, \`context_comments\`, \`context_versions\`
   - Writes (\`nest\` required): \`nest_create\`, \`context_create\`, \`context_update\`,
     \`context_delete\`, \`context_move\`, \`context_submit_review\`
 - \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, the full toolset. Same names as the
@@ -12458,9 +13441,11 @@ on the command line.
 export CONTEXTNEST_API_KEY=<api-key>
 # every nest these credentials can read, through the server-level endpoint
 ctx vault add contextnest --url ${B}/mcp --bearer-env CONTEXTNEST_API_KEY
-# or one nest
+ctx vault list                                  # lists contextnest/<nest> for each nest
+ctx search "pricing" --vault contextnest        # reads span every nest
+ctx update nodes/x --tags a,b --vault contextnest/<nest>   # a write names one nest
+# or pin one nest by its own endpoint
 ctx vault add mynest --url ${B}/nests/<nest-id>/mcp --bearer-env CONTEXTNEST_API_KEY
-ctx query "#gtm" --vault mynest
 \`\`\`
 
 Servers in "open" auth mode: drop \`--bearer-env\`. Pushing a local folder up
@@ -12479,14 +13464,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono23();
+var llmsTxtRoutes = new Hono25();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono26 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -12617,7 +13602,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid18 } from "uuid";
+import { v4 as uuid17 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -12633,7 +13618,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid18();
+  const id = uuid17();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -12833,7 +13818,7 @@ function rowToComment(row) {
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync3, existsSync } from "fs";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -12899,9 +13884,9 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join5(nestPath, "stewards.yaml"),
-    join5(nestPath, "stewards.yml"),
-    join5(nestPath, ".context", "stewards.yaml")
+    join7(nestPath, "stewards.yaml"),
+    join7(nestPath, "stewards.yml"),
+    join7(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
@@ -12918,7 +13903,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono24();
+var governanceRoutes = new Hono26();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -13058,6 +14043,7 @@ governanceRoutes.post("/review-queue/bulk", async (c) => {
   }
   const userEmail = await getUserEmail4(c);
   const baseUrl = requestBaseUrl(c.req.url);
+  const client = attributeRequest(c, body.client);
   const results = [];
   for (const nodeId of nodeIds) {
     try {
@@ -13068,7 +14054,8 @@ governanceRoutes.post("/review-queue/bulk", async (c) => {
           approvedBy: userEmail,
           note: body.note,
           override: false,
-          baseUrl
+          baseUrl,
+          client
         });
       } else {
         await reject({
@@ -13160,7 +14147,7 @@ governanceRoutes.post("/request-deletion", async (c) => {
   if (body.targetType === "folder") {
     const { storage } = await engineCache.get(nestId);
     const docs = await storage.discoverDocuments();
-    if (!docs.some((d) => isIdUnderFolder(d.id, target))) {
+    if (!docs.some((d) => isIdUnderFolder(d.id, target)) && !await vaultFolderExists(nestId, target)) {
       return c.json({ error: `Folder not found: ${target}` }, 404);
     }
   }
@@ -13286,7 +14273,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono24();
+var governanceNodeRoutes = new Hono26();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -13492,7 +14479,10 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
       requestedBy: userEmail,
       note: body.note,
       priority: body.priority,
-      baseUrl: requestBaseUrl(c.req.url)
+      baseUrl: requestBaseUrl(c.req.url),
+      // Submitting seals the draft into the engine's append-only chain, so the
+      // block lands on that entry as well as on this request's trace row.
+      client: attributeRequest(c, body.client)
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -13626,7 +14616,8 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
       approvedBy: userEmail,
       note: body.note,
       override: body.override && isAdmin,
-      baseUrl: requestBaseUrl(c.req.url)
+      baseUrl: requestBaseUrl(c.req.url),
+      client: attributeRequest(c, body.client)
     });
     return c.json({ review: request });
   } catch (err) {
@@ -13641,6 +14632,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
     throw new ValidationError("Rejection note is required");
   }
   const userEmail = await getUserEmail4(c);
+  attributeRequest(c, body.client);
   try {
     const request = await reject({
       nestId,
@@ -13753,26 +14745,52 @@ function posthogKeyError(value) {
   return null;
 }
 
+// src/shared/public-base-url.ts
+var UNSAFE = /["'`\\$;|&<>(){}\s]/;
+function publicBaseUrlError(value) {
+  const v = value.trim();
+  if (!v) return null;
+  let parsed;
+  try {
+    parsed = new URL(v);
+  } catch {
+    return "Public base URL must be a full http(s) URL, e.g. https://nest.example.com";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return "Public base URL must use http or https, e.g. https://nest.example.com";
+  if (!parsed.hostname)
+    return "Public base URL must include a hostname, e.g. https://nest.example.com";
+  if (UNSAFE.test(v))
+    return "Public base URL must not contain spaces, quotes or shell characters (\" ' ` \\ $ ; | & < > ( ) { }) \u2014 it is pasted into terminal commands and config files.";
+  return null;
+}
+
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, join as join6, relative as relative2 } from "path";
+import { dirname as dirname2, join as join8, relative as relative2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var SERVICE_VERSION = (() => {
   try {
-    return JSON.parse(readFileSync4(join6(HERE, "..", "package.json"), "utf8")).version;
+    return JSON.parse(readFileSync4(join8(HERE, "..", "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
 })();
 var UI_DIR_CANDIDATES = [
-  join6(HERE, "web3"),
-  join6(process.cwd(), "dist", "web3")
+  join8(HERE, "web3"),
+  join8(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
-var openModeMiddleware = createMiddleware2(async (c, next) => {
+var isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
+var serveIndexShell = serveStatic({
+  root: UI_DIR_REL,
+  path: "index.html",
+  onFound: (_p, c) => c.header("Cache-Control", "no-cache")
+});
+var openModeMiddleware = createMiddleware3(async (c, next) => {
   const anonId = await ensureAnonymousUser();
   c.set("userId", anonId);
   c.set("nestScope", null);
@@ -13784,7 +14802,7 @@ function isPublicReadEligiblePath(method, path) {
   if (/^\/nests\/[^/]+\/stewards/.test(path)) return false;
   return !/\/(collaborators|visibility|settings|mcp)/.test(path);
 }
-var flexAuthMiddleware = createMiddleware2(async (c, next) => {
+var flexAuthMiddleware = createMiddleware3(async (c, next) => {
   const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
   const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
   if (hasBearer || hasCookie) {
@@ -13802,12 +14820,15 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
     c.set("nestScope", null);
     return next();
   }
-  return c.json({ error: "Missing or invalid credentials" }, 401);
+  return c.json(
+    { error: "Authentication required \u2014 sign in or provide an API key.", code: "missing_credentials" },
+    401
+  );
 });
 function nestPathParts(path) {
   return path.replace(/^\/nests\//, "").split("/").filter(Boolean);
 }
-var flexAuthWithPromptowlTicket = createMiddleware2(
+var flexAuthWithPromptowlTicket = createMiddleware3(
   async (c, next) => {
     const header = c.req.header("Authorization") || "";
     const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
@@ -13820,14 +14841,24 @@ var flexAuthWithPromptowlTicket = createMiddleware2(
       return flexAuthMiddleware(c, next);
     }
     let claims = null;
+    let expired = false;
     for (const secret of secrets) {
       try {
         claims = verifySsoTicket(token, secret);
         break;
-      } catch {
+      } catch (err) {
+        if (err instanceof SsoTokenError && err.message === "Ticket expired") {
+          expired = true;
+        }
       }
     }
     if (!claims) {
+      if (expired) {
+        return c.json(
+          { error: "Service ticket expired \u2014 reconnect to refresh.", code: "ticket_expired" },
+          401
+        );
+      }
       return c.json({ error: "Invalid service ticket" }, 401);
     }
     if (claims.scope !== "mcp" || claims.jti) {
@@ -13874,7 +14905,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono25({ router: new LinearRouter() });
+  const app = new Hono27({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -13892,7 +14923,8 @@ function createApp() {
     const lenStr = c.req.header("Content-Length");
     if (lenStr) {
       const len = parseInt(lenStr, 10);
-      const cap = c.req.method === "POST" && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : config.MAX_BODY_BYTES;
+      const isPost = c.req.method === "POST";
+      const cap = isPost && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : isPost && PDF_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, pdfMaxRequestBytes()) : config.MAX_BODY_BYTES;
       if (Number.isFinite(len) && len > cap) {
         return c.json(
           {
@@ -13917,9 +14949,13 @@ function createApp() {
       nestId: /^\/nests\/([^/]+)/.exec(path)?.[1] ?? null,
       userId: c.get("userId") ?? null,
       status: c.res.status,
-      durationMs: Date.now() - started
+      durationMs: Date.now() - started,
+      // Set by whichever handler validated the request's `client` block
+      // (§9.4). Absent on a request that sent none.
+      client: c.get("clientMetadata")
     });
   });
+  app.use("*", nestScopedKeyGuard);
   app.get("/health", (c) => {
     const oidcReady = isOidcReady();
     return c.json({
@@ -13934,6 +14970,9 @@ function createApp() {
       // Presence only: the publish dialog hides the email/invite gates when
       // this server cannot send mail, because their only way in is a mailed link.
       email_configured: isEmailConfigured(),
+      // Who may create nests (admins | everyone) — the Nests page hides the
+      // create buttons from non-admins when it's admins-only.
+      nest_creation: config.NEST_CREATION,
       // Product analytics for the SPA. The PostHog project key is a public
       // client key, but it only ships while usage telemetry is on — one switch
       // covers everything this server sends outward.
@@ -13962,6 +15001,11 @@ function createApp() {
       // API would refuse it — existing nodes of the type stay readable.
       type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
       type_table_enabled: config.TYPE_TABLE_ENABLED,
+      // This server hosts several organizations (PromptOwl-hosted) rather than
+      // one. The visibility picker words 'Organization' and 'Public' by it and
+      // confirms before 'org'; the server enforces the same in
+      // PATCH /nests/:id/visibility.
+      shared_deployment: config.SHARED_DEPLOYMENT,
       // Sub-agent runs gate its own recursion surface separately (env-only,
       // must clear a security review — NOT a UI toggle). Exposed read-only so
       // the Runs page shows the "spawn sub-agent" option only when it's live.
@@ -14084,7 +15128,9 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    nest_creation: config.NEST_CREATION,
     people_suggest_all_users: config.PEOPLE_SUGGEST_ALL_USERS,
+    shared_deployment: config.SHARED_DEPLOYMENT,
     // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
     // presence is reported, never the value (same discipline as the OIDC secret).
     sso_token_exchange_enabled: config.SSO_TOKEN_EXCHANGE_ENABLED,
@@ -14104,7 +15150,12 @@ function createApp() {
     anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
     msteams_webhook_url: config.MSTEAMS_WEBHOOK_URL ?? "",
+    email_provider: config.EMAIL_PROVIDER,
     smtp_url: config.SMTP_URL ?? "",
+    ses_region: config.SES_REGION ?? "",
+    ses_access_key_id: config.SES_ACCESS_KEY_ID ?? "",
+    // Write-only, like the OIDC secret — presence only, never the value.
+    ses_secret_access_key_set: !!config.SES_SECRET_ACCESS_KEY,
     notify_email_from: config.NOTIFY_EMAIL_FROM ?? "",
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
@@ -14137,8 +15188,8 @@ function createApp() {
       return c.json({ error: "Invalid JSON body" }, 400);
     }
     const fieldErrors = {};
-    const addError = (field, message) => {
-      fieldErrors[field] = message;
+    const addError = (field2, message) => {
+      fieldErrors[field2] = message;
     };
     const pending = [];
     if ("promptowl_sign_in_gate" in body) {
@@ -14159,7 +15210,9 @@ function createApp() {
     }
     if ("public_base_url" in body) {
       const v = String(body.public_base_url ?? "").trim().replace(/\/$/, "");
-      pending.push({ name: "PUBLIC_BASE_URL", value: v || null });
+      const err = v ? publicBaseUrlError(v) : null;
+      if (err) addError("public_base_url", err);
+      else pending.push({ name: "PUBLIC_BASE_URL", value: v || null });
     }
     if ("telemetry_enabled" in body) {
       pending.push({ name: "TELEMETRY_ENABLED", value: body.telemetry_enabled ? "true" : "false" });
@@ -14307,12 +15360,24 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("nest_creation" in body) {
+      const v = String(body.nest_creation ?? "").trim().toLowerCase();
+      if (v !== "admins" && v !== "everyone")
+        addError("nest_creation", "Nest creation must be admins or everyone.");
+      else pending.push({ name: "NEST_CREATION", value: v });
+    }
     if ("people_suggest_all_users" in body) {
       pending.push({
         name: "PEOPLE_SUGGEST_ALL_USERS",
         value: body.people_suggest_all_users ? "true" : null
       });
     }
+    if ("shared_deployment" in body) {
+      pending.push({
+        name: "SHARED_DEPLOYMENT",
+        value: body.shared_deployment ? "true" : null
+      });
+    }
     if ("sso_token_exchange_enabled" in body) {
       pending.push({
         name: "SSO_TOKEN_EXCHANGE_ENABLED",
@@ -14363,13 +15428,13 @@ function createApp() {
     const effAllowedDomains = "oidc_allowed_domains" in body ? String(body.oidc_allowed_domains ?? "").split(",").map((d) => d.trim()).filter(Boolean) : config.OIDC_ALLOWED_DOMAINS;
     const effAutoProvision = "oidc_auto_provision" in body ? !!body.oidc_auto_provision : config.OIDC_AUTO_PROVISION;
     if (effAutoProvision && effAllowedDomains.length === 0) {
-      for (const field of [
+      for (const field2 of [
         "ms_token_exchange_enabled",
         "google_token_exchange_enabled"
       ]) {
-        if (body[field])
+        if (body[field2])
           addError(
-            field,
+            field2,
             "Set allowed email domains (or turn auto-provision off) before enabling token exchange \u2014 otherwise anyone with an account at that provider can sign themselves up and mint a token."
           );
       }
@@ -14410,6 +15475,50 @@ function createApp() {
         addError("smtp_url", "SMTP connection URL must start with smtp:// or smtps:// (or leave it empty to turn email notifications off).");
       else pending.push({ name: "SMTP_URL", value: v || null });
     }
+    if ("email_provider" in body) {
+      const v = String(body.email_provider ?? "").trim().toLowerCase();
+      if (v !== "smtp" && v !== "ses")
+        addError("email_provider", "Email provider must be SMTP or AWS SES.");
+      else pending.push({ name: "EMAIL_PROVIDER", value: v });
+    }
+    if ("ses_region" in body) {
+      const v = String(body.ses_region ?? "").trim();
+      if (v && !/^[a-z]{2}(-[a-z]+)+-\d+$/.test(v))
+        addError("ses_region", "AWS region must look like us-east-1.");
+      else pending.push({ name: "SES_REGION", value: v || null });
+    }
+    if ("ses_access_key_id" in body) {
+      const v = String(body.ses_access_key_id ?? "").trim();
+      pending.push({ name: "SES_ACCESS_KEY_ID", value: v || null });
+    }
+    if ("ses_secret_access_key" in body) {
+      const v = body.ses_secret_access_key;
+      if (v !== null && typeof v !== "string")
+        addError("ses_secret_access_key", "AWS secret access key must be a string (or empty to clear it).");
+      else pending.push({ name: "SES_SECRET_ACCESS_KEY", value: v?.trim() || null });
+    }
+    const provider = String(body.email_provider ?? "").trim().toLowerCase();
+    if (provider === "smtp" || provider === "ses") {
+      const stale = provider === "ses" ? ["SMTP_URL"] : ["SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"];
+      for (const name of stale) {
+        const i = pending.findIndex((p) => p.name === name);
+        if (i >= 0) pending.splice(i, 1);
+        pending.push({ name, value: null });
+      }
+    }
+    if ("ses_access_key_id" in body || "ses_secret_access_key" in body) {
+      const next = (name, current) => {
+        const p = pending.find((x) => x.name === name);
+        return p ? p.value : current;
+      };
+      const hasId = !!next("SES_ACCESS_KEY_ID", config.SES_ACCESS_KEY_ID);
+      const hasSecret = !!next("SES_SECRET_ACCESS_KEY", config.SES_SECRET_ACCESS_KEY);
+      if (hasId !== hasSecret)
+        addError(
+          "ses_access_key_id",
+          "Set both the AWS access key ID and secret access key, or leave both empty to use the server's IAM role."
+        );
+    }
     if ("notify_email_from" in body) {
       const v = String(body.notify_email_from ?? "").trim();
       if (v && v.includes(","))
@@ -14447,15 +15556,18 @@ function createApp() {
         { error: errorMessages.join("; "), fieldErrors, settings: currentServerSettings() },
         400
       );
-    const smtpChange = pending.find((p) => p.name === "SMTP_URL");
-    if (smtpChange && smtpChange.value) {
-      const result = await verifySmtp(smtpChange.value);
+    const over = Object.fromEntries(pending.map((p) => [p.name, p.value]));
+    const nextEmail = transportSettings(over);
+    const emailFields = nextEmail?.provider === "ses" ? ["EMAIL_PROVIDER", "SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"] : ["EMAIL_PROVIDER", "SMTP_URL"];
+    if (nextEmail && emailFields.some((k) => k in over)) {
+      const result = await verifyEmailTransport(nextEmail);
       if (!result.ok) {
-        const message = `SMTP connection failed: ${result.error}`;
+        const ses = nextEmail.provider === "ses";
+        const message = `${ses ? "AWS SES" : "SMTP"} connection failed: ${result.error}`;
         return c.json(
           {
             error: message,
-            fieldErrors: { smtp_url: message },
+            fieldErrors: { [ses ? "ses_region" : "smtp_url"]: message },
             settings: currentServerSettings()
           },
           400
@@ -14614,6 +15726,10 @@ function createApp() {
   app.use("/admin/community-sites", flexAuthMiddleware);
   app.use("/admin/community-sites/*", flexAuthMiddleware);
   app.route("/admin/community-sites", communitySiteRoutes);
+  app.get("/teams", async (c, next) => {
+    if (isDocumentNavigation(c)) return serveIndexShell(c, next);
+    return next();
+  });
   app.use("/teams/*", flexAuthMiddleware);
   app.use("/teams", flexAuthMiddleware);
   app.route("/teams", teamRoutes);
@@ -14667,7 +15783,7 @@ function createApp() {
     const others = requests.filter((r) => r.requestedBy !== me);
     const nestApprove = new Map(
       await Promise.all(
-        [...new Set(others.map((r) => r.nestId))].map(
+        [...nestName2.keys()].map(
           async (nestId) => [
             nestId,
             await canApproveInNest(nestId, me)
@@ -14697,13 +15813,33 @@ function createApp() {
     );
     waiting.sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
+    const approvableNestIds = [...nestName2.keys()].filter(
+      (id) => nestApprove.get(id)
+    );
+    const restNestIds = [...nestName2.keys()].filter(
+      (id) => !nestApprove.get(id)
+    );
+    const [{ total: approvableReviewTotal }, { total: myReviewsElsewhereTotal }] = await Promise.all([
+      getReviewQueue({ status: "pending", nestIds: approvableNestIds, limit: 1 }),
+      getReviewQueue({
+        status: "pending",
+        nestIds: restNestIds,
+        requestedByEmail: me,
+        limit: 1
+      })
+    ]);
+    const reviewTotal = approvableReviewTotal + myReviewsElsewhereTotal;
+    const deletionsShown = items.filter((i) => i.type === "deletion").length + waiting.filter((i) => i.type === "deletion").length;
     return c.json({
       items,
       waiting,
       notifications,
-      // total = all pending across visible nests (both buckets); has_more drives
-      // the "Load more" control on the client.
-      pagination: { total, limit, offset, has_more: offset + requests.length < total }
+      pagination: {
+        total: reviewTotal + deletionsShown,
+        limit,
+        offset,
+        has_more: offset + requests.length < total
+      }
     });
   });
   app.get("/me/drafts", async (c) => {
@@ -14752,12 +15888,29 @@ function createApp() {
     await markNotificationsRead(me, body.ids === "all" ? "all" : body.ids ?? []);
     return c.json({ ok: true });
   });
+  app.post("/me/nests/:nestId/leave", async (c) => {
+    const nestId = c.req.param("nestId");
+    const me = await resolveCallerEmail(c.get("userId"));
+    const db = getDb();
+    const info = await db.run(
+      "DELETE FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+      [nestId, c.get("userId")]
+    );
+    await db.run(
+      `UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND nest_id = ? AND kind = 'nest_invite' AND read_at IS NULL`,
+      [(/* @__PURE__ */ new Date()).toISOString(), me, nestId]
+    );
+    return c.json({ left: info.changes > 0 });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
-    const visibleNests = await listVisibleNests(userId);
+    const nestScope = c.get("nestScope");
+    const visibleNests = (await listVisibleNests(userId)).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     let documents = 0;
     for (const nest of visibleNests) {
       try {
@@ -14785,8 +15938,12 @@ function createApp() {
     const limit = Math.min(Math.max(Number(c.req.query("limit")) || 20, 1), 50);
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
+    const nestScope = c.get("nestScope");
+    const searchable = (await listVisibleNests(userId, { readable: true })).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     const perNest = await Promise.all(
-      (await listVisibleNests(userId, { readable: true })).map(async (nest) => {
+      searchable.map(async (nest) => {
         try {
           const { storage } = await engineCache.get(nest.id);
           const matches = matchDocuments(await discoverForSearch(storage), q);
@@ -14819,7 +15976,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono25();
+  const nestsApp = new Hono27();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -14949,7 +16106,7 @@ function createApp() {
       );
     }
     const resource = parts[1];
-    if (resource === "visibility" || resource === "reader-mode") {
+    if (resource === "visibility" || resource === "reader-mode" || resource === "branding") {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
@@ -14976,7 +16133,9 @@ function createApp() {
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor"
         );
-      } else if (parts.length === 2 && c.req.method === "POST") {
+      } else if (c.req.method === "POST" && // POST /nodes (create) and POST /nodes/pdf (PDF upload — a create, or
+      // a new version of a pdf node) share the nest-scope editor rule.
+      (parts.length === 2 || parts.length === 3 && parts[2] === "pdf")) {
         const resolved = await resolveStewardsForNode(nestId, "");
         stewardEditorBypass = resolved.some(
           (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && r.steward.scope === "nest"
@@ -15038,11 +16197,13 @@ function createApp() {
   });
   nestsApp.route("/", nestRoutes);
   nestsApp.route("/:nestId", governanceRoutes);
+  nestsApp.route("/:nestId/nodes", pdfNodeRoutes);
   nestsApp.route("/:nestId/nodes", annotationRoutes);
   nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
+  nestsApp.route("/:nestId", brandingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);
   nestsApp.route("/:nestId/publications", publishRoutes);
   nestsApp.route("/:nestId/teams", nestTeamRoutes);
@@ -15066,18 +16227,13 @@ function createApp() {
       onFound: (_p, c) => c.header("Cache-Control", "public, max-age=31536000, immutable")
     })
   );
-  const isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
   app.get(
     "*",
     async (c, next) => {
       if (isDocumentNavigation(c)) return next();
       return c.json({ error: "Not found" }, 404);
     },
-    serveStatic({
-      root: UI_DIR_REL,
-      path: "index.html",
-      onFound: (_p, c) => c.header("Cache-Control", "no-cache")
-    })
+    serveIndexShell
   );
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
@@ -15365,7 +16521,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid19 } from "uuid";
+import { v4 as uuid18 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -15393,7 +16549,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid19()}`;
+      const id = `run_${uuid18()}`;
       const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)