@promptowl/contextnest-community 1.25.0 → 1.27.0

package/dist/index.js

@@ -38,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-DTLMBF4W.js";
+} from "./chunk-VRLAP4HB.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -59,7 +59,7 @@ import {
   stewardDocumentCreator,
   syncFromConfig,
   updateSteward
-} from "./chunk-2KHM5C7V.js";
+} from "./chunk-MB52DWWP.js";
 import {
   createGrant,
   deleteGrant,
@@ -68,16 +68,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-KPGNZLZL.js";
-import {
-  generateApiKey,
-  getKeyPrefix,
-  hashApiKey,
-  hashPassword,
-  parseBearerToken,
-  verifyKeyRequest,
-  verifyPassword
-} from "./chunk-F66VCBLA.js";
+} from "./chunk-VHEMGQ3I.js";
 import {
   attributeRequest,
   checkConflict,
@@ -97,11 +88,12 @@ import {
   getVersions,
   listMyDrafts,
   mergeClient,
+  moveApprovedVersion,
   parseClientMetadata,
   serializeClient,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-TI7HMP64.js";
+} from "./chunk-NFFUZF2B.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -113,7 +105,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-32SZCH36.js";
+} from "./chunk-SE5U4J4T.js";
 import {
   addMember,
   addWatcher,
@@ -121,10 +113,7 @@ import {
   assertSafeNodeId,
   buildDocContext,
   buildTitleMap,
-  canApproveWith,
-  canEditWith,
   capForArchive,
-  collabPermToRole,
   createNest,
   createTeam,
   deleteNest,
@@ -147,7 +136,6 @@ import {
   insertOrIgnore,
   installLicenseKey,
   isConfigSuperAdmin,
-  isEmailConfigured,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
   isNestArchived,
@@ -186,7 +174,6 @@ import {
   persistSetting,
   pinNest,
   pinnedNestIds,
-  primaryRole,
   readIndexedNodes,
   rebuildNodeIndex,
   removeMember,
@@ -202,7 +189,6 @@ import {
   resolveNodeUrl,
   resolveTeamRolesForUser,
   restoreNest,
-  sendEmailToRecipient,
   setAllowSelfApprove,
   setCreatorIsReviewer,
   setPrimeOnlyReview,
@@ -219,9 +205,8 @@ import {
   unpinNest,
   unshareTeamFromNest,
   updateMemberRole,
-  validateLicense,
-  verifySmtp
-} from "./chunk-7FROMOZM.js";
+  validateLicense
+} from "./chunk-QMQDWRHN.js";
 import {
   AppError,
   ConflictError,
@@ -234,13 +219,34 @@ import {
   VaultBusyError,
   isVaultLockTimeout
 } from "./chunk-LHWOJPFE.js";
+import {
+  createInvitedUser,
+  findOrCreateInvitedUser,
+  generateApiKey,
+  getKeyPrefix,
+  hashApiKey,
+  hashPassword,
+  parseBearerToken,
+  verifyKeyRequest,
+  verifyPassword
+} from "./chunk-O3JEI33N.js";
+import {
+  canApproveWith,
+  canEditWith,
+  collabPermToRole,
+  isEmailConfigured,
+  primaryRole,
+  sendEmailToRecipient,
+  transportSettings,
+  verifyEmailTransport
+} from "./chunk-RXCVXG34.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-H3W72HN3.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -254,9 +260,9 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono26 } from "hono";
+import { Hono as Hono28 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
-import { createMiddleware as createMiddleware2 } from "hono/factory";
+import { createMiddleware as createMiddleware3 } from "hono/factory";
 import { cors } from "hono/cors";
 
 // src/shared/artifact-sandbox.ts
@@ -473,6 +479,84 @@ var authMiddleware = createMiddleware(async (c, next) => {
   );
 });
 
+// src/auth/nest-scope-guard.ts
+import { createMiddleware as createMiddleware2 } from "hono/factory";
+var NEST_SCOPED_KEY_CODE = "nest_scoped_key";
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/health",
+  "/license/status",
+  "/llms.txt",
+  "/auth/admin-status"
+]);
+function segmentMatches(seg, nestId) {
+  if (seg === nestId) return true;
+  try {
+    return decodeURIComponent(seg) === nestId;
+  } catch {
+    return false;
+  }
+}
+function nestKeyVerdict(method, rawPath, scope) {
+  const path = rawPath.length > 1 ? rawPath.replace(/\/+$/, "") : rawPath;
+  const isGet = method === "GET" || method === "HEAD";
+  if (PUBLIC_PATHS.has(path) && isGet) return { allowed: true };
+  if (path === "/mcp") return { allowed: true };
+  if (path === "/index" && isGet) return { allowed: true };
+  if ((path === "/search" || path === "/stats" || path === "/nests") && isGet) {
+    return { allowed: true };
+  }
+  if (path.startsWith("/runs/")) return { allowed: true };
+  const m = /^\/nests\/([^/]+)(\/.*)?$/.exec(path);
+  if (m) {
+    if (segmentMatches(m[1], scope)) return { allowed: true };
+    return {
+      allowed: false,
+      reason: "other_nest",
+      mcpTransport: m[2] === "/mcp"
+    };
+  }
+  return { allowed: false, reason: "outside_nest" };
+}
+async function bearerKeyScope(authorization) {
+  const key = parseBearerToken(authorization);
+  if (!key) return null;
+  const row = await getDb().get(
+    "SELECT nest_id FROM api_keys WHERE key_hash = ?",
+    [hashApiKey(key)]
+  );
+  return row?.nest_id ?? null;
+}
+var nestScopedKeyGuard = createMiddleware2(async (c, next) => {
+  const scope = await bearerKeyScope(c.req.header("Authorization"));
+  if (!scope) return next();
+  const verdict = nestKeyVerdict(c.req.method, c.req.path, scope);
+  if (verdict.allowed) return next();
+  const sessionId = getSessionIdFromRequest(c);
+  if (sessionId && await resolveSession(sessionId)) return next();
+  if (verdict.reason === "other_nest") {
+    const error = `API key not authorized for this nest \u2014 this key is scoped to nest "${scope}". Use that nest's MCP URL, or mint a user-level key in the Connect dialog.`;
+    if (verdict.mcpTransport) {
+      let id = null;
+      try {
+        id = (await c.req.json())?.id ?? null;
+      } catch {
+      }
+      return c.json(
+        { jsonrpc: "2.0", id, error: { code: -32e3, message: error } },
+        403
+      );
+    }
+    return c.json({ error, code: NEST_SCOPED_KEY_CODE }, 403);
+  }
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't reach account-wide or server-wide routes (API keys, admin, teams, people, your inbox). Use a key for all your nests for those.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
+});
+
 // src/shared/rate-limit.ts
 var buckets = /* @__PURE__ */ new Map();
 function liveBucket(key, cutoff) {
@@ -719,9 +803,9 @@ function isOidcReady() {
 }
 async function discover(issuer) {
   const now = Date.now();
-  const cached = discoveryCache.get(issuer);
-  if (cached && now - cached.fetchedAt < DISCOVERY_TTL_MS) {
-    return { doc: cached.doc, jwks: cached.jwks };
+  const cached2 = discoveryCache.get(issuer);
+  if (cached2 && now - cached2.fetchedAt < DISCOVERY_TTL_MS) {
+    return { doc: cached2.doc, jwks: cached2.jwks };
   }
   const res = await fetch(`${issuer}/.well-known/openid-configuration`, {
     headers: { Accept: "application/json" },
@@ -1310,7 +1394,7 @@ authRoutes.post("/register", async (c) => {
   if (config.MANUAL_SIGN_IN !== "open") {
     return c.json(
       {
-        error: "Self-registration is disabled on this server. If you were invited, use \u201CSet your password\u201D to activate your account. Otherwise ask your admin for an invite."
+        error: "Self-registration is disabled on this server. If you were invited, sign in with the temporary password from your invite email, or continue with PromptOwl using that email. Otherwise ask your admin for an invite."
       },
       403
     );
@@ -1337,7 +1421,7 @@ authRoutes.post("/register", async (c) => {
     if (existing.is_invited === 1) {
       return c.json(
         {
-          error: "You've been invited to this server. Ask your admin for your temporary password, then sign in and change it \u2014 you can't set it here."
+          error: "You've been invited to this server. Sign in with the temporary password from your invite email, or continue with PromptOwl using this email. Your admin can reset the password if you don't have it."
         },
         409
       );
@@ -1434,10 +1518,36 @@ authRoutes.post("/logout", async (c) => {
   );
   return c.json({ ok: true });
 });
+function refuseNestScopedCaller(c) {
+  if (!c.get("nestScope")) return null;
+  return c.json(
+    {
+      error: "This API key is scoped to one nest and can't create, rotate, list or revoke API keys. Use a key for all your nests, or the web app.",
+      code: NEST_SCOPED_KEY_CODE
+    },
+    403
+  );
+}
+async function checkKeyNest(userId, nestId) {
+  if (typeof nestId !== "string" || !nestId.trim()) {
+    return { error: "nest_id must be a nest id.", status: 400 };
+  }
+  const row = await getDb().get("SELECT id FROM nests WHERE id = ?", [nestId]);
+  const reachable = !!row && (config.AUTH_MODE === "open" || await resolveNestPermission(nestId, userId) !== "none");
+  if (!reachable) {
+    return {
+      error: "Nest not found \u2014 you can only scope a key to a nest you have access to.",
+      status: 404
+    };
+  }
+  return null;
+}
 authRoutes.post("/keys", authMiddleware, async (c) => {
   const body = await c.req.json().catch(
     () => ({})
   );
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1445,6 +1555,10 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     label: body.label
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
+  if (body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   await db.run(
@@ -1459,12 +1573,20 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
     ]
   );
   return c.json(
-    { id: keyId, api_key: apiKey, key_prefix: getKeyPrefix(apiKey), label: check.label },
+    {
+      id: keyId,
+      api_key: apiKey,
+      key_prefix: getKeyPrefix(apiKey),
+      label: check.label,
+      nest_id: body.nest_id || null
+    },
     201
   );
 });
 authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   const body = await c.req.json().catch(() => ({}));
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1474,6 +1596,10 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
+  if ("nest_id" in body && body.nest_id) {
+    const bad = await checkKeyNest(userId, body.nest_id);
+    if (bad) return c.json({ error: bad.error }, bad.status);
+  }
   const apiKey = generateApiKey();
   const keyId = uuid4();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
@@ -1506,10 +1632,13 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
     id: keyId,
     api_key: apiKey,
     key_prefix: getKeyPrefix(apiKey),
-    label: check.label ?? prior.label
+    label: check.label ?? prior.label,
+    nest_id: nestScope
   });
 });
 authRoutes.get("/keys", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, { action: "fetch" });
@@ -1521,6 +1650,8 @@ authRoutes.get("/keys", authMiddleware, async (c) => {
   return c.json({ keys });
 });
 authRoutes.delete("/keys/:keyId", authMiddleware, async (c) => {
+  const refused = refuseNestScopedCaller(c);
+  if (refused) return refused;
   const db = getDb();
   const userId = c.get("userId");
   const check = await verifyKeyRequest(db, userId, {
@@ -1904,47 +2035,30 @@ authRoutes.post("/invite", async (c) => {
     "SELECT id, email, is_invited FROM users WHERE LOWER(email) = ?",
     [email]
   );
-  if (existing && existing.is_invited === 0) {
+  if (existing) {
     return c.json(
       {
-        error: "A user with this email already exists. Use Reset password to issue them a new password."
+        error: existing.is_invited === 0 ? `${email} is already a member of this server.` : `${email} is already invited but hasn't signed in yet. Use Reset password on their row to issue a new temporary password.`
       },
       409
     );
   }
-  const tempPassword = uuid4().replace(/-/g, "").slice(0, 16);
-  const passwordHash = await hashPassword(tempPassword);
-  let userId;
-  if (existing) {
-    userId = existing.id;
-    await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
-      passwordHash,
-      userId
-    ]);
-  } else {
-    userId = uuid4();
-    await db.run(
-      "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-      [userId, email, null, passwordHash]
-    );
-  }
-  trackEvent("admin.invite", { adminId: callerId, email });
   const inviter = await db.get("SELECT email FROM users WHERE id = ?", [
     callerId
   ]);
-  void sendEmailToRecipient(email, {
-    status: "invited",
-    docTitle: "ContextNest",
-    path: "",
-    actor: email,
-    by: inviter?.email || void 0,
-    tempPassword,
-    link: requestBaseUrl(c.req.url)
+  const { id: userId, tempPassword } = await createInvitedUser(email, {
+    invitedBy: inviter?.email,
+    baseUrl: requestBaseUrl(c.req.url)
   });
+  trackEvent("admin.invite", { adminId: callerId, email });
   return c.json(
     {
       temporary_password: tempPassword,
       user: { id: userId, email },
+      // PromptOwl sign-in only counts as an option for them when it's open to all.
+      promptowl_sign_in: config.PROMPTOWL_SIGN_IN_GATE === "open",
+      // Email is configured, so the invite email (with this password) went out.
+      emailed: isEmailConfigured(),
       message: "Share this temporary password securely. Your teammate signs in with their email + this password, then can change it and create their own API key."
     },
     201
@@ -1972,7 +2086,12 @@ authRoutes.get("/teammates", async (c) => {
   const teammates = await db.all(
     `SELECT u.id, u.email, u.name, u.is_invited,
          (SELECT COUNT(*) FROM api_keys WHERE user_id = u.id) as key_count,
-         (SELECT MAX(last_used_at) FROM api_keys WHERE user_id = u.id) as last_active
+         -- Latest of API-key use and web-session activity (same text format).
+         (SELECT MAX(t) FROM (
+            SELECT last_used_at AS t FROM api_keys WHERE user_id = u.id
+            UNION ALL
+            SELECT last_seen_at FROM sessions WHERE user_id = u.id
+          ) activity) as last_active
        FROM users u
        WHERE u.id != ?
        ORDER BY u.created_at DESC`,
@@ -2046,6 +2165,35 @@ function stripUndefinedDeep(value) {
 // src/nodes/service.ts
 import { inputJsonSchema } from "@promptowl/contextnest-engine/api";
 
+// src/governance/approved-body.ts
+async function reconstructApproved(versionManager, nestId, nodeId, approved) {
+  try {
+    return { raw: await versionManager.reconstructVersion(nodeId, approved), version: approved };
+  } catch (err) {
+    const current = await getApprovedVersion(nestId, nodeId);
+    if (current != null && current !== approved) {
+      return { raw: await versionManager.reconstructVersion(nodeId, current), version: current };
+    }
+    const newer = (await getVersions(nestId, nodeId)).filter(
+      (v) => v.version > approved && (v.status === "published" || v.status === "approved")
+    );
+    for (const { version } of newer) {
+      let raw;
+      try {
+        raw = await versionManager.reconstructVersion(nodeId, version);
+      } catch {
+        continue;
+      }
+      if (await moveApprovedVersion(nestId, nodeId, approved, version)) {
+        console.warn(`[approved-heal] ${nestId}/${nodeId}: approved v${approved} \u2192 v${version} (v${approved} could not be rebuilt)`);
+      }
+      return { raw, version };
+    }
+    console.error(`[approved-heal] ${nestId}/${nodeId}: v${approved} can't be rebuilt and no newer published version can`, err);
+    throw err;
+  }
+}
+
 // src/governance/prime-service.ts
 async function isPrimeDocument(nestId, tags, metadata) {
   const flag = documentPrimeFlag(metadata);
@@ -2086,6 +2234,21 @@ function extractMentions(markdown2) {
   }
   return names;
 }
+function stripMentions(text) {
+  const spans = [];
+  const code = (text || "").replace(/```[\s\S]*?```/g, (m) => " ".repeat(m.length)).replace(/`[^`\n]*`/g, (m) => " ".repeat(m.length));
+  let match;
+  MENTION.lastIndex = 0;
+  while ((match = MENTION.exec(code)) !== null) {
+    const lead = match[0].startsWith("@") ? 0 : 1;
+    spans.push([match.index + lead, match.index + match[0].length]);
+  }
+  let out = text || "";
+  for (const [start, end] of spans.reverse()) {
+    out = out.slice(0, start) + out.slice(end);
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
 function newMentions(previous, next) {
   const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
   return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
@@ -2855,13 +3018,16 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.myGrant = grantRoleForNode(myGrants, doc.id);
       }
       if (approvedVersions) {
-        const approved = approvedVersions.get(doc.id);
+        let approved = approvedVersions.get(doc.id);
         if (approved != null) {
           try {
-            const raw = await versionManager.reconstructVersion(
+            let raw;
+            ({ raw, version: approved } = await reconstructApproved(
+              versionManager,
+              nestId,
               doc.id,
               approved
-            );
+            ));
             r.content = bodyOnly(doc.id, raw);
           } catch (err) {
             console.error(
@@ -2930,7 +3096,7 @@ async function vaultFolderPaths(nestId, opts = {}) {
   });
   return entries.map(
     (e) => prefix && e.path.startsWith(`${prefix}/`) ? e.path.slice(prefix.length + 1) : e.path
-  ).filter(Boolean);
+  ).filter((p) => p && !(!prefix && (p === "assets" || p.startsWith("assets/"))));
 }
 async function listNestFolders(nestId, opts = {}) {
   if (opts.folder !== void 0) assertSafeFolder(opts.folder);
@@ -3908,6 +4074,7 @@ async function vaultFolderDir(nestId, rel) {
 }
 async function vaultFolderExists(nestId, rel) {
   if (!rel) return false;
+  assertSafeFolder(rel);
   try {
     return (await stat(await vaultFolderDir(nestId, rel))).isDirectory();
   } catch {
@@ -4066,14 +4233,14 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail, client) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     console.warn(`[unsynced] source missing: ${src}`);
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   const files = collectMarkdownFiles(src, src);
@@ -4122,19 +4289,226 @@ async function deleteUnsyncedFolder(folderName) {
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for delete");
   }
-  let stat2;
+  let stat3;
   try {
-    stat2 = statSync(src);
+    stat3 = statSync(src);
   } catch {
     throw new NotFoundError(`Folder not found: ${folderName}`);
   }
-  if (!stat2.isDirectory()) {
+  if (!stat3.isDirectory()) {
     throw new ValidationError(`Not a directory: ${folderName}`);
   }
   await rm2(src, { recursive: true, force: true });
   console.log(`[unsynced] deleted folder ${src}`);
 }
 
+// src/shared/branding.ts
+import { z } from "zod";
+var HEX_RE = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
+var IMAGE_EXT_RE = /\.(?:png|jpe?g|gif|webp)$/i;
+var ASSET_NAME_RE = /^[0-9a-f-]{36}\.(?:png|jpe?g|gif|webp)$/;
+var BRANDING_LIMITS = {
+  site_title: 120,
+  banner_headline: 120,
+  banner_subtext: 280,
+  footer_text: 280,
+  footer_link_label: 80,
+  url: 2048
+};
+var IMAGE_FIELDS = ["logo_url", "banner_url", "favicon_url"];
+var COLOR_FIELDS = ["accent_color", "header_bg_color", "page_tint_color"];
+var CONTROL_RE = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/;
+var optText = (max) => z.string().max(max).refine((s) => !CONTROL_RE.test(s), "must not contain control characters").nullable().optional();
+var optColor = z.string().regex(HEX_RE, "must be a #rgb or #rrggbb hex color").nullable().optional();
+var optUrl = z.string().max(BRANDING_LIMITS.url).nullable().optional();
+var BrandingSchema = z.strictObject({
+  logo_url: optUrl,
+  banner_url: optUrl,
+  banner_headline: optText(BRANDING_LIMITS.banner_headline),
+  banner_subtext: optText(BRANDING_LIMITS.banner_subtext),
+  accent_color: optColor,
+  header_bg_color: optColor,
+  page_tint_color: optColor,
+  site_title: optText(BRANDING_LIMITS.site_title),
+  footer_text: optText(BRANDING_LIMITS.footer_text),
+  footer_link_url: optUrl,
+  footer_link_label: optText(BRANDING_LIMITS.footer_link_label),
+  favicon_url: optUrl,
+  hide_powered_by: z.boolean().optional()
+});
+function nestAssetName(url, nestId) {
+  const prefix = `/nests/${nestId}/assets/`;
+  if (!url.startsWith(prefix)) return null;
+  const name = url.slice(prefix.length);
+  return ASSET_NAME_RE.test(name) ? name : null;
+}
+function isHttpsImageUrl(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:" || u.username || u.password || !u.hostname) return false;
+  return IMAGE_EXT_RE.test(u.pathname);
+}
+function isHttpsLink(url) {
+  if (!/^https:\/\//i.test(url)) return false;
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" && !u.username && !u.password && !!u.hostname;
+  } catch {
+    return false;
+  }
+}
+function normalizeHex(v) {
+  if (typeof v !== "string" || !HEX_RE.test(v)) return null;
+  let h = v.slice(1).toLowerCase();
+  if (h.length === 3) h = h.split("").map((c) => c + c).join("");
+  return "#" + h;
+}
+function compact(b) {
+  const out = {};
+  for (const [k, v] of Object.entries(b)) {
+    if (v === null || v === void 0) continue;
+    if (typeof v === "string") {
+      const t = v.trim();
+      if (t === "") continue;
+      out[k] = t;
+    } else if (v === true) {
+      out[k] = true;
+    }
+  }
+  if (Object.keys(out).length === 0) return null;
+  return out;
+}
+var BrandingValidationError = class extends Error {
+};
+async function validateBrandingInput(body, nestId, assetExists) {
+  if (body === null || body === void 0) return null;
+  const parsed = BrandingSchema.safeParse(body);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    const field2 = issue?.path?.join(".") || "branding";
+    const msg = issue?.code === "unrecognized_keys" ? `unknown branding field(s): ${issue.keys.join(", ")}` : `${field2}: ${issue?.message ?? "invalid"}`;
+    throw new BrandingValidationError(msg);
+  }
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of COLOR_FIELDS) {
+    if (b[f]) b[f] = normalizeHex(b[f]);
+  }
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (!url) continue;
+    const asset = nestAssetName(url, nestId);
+    if (asset) {
+      if (!await assetExists(asset)) {
+        throw new BrandingValidationError(`${f}: no such asset in this nest`);
+      }
+      continue;
+    }
+    if (!isHttpsImageUrl(url)) {
+      throw new BrandingValidationError(
+        `${f}: must be an image uploaded to this nest or an https:// URL ending in .png, .jpg, .gif or .webp`
+      );
+    }
+    b[f] = new URL(url).href;
+  }
+  if (b.footer_link_url) {
+    if (!isHttpsLink(b.footer_link_url)) {
+      throw new BrandingValidationError("footer_link_url: must be an https:// URL");
+    }
+    b.footer_link_url = new URL(b.footer_link_url).href;
+  }
+  return b;
+}
+function parseStoredBranding(raw, nestId) {
+  if (!raw) return null;
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const parsed = BrandingSchema.safeParse(data);
+  if (!parsed.success) return null;
+  const b = compact(parsed.data);
+  if (!b) return null;
+  for (const f of IMAGE_FIELDS) {
+    const url = b[f];
+    if (url && !nestAssetName(url, nestId) && !isHttpsImageUrl(url)) delete b[f];
+  }
+  if (b.footer_link_url && !isHttpsLink(b.footer_link_url)) delete b.footer_link_url;
+  const kept = compact(b);
+  if (!kept) return null;
+  return { ...kept, hide_powered_by: kept.hide_powered_by === true };
+}
+function rgb(hex) {
+  const h = normalizeHex(hex).slice(1);
+  return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16));
+}
+function toHex([r, g, b]) {
+  return "#" + [r, g, b].map((n) => Math.round(Math.max(0, Math.min(255, n))).toString(16).padStart(2, "0")).join("");
+}
+function relativeLuminance(hex) {
+  const [r, g, b] = rgb(hex).map((v) => {
+    const c = v / 255;
+    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
+  });
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+function contrastRatio(a, b) {
+  const la = relativeLuminance(a);
+  const lb = relativeLuminance(b);
+  return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05);
+}
+function readableForeground(bg) {
+  return contrastRatio("#000000", bg) >= contrastRatio("#ffffff", bg) ? "#000000" : "#ffffff";
+}
+function mixHex(a, b, weight) {
+  const ca = rgb(a);
+  const cb = rgb(b);
+  return toHex([0, 1, 2].map((i) => ca[i] * weight + cb[i] * (1 - weight)));
+}
+function ensureContrast(fg, bg, min = 4.5) {
+  const start = normalizeHex(fg);
+  if (contrastRatio(start, bg) >= min) return start;
+  const target = readableForeground(bg);
+  for (let w = 0.05; w <= 1.0001; w += 0.05) {
+    const c = mixHex(target, start, w);
+    if (contrastRatio(c, bg) >= min) return c;
+  }
+  return target;
+}
+function publishBrandCssVars(b) {
+  if (!b) return "";
+  const decls = [];
+  const tint = normalizeHex(b.page_tint_color);
+  const page = tint ? mixHex(tint, "#ffffff", 0.1) : "#ffffff";
+  const accent = normalizeHex(b.accent_color);
+  if (accent) {
+    const text = ensureContrast(ensureContrast(accent, page), "#ffffff");
+    decls.push(
+      `--cn-accent:${accent}`,
+      `--cn-accent-fg:${readableForeground(accent)}`,
+      `--cn-accent-text:${text}`
+    );
+  }
+  const header = normalizeHex(b.header_bg_color);
+  if (header) decls.push(`--cn-header-bg:${header}`, `--cn-header-fg:${readableForeground(header)}`);
+  if (tint) decls.push(`--cn-page-bg:${page}`);
+  return decls.length ? `:root{${decls.join(";")}}` : "";
+}
+function cssUrl(url) {
+  const safe = url.replace(
+    /["'()\\\s\u0000-\u001f\u007f]/g,
+    (ch) => "%" + ch.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase()
+  );
+  return `url("${safe}")`;
+}
+
 // src/nests/routes.ts
 async function effectiveAccess(nestId, userId) {
   const access = await resolveNestAccess(nestId, userId);
@@ -4157,6 +4531,11 @@ function isGrantOnly(access) {
   return access.permission === "none" && access.hasGrant;
 }
 var nestRoutes = new Hono3();
+function withParsedBranding(nest) {
+  if (!nest) return nest;
+  const { branding_json, ...rest } = nest;
+  return { ...rest, branding: parseStoredBranding(branding_json, nest.id) };
+}
 nestRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const archivedOnly = c.req.query("archived") === "1";
@@ -4212,9 +4591,11 @@ nestRoutes.get("/", async (c) => {
       pinned: pinned.has(n.id)
     };
   };
+  const nestScope = c.get("nestScope");
   const seen = /* @__PURE__ */ new Set();
   const deduped = [];
   for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (nestScope && n.id !== nestScope) continue;
     if (seen.has(n.id)) continue;
     seen.add(n.id);
     deduped.push(n);
@@ -4279,7 +4660,7 @@ nestRoutes.get("/", async (c) => {
       }
     }
   }
-  const withMeta = out.map(
+  const withMeta = out.map((raw) => withParsedBranding(raw)).map(
     (n) => n.grant_only ? {
       ...n,
       document_count: grantedDocsByNest.get(n.id) ?? 0,
@@ -4305,7 +4686,7 @@ nestRoutes.post("/", async (c) => {
     throw new ValidationError("name is required");
   }
   const nest = await createNest(c.get("userId"), body.name, body.description);
-  return c.json({ nest }, 201);
+  return c.json({ nest: withParsedBranding(nest) }, 201);
 });
 nestRoutes.post("/:nestId", async (c) => {
   if (c.req.param("nestId") !== "import") {
@@ -4323,7 +4704,7 @@ nestRoutes.post("/:nestId", async (c) => {
     const email2 = await resolveCallerEmail(userId);
     if (body.finalize) {
       return c.json({
-        nest: nest2,
+        nest: withParsedBranding(nest2),
         documents: await registerImportedDocuments(
           target,
           email2,
@@ -4354,14 +4735,14 @@ nestRoutes.post("/:nestId", async (c) => {
   try {
     const { rejected } = await stageImportedFiles(nest.id, files, email);
     if (body.partial) {
-      return c.json({ nest, rejected }, 201);
+      return c.json({ nest: withParsedBranding(nest), rejected }, 201);
     }
     const documents = await registerImportedDocuments(
       nest.id,
       email,
       attributeRequest(c, body.client)
     );
-    return c.json({ nest, documents, rejected }, 201);
+    return c.json({ nest: withParsedBranding(nest), documents, rejected }, 201);
   } catch (err) {
     await deleteNest(nest.id).catch(() => {
     });
@@ -4427,7 +4808,7 @@ nestRoutes.get("/:nestId", async (c) => {
   const grant_only = roles.length === 0 && isGrantOnly(access);
   const nest = await getNest(nestId);
   return c.json({
-    nest,
+    nest: withParsedBranding(nest),
     permission,
     roles: grant_only ? ["viewer"] : roles,
     myStewards,
@@ -4451,7 +4832,7 @@ nestRoutes.patch("/:nestId", async (c) => {
     name: body.name,
     description: body.description
   });
-  return c.json({ nest });
+  return c.json({ nest: withParsedBranding(nest) });
 });
 nestRoutes.post("/:nestId/pin", async (c) => {
   const nestId = c.req.param("nestId");
@@ -4594,21 +4975,10 @@ async function addCollaborator(params) {
     if (!isEmailish(params.email)) {
       throw new ValidationError("Enter a valid email address.");
     }
-    const email = normalizeEmail(params.email);
-    const existing = await db.get(
-      "SELECT id FROM users WHERE LOWER(email) = ?",
-      [email]
-    );
-    if (existing) {
-      userId = existing.id;
-    } else {
-      const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid6();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid6())]
-      );
-    }
+    userId = (await findOrCreateInvitedUser(params.email, {
+      invitedBy: params.grantedByEmail,
+      baseUrl: params.baseUrl
+    })).id;
   }
   if (!userId) {
     throw new ValidationError("user_id or email is required");
@@ -4667,13 +5037,18 @@ async function addCollaborator(params) {
     // event. Slack/Teams still fire.
     { skipEmail: true }
   );
-  const inviteeEmail = params.email || (await db.get("SELECT email FROM users WHERE id = ?", [userId]))?.email;
+  const invitee = await db.get(
+    "SELECT email, is_invited FROM users WHERE id = ?",
+    [userId]
+  );
+  const inviteeEmail = params.email || invitee?.email;
   if (inviteeEmail) {
+    const nestLink = docLink(nestId, void 0, params.baseUrl);
     void sendEmailToRecipient(inviteeEmail, {
       status: "shared",
       docTitle: shareNestName,
       path: shareNestName,
-      link: docLink(nestId, void 0, params.baseUrl),
+      link: nestLink && invitee?.is_invited === 1 ? `${nestLink}&invite=${encodeURIComponent(inviteeEmail)}` : nestLink,
       actor: inviteeEmail,
       permission: params.permission,
       by: params.grantedByEmail || void 0
@@ -4867,10 +5242,78 @@ sharingRoutes.patch("/reader-mode", async (c) => {
   });
 });
 
-// src/nests/grant-routes.ts
+// src/nests/branding-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid7 } from "uuid";
-var grantRoutes = new Hono5();
+import { access as fsAccess } from "fs/promises";
+import { join as join3 } from "path";
+var brandingRoutes = new Hono5();
+brandingRoutes.patch("/branding", async (c) => {
+  const userId = c.get("userId");
+  const nestId = c.req.param("nestId");
+  const isServerAdmin = config.AUTH_MODE === "open" || await isServerAdminUserId(userId);
+  if (!isServerAdmin) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("admin")) {
+      throw new ForbiddenError(
+        "Only the nest owner, a nest admin, or the server admin can change branding"
+      );
+    }
+  }
+  const db = getDb();
+  if (!await db.get("SELECT id FROM nests WHERE id = ?", [nestId])) {
+    throw new NotFoundError("Nest not found");
+  }
+  const text = await c.req.text();
+  let body = null;
+  if (text.trim() !== "") {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new ValidationError("body must be JSON");
+    }
+  }
+  if (body !== null && (typeof body !== "object" || Array.isArray(body))) {
+    throw new ValidationError("branding must be an object or null");
+  }
+  const assetsDir = join3(resolveNestPath(nestId), "assets");
+  let next;
+  try {
+    next = await validateBrandingInput(body, nestId, async (name) => {
+      try {
+        await fsAccess(join3(assetsDir, name));
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  } catch (err) {
+    if (err instanceof BrandingValidationError) throw new ValidationError(err.message);
+    throw err;
+  }
+  const mentionsHide = body !== null && Object.prototype.hasOwnProperty.call(body, "hide_powered_by");
+  const stored = await db.transaction(async (tx) => {
+    const lock = db.dialect === "postgres" ? " FOR UPDATE" : "";
+    const row = await tx.get(`SELECT branding_json FROM nests WHERE id = ?${lock}`, [nestId]);
+    if (!row) throw new NotFoundError("Nest not found");
+    const wasHidden = parseStoredBranding(row.branding_json, nestId)?.hide_powered_by === true;
+    if (!isServerAdmin) {
+      if (next?.hide_powered_by === true && !wasHidden) {
+        throw new ForbiddenError(
+          'Only the server admin can hide the "Powered by ContextNest" line'
+        );
+      }
+      if (!mentionsHide && wasHidden) next = { ...next ?? {}, hide_powered_by: true };
+    }
+    const value = next ? JSON.stringify(next) : null;
+    await tx.run("UPDATE nests SET branding_json = ? WHERE id = ?", [value, nestId]);
+    return value;
+  });
+  return c.json({ branding: parseStoredBranding(stored, nestId) });
+});
+
+// src/nests/grant-routes.ts
+import { Hono as Hono6 } from "hono";
+var grantRoutes = new Hono6();
 async function requireManage(c, nestId, opts = {}) {
   if (config.AUTH_MODE === "open") return;
   const access = await resolveNestAccess(nestId, c.get("userId"));
@@ -4886,17 +5329,8 @@ async function requireManage(c, nestId, opts = {}) {
   }
 }
 async function resolveGrantee(email) {
-  const db = getDb();
-  const e = normalizeEmail(email);
-  const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-  if (existing) return existing.id;
-  const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid7();
-  await db.run(
-    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid7())]
-  );
-  return id;
+  const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-XEBX6BM4.js");
+  return (await findOrCreateInvitedUser2(email)).id;
 }
 async function assertGrantAddsAccess(params) {
   const { nestId, email, userId, targetType, target, role } = params;
@@ -4993,10 +5427,10 @@ grantRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // src/nests/publish-service.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 var MODES = ["public", "email", "code", "invite"];
 var LINK_TTL_SECONDS = 60 * 60;
@@ -5065,7 +5499,7 @@ async function createPublish(params) {
     );
   }
   const db = getDb();
-  const id = uuid8();
+  const id = uuid7();
   const slug = newSlug();
   const created = nowIso();
   const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
@@ -5096,7 +5530,7 @@ async function createPublish(params) {
       await db.run(
         `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
          VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
-        [uuid8(), id, email, created]
+        [uuid7(), id, email, created]
       );
     }
   }
@@ -5151,7 +5585,7 @@ async function mintMagicLink(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, e, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, e, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -5181,7 +5615,7 @@ async function createSession2(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
-    [uuid8(), publishId, email, sha256Hex(token), expires, nowIso()]
+    [uuid7(), publishId, email, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -5198,7 +5632,7 @@ async function logView(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
-    [uuid8(), publishId, email, nowIso()]
+    [uuid7(), publishId, email, nowIso()]
   );
 }
 async function listAllowlist(publishId) {
@@ -5216,7 +5650,7 @@ async function listViews(publishId) {
 }
 
 // src/nests/publish-routes.ts
-var publishRoutes = new Hono6();
+var publishRoutes = new Hono7();
 async function requireManage2(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
     throw new ForbiddenError(
@@ -5231,7 +5665,7 @@ publishRoutes.post("/", async (c) => {
   const mode = body.access_mode ?? "public";
   if ((mode === "email" || mode === "invite") && !isEmailConfigured()) {
     throw new ValidationError(
-      "Email and invite links need email set up on this server (SMTP_URL and NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
+      "Email and invite links need email set up on this server (SMTP or AWS SES, plus NOTIFY_EMAIL_FROM). Use a public or passcode link instead."
     );
   }
   const row = await createPublish({
@@ -5287,11 +5721,11 @@ publishRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/publish-render-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 import MarkdownIt from "markdown-it";
 
 // src/annotations/service.ts
-import { v4 as uuid9 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -5445,7 +5879,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid9();
+  const id = uuid8();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
@@ -5465,7 +5899,7 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     await tx.run(
       `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
        VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-      [uuid9(), id, authorEmail, body]
+      [uuid8(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -5487,7 +5921,7 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
   await db.run(
     `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
      VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
-    [uuid9(), threadId, authorEmail, trimmed]
+    [uuid8(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -5608,7 +6042,9 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
 }
 
 // src/nests/publish-render-routes.ts
-var publishRenderRoutes = new Hono7();
+import { readFile, stat as stat2 } from "fs/promises";
+import { join as join4 } from "path";
+var publishRenderRoutes = new Hono8();
 var SESSION_TTL_SECONDS2 = 24 * 60 * 60;
 var GATE_LIMIT = { max: 10, windowMs: 10 * 6e4 };
 var COMMENT_LIMIT = { max: 5, windowMs: 10 * 6e4 };
@@ -5665,6 +6101,114 @@ function setSessionCookie2(c, slug, token) {
 function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+var IMAGE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp"
+};
+var INLINE_CAP = { logo: 512 * 1024, favicon: 256 * 1024, banner: 2 * 1024 * 1024 };
+var INLINE_CACHE_MAX_CHARS = 24 * 1024 * 1024;
+var inlineCache = /* @__PURE__ */ new Map();
+var inlineCacheChars = 0;
+function cacheGet(key) {
+  if (!inlineCache.has(key)) return void 0;
+  const v = inlineCache.get(key);
+  inlineCache.delete(key);
+  inlineCache.set(key, v);
+  return v;
+}
+function cachePut(key, v) {
+  const size = v?.length ?? 0;
+  if (size > INLINE_CACHE_MAX_CHARS) return;
+  inlineCacheChars -= inlineCache.get(key)?.length ?? 0;
+  inlineCache.set(key, v);
+  inlineCacheChars += size;
+  for (const [k, old] of inlineCache) {
+    if (inlineCacheChars <= INLINE_CACHE_MAX_CHARS && inlineCache.size <= 512) break;
+    inlineCache.delete(k);
+    inlineCacheChars -= old?.length ?? 0;
+  }
+}
+async function inlineAsset(nestId, url, cap) {
+  if (!url) return null;
+  const name = nestAssetName(url, nestId);
+  if (!name) return null;
+  const key = `${nestId}/${name}/${cap}`;
+  const hit = cacheGet(key);
+  if (hit !== void 0) return hit;
+  let out = null;
+  try {
+    const path = join4(resolveNestPath(nestId), "assets", name);
+    if ((await stat2(path)).size <= cap) {
+      const mime = IMAGE_MIME[name.split(".").pop().toLowerCase()];
+      if (mime) out = `data:${mime};base64,${(await readFile(path)).toString("base64")}`;
+    }
+  } catch {
+    return null;
+  }
+  cachePut(key, out);
+  return out;
+}
+async function loadBrand(row) {
+  let b = null;
+  try {
+    const r = await getDb().get("SELECT branding_json FROM nests WHERE id = ?", [row.nest_id]);
+    b = parseStoredBranding(r?.branding_json, row.nest_id);
+  } catch {
+    b = null;
+  }
+  if (!b) return null;
+  const [logo, banner, favicon] = await Promise.all([
+    inlineAsset(row.nest_id, b.logo_url, INLINE_CAP.logo),
+    inlineAsset(row.nest_id, b.banner_url, INLINE_CAP.banner),
+    inlineAsset(row.nest_id, b.favicon_url, INLINE_CAP.favicon)
+  ]);
+  return { b, logo, banner, favicon };
+}
+var BRAND_CSS = `
+  .cn-brand{display:flex;align-items:center;gap:12px;padding:12px 24px;background:var(--cn-header-bg,#fff);color:var(--cn-header-fg,#1c1917);border-bottom:1px solid rgba(0,0,0,.08);font:600 16px/1.3 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-brand img{height:32px;width:auto;max-width:160px;object-fit:contain}
+  .cn-brand span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .cn-hero{position:relative;min-height:120px;max-height:220px;height:28vw;display:flex;flex-direction:column;justify-content:flex-end;padding:20px 24px;box-sizing:border-box;background:var(--cn-accent,#142a80) center/cover no-repeat;color:var(--cn-accent-fg,#fff);overflow:hidden}
+  .cn-hero.has-img{color:#fff}
+  .cn-hero.has-img::before{content:"";position:absolute;inset:0;background:linear-gradient(to top,rgba(0,0,0,.62),rgba(0,0,0,.08))}
+  .cn-hero *{position:relative;margin:0;max-width:820px}
+  .cn-hero strong{display:block;font:700 clamp(20px,4vw,30px)/1.2 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}
+  .cn-hero p{margin-top:6px;font-size:15px;opacity:.92}
+  .cn-foot{max-width:820px;margin:0 auto;padding:20px 24px 40px;border-top:1px solid #e7e5e4;color:#78716c;font-size:13px;display:flex;flex-wrap:wrap;gap:6px 16px}
+  .cn-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function brandHead(brand, extraCss = "") {
+  if (!brand) return "";
+  const icon = brand.favicon ? `<link rel="icon" href="${esc(brand.favicon)}">` : "";
+  return `<style>${publishBrandCssVars(brand.b)}${BRAND_CSS}${extraCss}</style>${icon}`;
+}
+function brandBar(brand) {
+  if (!brand) return "";
+  const title = brand.b.site_title ? `<span>${esc(brand.b.site_title)}</span>` : "";
+  const logo = brand.logo ? `<img src="${esc(brand.logo)}" alt="">` : "";
+  if (!title && !logo) return "";
+  return `<header class="cn-brand">${logo}${title}</header>`;
+}
+function brandHero(brand) {
+  if (!brand) return "";
+  const { banner_headline: h, banner_subtext: sub } = brand.b;
+  if (!brand.banner && !h) return "";
+  const style = brand.banner ? ` style="background-image:${esc(cssUrl(brand.banner))}"` : "";
+  const cls = brand.banner ? "cn-hero has-img" : "cn-hero";
+  return `<div class="${cls}"${style}>${h ? `<strong>${esc(h)}</strong>` : ""}${sub ? `<p>${esc(sub)}</p>` : ""}</div>`;
+}
+function brandFooter(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(`<span>${esc(text)}</span>`);
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  if (!brand.b.hide_powered_by) parts.push(`<span>Secured by PromptOwl \xB7 ContextNest</span>`);
+  return parts.length ? `<footer class="cn-foot">${parts.join("")}</footer>` : "";
+}
 var NO_DOWNLOAD_CSS = `<style>
   @media print{html,body{display:none !important}}
   html,body{-webkit-user-select:none;-ms-user-select:none;user-select:none}
@@ -5736,7 +6280,10 @@ async function renderPublished(c, row, viewerEmail) {
   }
   const title = esc(artifact.title || row.node_id);
   const heading = /^\s*#\s/.test(body) ? "" : `<h1>${title}</h1>`;
-  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title><style>${PROSE_CSS}</style></head><body><main>${heading}${markdown.render(body)}</main>${overlays}</body></html>`;
+  const brand = await loadBrand(row);
+  const docTitle = brand?.b.site_title ? `${title} \xB7 ${esc(brand.b.site_title)}` : title;
+  const brandCss = brand ? `body{background:var(--cn-page-bg,#fff)}h1,h2,h3,h4,a{color:var(--cn-accent-text,#142a80)}` : "";
+  const shell = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${docTitle}</title><style>${PROSE_CSS}</style>${brandHead(brand, brandCss)}</head><body>${brandBar(brand)}${brandHero(brand)}<main>${heading}${markdown.render(body)}</main>${brandFooter(brand)}${overlays}</body></html>`;
   return c.body(shell, 200, { "Content-Type": "text/html; charset=utf-8" });
 }
 var EYE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7-10-7-10-7Z"/><circle cx="12" cy="12" r="3"/></svg>`;
@@ -5757,7 +6304,27 @@ var GATE_EYE_SCRIPT = `<script>
     });
   })();
 </script>`;
-function gatePage(row, message) {
+var GATE_BRAND_CSS = `
+    body{background:var(--cn-page-bg,#f4f4f5)}
+    .card{box-sizing:border-box;overflow:hidden}
+    h1{color:var(--cn-accent-text,#142a80)}
+    button[type=submit]{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}
+    .cn-brand{margin:-32px -34px 20px;border-radius:14px 14px 0 0;padding:14px 20px}
+    .cn-gate-foot{font-size:12px;color:#a8a29e;margin:10px 0 0;text-align:center}
+    .cn-gate-foot a{color:var(--cn-accent-text,#142a80)}
+`;
+function gateBrandTop(brand) {
+  return brandBar(brand);
+}
+function gateBrandFoot(brand) {
+  if (!brand) return "";
+  const { footer_text: text, footer_link_url: href, footer_link_label: label } = brand.b;
+  const parts = [];
+  if (text) parts.push(esc(text));
+  if (href) parts.push(`<a href="${esc(href)}" rel="noopener noreferrer" target="_blank">${esc(label || href)}</a>`);
+  return parts.length ? `<p class="cn-gate-foot">${parts.join(" \xB7 ")}</p>` : "";
+}
+function gatePage(row, message, brand = null) {
   const wantsCode = row.access_mode === "code";
   const field2 = wantsCode ? `<label>Access code<span class="wrap">
         <input id="cn-code" name="code" type="password" autocomplete="off" required autofocus>
@@ -5782,10 +6349,10 @@ function gatePage(row, message) {
     button.eye svg{width:18px;height:18px;display:block}
     .err{color:#be123c;font-weight:600}
     .brand{font-size:12px;color:#a8a29e;margin:18px 0 0;text-align:center}
-  </style></head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
-    <h1>Protected document</h1><p>${esc(note)}</p>${err}${field2}
+  </style>${brandHead(brand, GATE_BRAND_CSS)}</head><body><form class="card" method="POST" action="/p/${esc(row.slug)}/gate">
+    ${gateBrandTop(brand)}<h1>Protected document</h1><p>${esc(note)}</p>${err}${field2}
     <button type="submit">${cta}</button>
-    <p class="brand">Secured by PromptOwl \xB7 ContextNest</p>
+    ${brand?.b.hide_powered_by ? "" : `<p class="brand">Secured by PromptOwl \xB7 ContextNest</p>`}${gateBrandFoot(brand)}
   </form>${wantsCode ? GATE_EYE_SCRIPT : ""}</body></html>`;
 }
 function unavailablePage() {
@@ -5804,7 +6371,7 @@ function unavailablePage() {
 function sentPage() {
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Check your email</title><style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f4f4f5;color:#1c1917;font:16px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif}.card{background:#fff;border:1px solid #e7e5e4;border-radius:14px;box-shadow:0 4px 24px rgba(20,42,128,.08);padding:32px 34px;max-width:380px;text-align:center}h1{font-size:20px;color:#142a80;margin:0 0 6px}p{color:#78716c;margin:0;font-size:14px}</style></head><body><div class="card"><h1>Check your email</h1><p>If your address has access, a one-time link to open this document is on its way.</p></div></body></html>`;
 }
-function readerShell(row, title, viewerEmail) {
+function readerShell(row, title, viewerEmail, brand = null) {
   const emailField = viewerEmail ? `<p class="who">Commenting as <strong>${esc(viewerEmail)}</strong></p>` : `<label>Your email<input id="cn-email" type="email" autocomplete="email" required></label>`;
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(title)}</title><style>
     html,body{margin:0;height:100%}
@@ -5825,7 +6392,7 @@ function readerShell(row, title, viewerEmail) {
     button[disabled]{opacity:.6;cursor:default}
     .msg{font-weight:600;margin:0 0 14px;font-size:14px}
     .msg.err{color:#be123c}.msg.ok{color:#15803d}
-  </style></head><body>
+  </style>${brand ? `<style>${publishBrandCssVars(brand.b)}#cn-open,#cn-send{background:var(--cn-accent,#142a80);color:var(--cn-accent-fg,#fff)}.card h2{color:var(--cn-accent-text,#142a80)}</style>` : ""}</head><body>
     <iframe id="cn-frame" src="/p/${esc(row.slug)}/view" title="${esc(title)}"></iframe>
     <button id="cn-open" type="button">Leave a comment</button>
     <div id="cn-back"><div class="card" role="dialog" aria-modal="true" aria-label="Leave a comment">
@@ -5896,12 +6463,12 @@ publishRenderRoutes.get("/:slug", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const viewer = await resolveViewer(c, row);
-  if (!viewer) return c.html(gatePage(row));
+  if (!viewer) return c.html(gatePage(row, void 0, await loadBrand(row)));
   if (row.comments_enabled !== 1) return renderPublished(c, row, viewer.email);
   const title = await publishedTitle(row);
   c.header("Content-Security-Policy", SHELL_CSP);
   c.header("Referrer-Policy", "no-referrer");
-  return c.html(readerShell(row, title, viewer.email));
+  return c.html(readerShell(row, title, viewer.email, await loadBrand(row)));
 });
 publishRenderRoutes.get("/:slug/view", async (c) => {
   const slug = c.req.param("slug");
@@ -5939,20 +6506,20 @@ publishRenderRoutes.post("/:slug/gate", async (c) => {
   const row = await getPublishBySlug(slug);
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   if (!tryConsume(`publish-gate:${slug}:${clientIp(c)}`, GATE_LIMIT)) {
-    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes."), 429);
+    return c.html(gatePage(row, "Too many attempts. Try again in a few minutes.", await loadBrand(row)), 429);
   }
   if (row.access_mode === "public") return c.redirect(`/p/${slug}`);
   const form = await c.req.parseBody();
   if (row.access_mode === "code") {
     if (!await verifyCode(row, String(form.code ?? ""))) {
-      return c.html(gatePage(row, "That code is not correct."), 401);
+      return c.html(gatePage(row, "That code is not correct.", await loadBrand(row)), 401);
     }
     setSessionCookie2(c, slug, await createSession2(row.id, null));
     return c.redirect(`/p/${slug}`);
   }
   const email = normalizeEmail(String(form.email ?? ""));
   if (!isEmailish(email)) {
-    return c.html(gatePage(row, "Enter a valid email address."), 400);
+    return c.html(gatePage(row, "Enter a valid email address.", await loadBrand(row)), 400);
   }
   const allowed = row.access_mode !== "invite" || await isAllowlisted(row.id, email);
   const linkToken = await mintMagicLink(row.id, email);
@@ -5972,15 +6539,15 @@ publishRenderRoutes.get("/:slug/verify", async (c) => {
   if (!isLivePublish(row)) return c.html(unavailablePage(), 404);
   const email = await consumeMagicLink(row.id, c.req.query("token") ?? "");
   if (!email) {
-    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one."), 401);
+    return c.html(gatePage(row, "That link is invalid or has expired. Request a new one.", await loadBrand(row)), 401);
   }
   setSessionCookie2(c, slug, await createSession2(row.id, email));
   return c.redirect(`/p/${slug}`);
 });
 
 // src/nests/nest-team-routes.ts
-import { Hono as Hono8 } from "hono";
-var nestTeamRoutes = new Hono8();
+import { Hono as Hono9 } from "hono";
+var nestTeamRoutes = new Hono9();
 nestTeamRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const refs = await listNestTeams(nestId);
@@ -6019,8 +6586,8 @@ nestTeamRoutes.delete("/:teamId", async (c) => {
 });
 
 // src/nests/people-routes.ts
-import { Hono as Hono9 } from "hono";
-var peopleRoutes = new Hono9();
+import { Hono as Hono10 } from "hono";
+var peopleRoutes = new Hono10();
 peopleRoutes.get("/suggest", async (c) => {
   const userId = c.get("userId");
   const q = c.req.query("q") ?? "";
@@ -6030,7 +6597,7 @@ peopleRoutes.get("/suggest", async (c) => {
 });
 
 // src/governance/team-routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/governance/promptowl-teams.ts
 var PROMPTOWL_SOURCE = "promptowl";
@@ -6177,7 +6744,7 @@ async function desiredRoster(poTeam, callerEmail) {
 }
 
 // src/governance/team-routes.ts
-var teamRoutes = new Hono10();
+var teamRoutes = new Hono11();
 var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var CONNECT_REQUIRED = "promptowl_connect_required";
 var CONNECT_REQUIRED_STATUS = 428;
@@ -6362,7 +6929,7 @@ function toSearchHit(node, query) {
 }
 
 // src/nodes/routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 import { parseDocument as parseDocument3, readPdfBinary as readPdfBinary2 } from "@promptowl/contextnest-engine";
 
 // src/nodes/markdown-export.ts
@@ -6415,7 +6982,7 @@ ${m[1]}
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono11();
+var nodeRoutes = new Hono12();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -6498,7 +7065,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-S22V2JKG.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-KDBPWRZI.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -6519,7 +7086,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-4G2XUFS6.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GB43UQVH.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -6675,14 +7242,16 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
   response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
   const approvedOnly = c.req.query("approved_only") === "1" || c.req.query("approved_only") === "true";
   if (publicReader || approvedOnly) {
-    const approved = await getApprovedVersion(nestId, nodeId);
+    let approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
       let approvedRaw = "";
       try {
-        approvedRaw = await versionManager.reconstructVersion(
+        ({ raw: approvedRaw, version: approved } = await reconstructApproved(
+          versionManager,
+          nestId,
           nodeId,
           approved
-        );
+        ));
         response.content = bodyOnly(nodeId, approvedRaw);
         if (response.type === "pdf") {
           const approvedPdf = pdfMetaOf(nodeId, approvedRaw);
@@ -6798,13 +7367,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono12();
+var annotationRoutes = new Hono13();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -6932,7 +7501,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -7371,7 +7940,7 @@ async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
   if (approved == null) return "";
   try {
     const { versions } = await engineCache.get(nestId);
-    const raw = await versions.reconstructVersion(nodeId, approved);
+    const { raw } = await reconstructApproved(versions, nestId, nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
     return "";
@@ -7383,76 +7952,18 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
   if (approved == null) return null;
   try {
     const { versions } = await engineCache.get(nestId);
-    const raw = await versions.reconstructVersion(nodeId, approved);
+    const { raw } = await reconstructApproved(versions, nestId, nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
     return null;
   }
 }
 
-// src/nests/bundle-service.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join3, sep } from "path";
-import JSZip from "jszip";
-import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
-function walkFiles(root) {
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync2(root, { recursive: true });
-  } catch {
-    return out;
-  }
-  for (const rel of entries) {
-    try {
-      if (statSync2(join3(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
-    } catch {
-    }
-  }
-  return out;
-}
-async function exportNestBundle(nestId, includeDrafts) {
-  const db = getDb();
-  const approvedRows = await db.all(
-    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
-    [nestId]
-  );
-  const approvedByNode = new Map(
-    approvedRows.map((r) => [r.node_id, r.approved_version])
-  );
-  const { storage } = await engineCache.get(nestId);
-  const docs = await storage.discoverDocuments();
-  const zip = new JSZip();
-  let count = 0;
-  for (const doc of docs) {
-    const approved = approvedByNode.get(doc.id);
-    const frontmatter = stripUndefinedDeep({ ...doc.frontmatter });
-    let body = doc.body || "";
-    if (approved != null) {
-      const approvedBody = await resolveExportBody(nestId, doc.id, body);
-      if (approvedBody == null) continue;
-      body = approvedBody;
-      frontmatter.status = "published";
-      frontmatter.version = approved;
-    } else {
-      if (!includeDrafts) continue;
-      frontmatter.status = "draft";
-    }
-    zip.file(`${doc.id}.md`, serializeDocument2({ ...doc, frontmatter, body }));
-    count++;
-  }
-  const nestPath = resolveNestPath(nestId);
-  for (const rel of walkFiles(nestPath)) {
-    const segs = rel.split("/");
-    const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
-    if (!keep) continue;
-    zip.file(rel, readFileSync2(join3(nestPath, rel)));
-  }
-  trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
-  return zip.generateAsync({ type: "arraybuffer" });
-}
-
 // src/nodes/graph-service.ts
+import {
+  contextLinkTarget,
+  extractContextLinks
+} from "@promptowl/contextnest-engine";
 var MAX_GRAPH_NODES = 150;
 var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
 function bareSlug(idOrTarget) {
@@ -7470,6 +7981,15 @@ function extractWikiTargets(body) {
   }
   return out;
 }
+function extractContextTargets(body) {
+  const out = /* @__PURE__ */ new Set();
+  if (!body) return [];
+  for (const uri of extractContextLinks(body)) {
+    const t = contextLinkTarget(uri);
+    if (t) out.add(t);
+  }
+  return [...out];
+}
 async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   const { storage } = await engineCache.get(nestId);
   const docs = (await storage.discoverDocuments()).filter(
@@ -7504,6 +8024,15 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
       allLinks.push({ source: d.id, target: targetId });
     }
   }
+  for (const d of accessible) {
+    for (const targetId of extractContextTargets(d.body || "")) {
+      if (!idSet.has(targetId) || targetId === d.id) continue;
+      const key = `${d.id}->${targetId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      allLinks.push({ source: d.id, target: targetId });
+    }
+  }
   const tagCounts = /* @__PURE__ */ new Map();
   const tagToDocs = /* @__PURE__ */ new Map();
   for (const n of allNodes) {
@@ -7615,132 +8144,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   };
 }
 
-// src/nodes/query-routes.ts
-var queryRoutes = new Hono13();
-queryRoutes.get("/changes", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const sinceRaw = c.req.query("since");
-  const sinceMs = sinceRaw ? Date.parse(sinceRaw) : NaN;
-  if (!sinceRaw || Number.isNaN(sinceMs)) {
-    throw new ValidationError(
-      "since must be an ISO-8601 date, e.g. ?since=2026-07-01T00:00:00Z"
-    );
-  }
-  const includeContent = ["1", "true"].includes(
-    c.req.query("include_content") || ""
-  );
-  const all = await listNodesForCaller(nestId, userId, {
-    ...includeContent ? { withContent: true } : {}
-  });
-  const db = getDb();
-  const publicReader = await isPublicReader(nestId, userId);
-  const approvedRows = await db.all(
-    "SELECT node_id, approved_at FROM approved_versions WHERE nest_id = ?",
-    [nestId]
-  );
-  const parseDbTs = (t) => Date.parse(t.includes("T") ? t : `${t.replace(" ", "T")}Z`);
-  const approvedAtMsByNode = new Map(
-    approvedRows.map((r) => [r.node_id, parseDbTs(r.approved_at)])
-  );
-  const publishedSince = new Set(
-    approvedRows.filter((r) => parseDbTs(r.approved_at) > sinceMs).map((r) => r.node_id)
-  );
-  const summarize = (n, updatedOverride) => ({
-    id: n.id,
-    title: n.title,
-    type: n.type,
-    status: n.status,
-    tags: n.tags,
-    created_at: n.created_at,
-    updated_at: updatedOverride ?? n.updated_at,
-    ...includeContent ? { content: n.content } : {}
-  });
-  const created = [];
-  const updated = [];
-  for (const n of all) {
-    if (publicReader) {
-      const approvedMs = approvedAtMsByNode.get(n.id);
-      if (approvedMs === void 0) continue;
-      const approvedIso = new Date(approvedMs).toISOString();
-      const createdAt2 = Date.parse(n.created_at || "");
-      if (!Number.isNaN(createdAt2) && createdAt2 > sinceMs) {
-        created.push(summarize(n, approvedIso));
-      } else if (approvedMs > sinceMs) {
-        updated.push(summarize(n, approvedIso));
-      }
-      continue;
-    }
-    const createdAt = Date.parse(n.created_at || "");
-    const updatedAt = Date.parse(n.updated_at || "");
-    if (!Number.isNaN(createdAt) && createdAt > sinceMs) created.push(summarize(n));
-    else if (!Number.isNaN(updatedAt) && updatedAt > sinceMs) updated.push(summarize(n));
-    else if (publishedSince.has(n.id)) updated.push(summarize(n));
-  }
-  const canSeeDeleted = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
-  let deleted = null;
-  if (canSeeDeleted) {
-    const rows = await db.all(
-      "SELECT node_id, deleted_by, deleted_at FROM node_deletions WHERE nest_id = ? AND deleted_at > ?",
-      [nestId, new Date(sinceMs).toISOString()]
-    );
-    const liveIds = new Set(all.map((n) => n.id));
-    deleted = rows.filter((r) => !liveIds.has(r.node_id)).map((r) => ({ id: r.node_id, deleted_by: r.deleted_by, deleted_at: r.deleted_at }));
-  }
-  return c.json({
-    since: new Date(sinceMs).toISOString(),
-    now: (/* @__PURE__ */ new Date()).toISOString(),
-    created,
-    updated,
-    deleted
-  });
-});
-queryRoutes.get("/runnables", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const all = await listNodesForCaller(nestId, userId, {
-    type: RUNNABLE_NODE_TYPES,
-    // The prompt/skill body IS the payload here — an orchestrator pulls it to
-    // run the thing, so this surface pays for the file reads.
-    withContent: true
-  });
-  const runnables = all.map((n) => ({
-    id: n.id,
-    title: n.title,
-    type: n.type,
-    schedule: n.schedule ?? null,
-    status: n.status,
-    tags: n.tags,
-    updated_at: n.updated_at,
-    content: n.content
-  }));
-  return c.json({ count: runnables.length, runnables });
-});
-queryRoutes.get("/graph", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
-  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
-  if (config.FEATURE_WORKFLOW_PLANE) {
-    const rows = await getDb().all(
-      `SELECT e.from_node, e.to_node, e.condition_mode, t.name as type, t.color, t.is_flow
-         FROM edges e JOIN edge_types t ON t.id = e.type_id
-        WHERE e.nest_id = ?`,
-      [nestId]
-    );
-    const visible = new Set(graph.nodes.map((n) => n.id));
-    graph.typedEdges = rows.filter((r) => visible.has(r.from_node) && visible.has(r.to_node)).map((r) => ({
-      source: r.from_node,
-      target: r.to_node,
-      type: r.type,
-      color: r.color,
-      is_flow: !!r.is_flow,
-      condition_mode: r.condition_mode
-    }));
-  }
-  return c.json(graph);
-});
+// src/nodes/context-service.ts
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -7759,13 +8163,11 @@ ${meta.join("\n")}
 `;
   return header + (node.body || "").trim();
 }
-queryRoutes.post("/context", async (c) => {
-  const body = await c.req.json();
+async function resolveContext(params) {
+  const { nestId, userId, baseUrl, body } = params;
   if (!body.prompt && !body.selector) {
     throw new ValidationError("prompt or selector is required");
   }
-  const nestId = c.req.param("nestId");
-  const baseUrl = requestBaseUrl(c.req.url);
   const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const promptPath = !body.selector?.trim() && !!body.prompt;
@@ -7780,17 +8182,23 @@ queryRoutes.post("/context", async (c) => {
   if (selector && selector.includes("[[")) {
     const parts = selector.split("|").map((p) => p.trim()).filter(Boolean);
     const wantedTitles = /* @__PURE__ */ new Set();
+    const wantedIds = /* @__PURE__ */ new Set();
     const rest = [];
     for (const p of parts) {
       const m = /^\[\[(.+)\]\]$/.exec(p);
-      if (m) wantedTitles.add(m[1].trim().toLowerCase());
-      else rest.push(p);
+      if (!m) {
+        rest.push(p);
+        continue;
+      }
+      const inner = m[1].trim();
+      if (inner.startsWith("nodes/")) wantedIds.add(inner);
+      else wantedTitles.add(inner.toLowerCase());
     }
-    if (wantedTitles.size > 0) {
+    if (wantedTitles.size > 0 || wantedIds.size > 0) {
       selector = rest.join("|") || null;
       resolvedTitleSelector = true;
       titleMatches = allDocs.filter(
-        (d) => wantedTitles.has(String(d.frontmatter.title || "").toLowerCase()) && isVisible(d)
+        (d) => (wantedIds.has(d.id) || wantedTitles.has(String(d.frontmatter.title || "").toLowerCase())) && isVisible(d)
       );
     }
   }
@@ -7820,7 +8228,10 @@ queryRoutes.post("/context", async (c) => {
     hopsUsed = result.hopsUsed;
     nodesTraversed = result.nodesTraversed;
   }
-  if (titleMatches.length > 0 && hops > 0) {
+  const hopSeeds = [
+    ...new Map([...documents, ...titleMatches].map((d) => [d.id, d])).values()
+  ];
+  if (hopSeeds.length > 0 && hops > 0) {
     const byTitle = new Map(
       allDocs.map((d) => [
         String(d.frontmatter.title || "").toLowerCase(),
@@ -7838,9 +8249,13 @@ queryRoutes.post("/context", async (c) => {
         const t = byId.get(target) ?? byTitle.get(target.toLowerCase());
         if (t && t.id !== d.id) link(d.id, t.id);
       }
+      for (const target of extractContextTargets(d.body || "")) {
+        const t = byId.get(target);
+        if (t && t.id !== d.id) link(d.id, t.id);
+      }
     }
-    const seen = new Set(titleMatches.map((d) => d.id));
-    let frontier = titleMatches.map((d) => d.id);
+    const seen = new Set(hopSeeds.map((d) => d.id));
+    let frontier = hopSeeds.map((d) => d.id);
     for (let depth = 0; depth < hops && frontier.length; depth++) {
       const next = [];
       for (const id of frontier) {
@@ -7888,7 +8303,6 @@ queryRoutes.post("/context", async (c) => {
     });
     documents.sort((a, b) => relevance.get(b.id).score - relevance.get(a.id).score);
   }
-  const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const beforePermission = documents.length;
   const accessible = await filterAccessible(nestId, userId, userEmail, documents);
@@ -7913,44 +8327,248 @@ queryRoutes.post("/context", async (c) => {
     included.push(readable[0]);
     tokenCount = approxTokens(formatContextBlock(readable[0], readable[0].url));
   }
-  const truncatedByBudget = accessible.length - included.length;
-  const contextMarkdown = included.map((n) => formatContextBlock(n, n.url)).join("\n\n---\n\n");
-  trackEvent("context.resolve", {
-    nestId,
-    selector_from_prompt: !!compileDetail,
-    included: included.length,
-    permission_filtered: permissionFiltered,
-    token_count: tokenCount
-  });
-  return c.json({
-    context: contextMarkdown,
-    nodes: included.map((n) => ({
-      id: n.id,
-      title: n.frontmatter.title,
-      url: n.url,
-      tags: n.frontmatter.tags || [],
-      type: n.frontmatter.type || "document",
-      ...relevance.get(n.id)
-    })),
-    trace: {
-      selector_used: selector,
-      from_prompt: body.prompt ?? null,
-      compiled: compileDetail ? {
-        matched_tags: compileDetail.matchedTags,
-        matched_titles: compileDetail.matchedTitles,
-        unmatched_tokens: compileDetail.unmatched,
-        fallback
-      } : null,
-      total_matched: documents.length,
-      permission_filtered: permissionFiltered,
-      included: included.length,
-      truncated_by_budget: truncatedByBudget,
-      hops_used: hopsUsed,
-      nodes_traversed: nodesTraversed,
-      approx_tokens: tokenCount,
-      max_tokens: maxTokens
-    }
+  const truncatedByBudget = accessible.length - included.length;
+  const contextMarkdown = included.map((n) => formatContextBlock(n, n.url)).join("\n\n---\n\n");
+  trackEvent("context.resolve", {
+    nestId,
+    selector_from_prompt: !!compileDetail,
+    included: included.length,
+    permission_filtered: permissionFiltered,
+    token_count: tokenCount
+  });
+  return {
+    context: contextMarkdown,
+    blocks: included.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      markdown: formatContextBlock(n, n.url)
+    })),
+    nodes: included.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      url: n.url,
+      tags: n.frontmatter.tags || [],
+      type: n.frontmatter.type || "document",
+      ...relevance.get(n.id)
+    })),
+    trace: {
+      selector_used: selector,
+      from_prompt: body.prompt ?? null,
+      compiled: compileDetail ? {
+        matched_tags: compileDetail.matchedTags,
+        matched_titles: compileDetail.matchedTitles,
+        unmatched_tokens: compileDetail.unmatched,
+        fallback
+      } : null,
+      total_matched: documents.length,
+      permission_filtered: permissionFiltered,
+      included: included.length,
+      truncated_by_budget: truncatedByBudget,
+      hops_used: hopsUsed,
+      nodes_traversed: nodesTraversed,
+      approx_tokens: tokenCount,
+      max_tokens: maxTokens
+    }
+  };
+}
+
+// src/nests/bundle-service.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { join as join5, sep } from "path";
+import JSZip from "jszip";
+import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
+function walkFiles(root) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync2(root, { recursive: true });
+  } catch {
+    return out;
+  }
+  for (const rel of entries) {
+    try {
+      if (statSync2(join5(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function exportNestBundle(nestId, includeDrafts) {
+  const db = getDb();
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const approvedByNode = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const { storage } = await engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const zip = new JSZip();
+  let count = 0;
+  for (const doc of docs) {
+    const approved = approvedByNode.get(doc.id);
+    const frontmatter = stripUndefinedDeep({ ...doc.frontmatter });
+    let body = doc.body || "";
+    if (approved != null) {
+      const approvedBody = await resolveExportBody(nestId, doc.id, body);
+      if (approvedBody == null) continue;
+      body = approvedBody;
+      frontmatter.status = "published";
+      frontmatter.version = approved;
+    } else {
+      if (!includeDrafts) continue;
+      frontmatter.status = "draft";
+    }
+    zip.file(`${doc.id}.md`, serializeDocument2({ ...doc, frontmatter, body }));
+    count++;
+  }
+  const nestPath = resolveNestPath(nestId);
+  for (const rel of walkFiles(nestPath)) {
+    const segs = rel.split("/");
+    const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
+    if (!keep) continue;
+    zip.file(rel, readFileSync2(join5(nestPath, rel)));
+  }
+  trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
+  return zip.generateAsync({ type: "arraybuffer" });
+}
+
+// src/nodes/query-routes.ts
+var queryRoutes = new Hono14();
+queryRoutes.get("/changes", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const sinceRaw = c.req.query("since");
+  const sinceMs = sinceRaw ? Date.parse(sinceRaw) : NaN;
+  if (!sinceRaw || Number.isNaN(sinceMs)) {
+    throw new ValidationError(
+      "since must be an ISO-8601 date, e.g. ?since=2026-07-01T00:00:00Z"
+    );
+  }
+  const includeContent = ["1", "true"].includes(
+    c.req.query("include_content") || ""
+  );
+  const all = await listNodesForCaller(nestId, userId, {
+    ...includeContent ? { withContent: true } : {}
+  });
+  const db = getDb();
+  const publicReader = await isPublicReader(nestId, userId);
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_at FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const parseDbTs = (t) => Date.parse(t.includes("T") ? t : `${t.replace(" ", "T")}Z`);
+  const approvedAtMsByNode = new Map(
+    approvedRows.map((r) => [r.node_id, parseDbTs(r.approved_at)])
+  );
+  const publishedSince = new Set(
+    approvedRows.filter((r) => parseDbTs(r.approved_at) > sinceMs).map((r) => r.node_id)
+  );
+  const summarize = (n, updatedOverride) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    status: n.status,
+    tags: n.tags,
+    created_at: n.created_at,
+    updated_at: updatedOverride ?? n.updated_at,
+    ...includeContent ? { content: n.content } : {}
+  });
+  const created = [];
+  const updated = [];
+  for (const n of all) {
+    if (publicReader) {
+      const approvedMs = approvedAtMsByNode.get(n.id);
+      if (approvedMs === void 0) continue;
+      const approvedIso = new Date(approvedMs).toISOString();
+      const createdAt2 = Date.parse(n.created_at || "");
+      if (!Number.isNaN(createdAt2) && createdAt2 > sinceMs) {
+        created.push(summarize(n, approvedIso));
+      } else if (approvedMs > sinceMs) {
+        updated.push(summarize(n, approvedIso));
+      }
+      continue;
+    }
+    const createdAt = Date.parse(n.created_at || "");
+    const updatedAt = Date.parse(n.updated_at || "");
+    if (!Number.isNaN(createdAt) && createdAt > sinceMs) created.push(summarize(n));
+    else if (!Number.isNaN(updatedAt) && updatedAt > sinceMs) updated.push(summarize(n));
+    else if (publishedSince.has(n.id)) updated.push(summarize(n));
+  }
+  const canSeeDeleted = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  let deleted = null;
+  if (canSeeDeleted) {
+    const rows = await db.all(
+      "SELECT node_id, deleted_by, deleted_at FROM node_deletions WHERE nest_id = ? AND deleted_at > ?",
+      [nestId, new Date(sinceMs).toISOString()]
+    );
+    const liveIds = new Set(all.map((n) => n.id));
+    deleted = rows.filter((r) => !liveIds.has(r.node_id)).map((r) => ({ id: r.node_id, deleted_by: r.deleted_by, deleted_at: r.deleted_at }));
+  }
+  return c.json({
+    since: new Date(sinceMs).toISOString(),
+    now: (/* @__PURE__ */ new Date()).toISOString(),
+    created,
+    updated,
+    deleted
+  });
+});
+queryRoutes.get("/runnables", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const all = await listNodesForCaller(nestId, userId, {
+    type: RUNNABLE_NODE_TYPES,
+    // The prompt/skill body IS the payload here — an orchestrator pulls it to
+    // run the thing, so this surface pays for the file reads.
+    withContent: true
+  });
+  const runnables = all.map((n) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    schedule: n.schedule ?? null,
+    status: n.status,
+    tags: n.tags,
+    updated_at: n.updated_at,
+    content: n.content
+  }));
+  return c.json({ count: runnables.length, runnables });
+});
+queryRoutes.get("/graph", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
+  if (config.FEATURE_WORKFLOW_PLANE) {
+    const rows = await getDb().all(
+      `SELECT e.from_node, e.to_node, e.condition_mode, t.name as type, t.color, t.is_flow
+         FROM edges e JOIN edge_types t ON t.id = e.type_id
+        WHERE e.nest_id = ?`,
+      [nestId]
+    );
+    const visible = new Set(graph.nodes.map((n) => n.id));
+    graph.typedEdges = rows.filter((r) => visible.has(r.from_node) && visible.has(r.to_node)).map((r) => ({
+      source: r.from_node,
+      target: r.to_node,
+      type: r.type,
+      color: r.color,
+      is_flow: !!r.is_flow,
+      condition_mode: r.condition_mode
+    }));
+  }
+  return c.json(graph);
+});
+queryRoutes.post("/context", async (c) => {
+  const body = await c.req.json();
+  const { blocks: _blocks, ...result } = await resolveContext({
+    nestId: c.req.param("nestId"),
+    userId: c.get("userId"),
+    baseUrl: requestBaseUrl(c.req.url),
+    body
   });
+  return c.json(result);
 });
 queryRoutes.post("/table-query", async (c) => {
   const nestId = c.req.param("nestId");
@@ -8206,8 +8824,393 @@ queryRoutes.post("/publish", async (c) => {
   );
 });
 
-// src/mcp/routes.ts
+// src/hootie/routes.ts
 import { Hono as Hono15 } from "hono";
+import { streamSSE } from "hono/streaming";
+
+// src/hootie/model.ts
+import Anthropic from "@anthropic-ai/sdk";
+var plainModels = /* @__PURE__ */ new Set();
+async function* streamAnswer(params) {
+  const client = clientFor(params.apiKey, params.baseUrl ?? null);
+  const key = `${params.baseUrl ?? ""}|${params.model}`;
+  if (plainModels.has(key)) {
+    yield* answer(client, params, false);
+    return;
+  }
+  const state = { started: false };
+  try {
+    yield* answer(client, params, true, state);
+  } catch (err) {
+    if (state.started || err?.status !== 400) throw err;
+    yield* answer(client, params, false);
+    plainModels.add(key);
+  }
+}
+async function* answer(client, params, tuned, state = { started: false }) {
+  const stream = client.messages.stream(
+    tuned ? {
+      model: params.model,
+      max_tokens: 4096,
+      // The system prompt carries the retrieved context — the bulk of the
+      // request, identical across a conversation's turns — so cache it.
+      system: [
+        { type: "text", text: params.system, cache_control: { type: "ephemeral" } }
+      ],
+      messages: params.turns,
+      thinking: { type: "adaptive" },
+      output_config: { effort: "medium" }
+    } : (
+      // The bare request every Messages-speaking model accepts.
+      {
+        model: params.model,
+        max_tokens: 4096,
+        system: params.system,
+        messages: params.turns
+      }
+    ),
+    { signal: params.signal }
+  );
+  for await (const event of stream) {
+    if (event.type === "content_block_delta" && event.delta.type === "text_delta") {
+      state.started = true;
+      yield event.delta.text;
+    }
+  }
+  const final = await stream.finalMessage();
+  if (final.stop_reason === "refusal") {
+    throw new ModelRefusedError(
+      final.stop_details?.explanation || "The model declined to answer that."
+    );
+  }
+}
+function describeModelError(err) {
+  const e = err;
+  const detail = (e?.error?.error?.message || "").toLowerCase();
+  const provider = config.ANTHROPIC_BASE_URL ? "The model gateway" : "Anthropic";
+  if (detail.includes("credit balance") || detail.includes("billing")) {
+    return "Hootie's Anthropic account is out of credit. A server admin needs to add credit in the Anthropic console (Plans & Billing).";
+  }
+  switch (e?.status) {
+    case 401:
+    case 403:
+      return `${provider} rejected this server's API key. A server admin can replace it under Settings \u2192 General.`;
+    case 404:
+      return `No model named "${config.HOOTIE_MODEL}" is available on this key. A server admin can change it under Settings \u2192 General.`;
+    case 413:
+      return "That question plus the documents behind it are too large for one request. Try asking something narrower.";
+    case 429:
+      return `${provider} is rate-limiting this server right now. Try again in a moment.`;
+    case 529:
+      return "The model is overloaded right now. Try again in a moment.";
+  }
+  if (typeof e?.status === "number" && e.status >= 500) {
+    return `${provider} is having trouble right now. Try again in a moment.`;
+  }
+  return "Hootie couldn't reach the model. Try again in a moment.";
+}
+async function verifyModelKey(apiKey, baseUrl) {
+  try {
+    await clientFor(apiKey, baseUrl).models.list(
+      { limit: 1 },
+      { signal: AbortSignal.timeout(1e4) }
+    );
+    return null;
+  } catch (err) {
+    const status = err?.status;
+    if (status === 401 || status === 403) {
+      return baseUrl ? `The model gateway rejected that key (${status}). Check the key and the gateway URL.` : "Anthropic rejected that key. Check it and paste it again.";
+    }
+    console.warn("[hootie] key check inconclusive, saving anyway", status ?? err?.message);
+    return null;
+  }
+}
+var cached = null;
+function clientFor(apiKey, baseUrl) {
+  if (!cached || cached.apiKey !== apiKey || cached.baseUrl !== baseUrl) {
+    cached = {
+      apiKey,
+      baseUrl,
+      client: new Anthropic({ apiKey, ...baseUrl ? { baseURL: baseUrl } : {} })
+    };
+  }
+  return cached.client;
+}
+var ModelRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ModelRefusedError";
+  }
+};
+
+// src/hootie/routes.ts
+var hootieRoutes = new Hono15();
+var MAX_MESSAGE_CHARS = 4e3;
+var MAX_HISTORY_TURNS = 20;
+var MAX_HISTORY_CHARS = 8e3;
+var MAX_HISTORY_RAW = MAX_HISTORY_TURNS * 4;
+var CONTEXT_BUDGET = 6e3;
+var CHAT_BUDGET = { max: 30, windowMs: 5 * 6e4 };
+hootieRoutes.post("/chat", async (c) => {
+  if (!config.HOOTIE_ENABLED) return c.json({ error: "Not found" }, 404);
+  const apiKey = process.env.ANTHROPIC_API_KEY;
+  if (!apiKey) {
+    return c.json(
+      {
+        error: "Hootie needs an Anthropic API key. A server admin can add one under Settings \u2192 General.",
+        reason: "no_api_key"
+      },
+      503
+    );
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const message = typeof body.message === "string" ? body.message.trim() : "";
+  if (!message) return c.json({ error: "message is required" }, 400);
+  if (message.length > MAX_MESSAGE_CHARS) {
+    return c.json(
+      { error: `message is too long (max ${MAX_MESSAGE_CHARS} characters)` },
+      400
+    );
+  }
+  const nodeId = typeof body.node_id === "string" && body.node_id.trim() ? body.node_id.trim() : null;
+  if (nodeId !== null && !isNodeIdShaped(nodeId)) {
+    return c.json({ error: "Node not found" }, 404);
+  }
+  const history = normalizeHistory(body.history);
+  if (history === null) {
+    return c.json(
+      { error: "history must be a list of {role: user|assistant, content}" },
+      400
+    );
+  }
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  if (!tryConsume(`hootie:${userId}`, CHAT_BUDGET)) {
+    return c.json(
+      { error: "Too many questions in a short time \u2014 give it a few minutes." },
+      429
+    );
+  }
+  const userEmail = await resolveCallerEmail(userId);
+  const baseUrl = requestBaseUrl(c.req.url);
+  const nodes = [];
+  const blocks = [];
+  const seen = /* @__PURE__ */ new Set();
+  const take = (r) => {
+    for (let i = 0; i < r.nodes.length; i++) {
+      const n = r.nodes[i];
+      if (seen.has(n.id)) continue;
+      seen.add(n.id);
+      nodes.push(n);
+      blocks.push(r.blocks[i].markdown);
+    }
+  };
+  let anchor = null;
+  if (nodeId) {
+    const r = await resolveContext({
+      nestId,
+      userId,
+      baseUrl,
+      body: {
+        selector: `[[${nodeId}]]`,
+        hops: 1,
+        max_tokens: CONTEXT_BUDGET,
+        include_drafts: true
+      }
+    });
+    anchor = r.nodes.find((n) => n.id === nodeId) ?? null;
+    if (!anchor) return c.json({ error: "Node not found" }, 404);
+    take(r);
+  }
+  const question = stripMentions(message);
+  if (question) {
+    const r = await resolveContext({
+      nestId,
+      userId,
+      baseUrl,
+      body: { prompt: question, max_tokens: CONTEXT_BUDGET }
+    });
+    take(r);
+  }
+  const nest = await getNest(nestId);
+  const system = buildSystemPrompt({
+    nestName: nest?.name ?? "this nest",
+    userEmail,
+    anchor,
+    blocks
+  });
+  const turns = [...history, { role: "user", content: message }];
+  const mentionNames = extractMentions(message);
+  trackEvent("hootie.chat", {
+    nestId,
+    anchored: !!anchor,
+    context_nodes: nodes.length,
+    history_turns: history.length,
+    mentions: mentionNames.length
+  });
+  return streamSSE(c, async (stream) => {
+    const cancel = new AbortController();
+    const hangUp = () => cancel.abort();
+    stream.onAbort(hangUp);
+    c.req.raw.signal.addEventListener("abort", hangUp, { once: true });
+    await stream.writeSSE({
+      event: "meta",
+      data: JSON.stringify({ nodes, anchor })
+    });
+    let answer2 = "";
+    try {
+      for await (const chunk of streamAnswer({
+        apiKey,
+        model: config.HOOTIE_MODEL,
+        baseUrl: config.ANTHROPIC_BASE_URL || null,
+        system,
+        turns,
+        signal: cancel.signal
+      })) {
+        if (cancel.signal.aborted) return;
+        answer2 += chunk;
+        await stream.writeSSE({ event: "delta", data: JSON.stringify({ text: chunk }) });
+      }
+    } catch (err) {
+      if (cancel.signal.aborted) return;
+      const text = err instanceof ModelRefusedError ? err.message : describeModelError(err);
+      console.error("[hootie] model call failed", nestId, err);
+      await stream.writeSSE({ event: "error", data: JSON.stringify({ error: text }) });
+      return;
+    }
+    if (cancel.signal.aborted) return;
+    const cited = citedNodes(answer2, nodes);
+    let mention = null;
+    if (mentionNames.length > 0) {
+      mention = await deliverMentions({
+        nestId,
+        userEmail,
+        baseUrl,
+        message,
+        answer: answer2,
+        anchor: anchor ?? cited[0] ?? null
+      });
+    }
+    await stream.writeSSE({
+      event: "done",
+      data: JSON.stringify({ answer: answer2, cited, mention })
+    });
+  });
+});
+var NODE_ID_SHAPE = /^nodes(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)+$/;
+function isNodeIdShaped(id) {
+  return id.length <= 512 && NODE_ID_SHAPE.test(id);
+}
+function normalizeHistory(raw) {
+  if (raw === void 0 || raw === null) return [];
+  if (!Array.isArray(raw)) return null;
+  const tail = raw.length > MAX_HISTORY_RAW ? raw.slice(-MAX_HISTORY_RAW) : raw;
+  const turns = [];
+  for (const t of tail) {
+    if (!t || typeof t !== "object") return null;
+    const role = t.role;
+    const content = t.content;
+    if (role !== "user" && role !== "assistant" || typeof content !== "string")
+      return null;
+    const text = content.trim();
+    if (!text) continue;
+    turns.push({ role, content: text });
+  }
+  const merged = [];
+  for (const t of turns) {
+    const last = merged[merged.length - 1];
+    if (last && last.role === t.role) last.content += "\n\n" + t.content;
+    else merged.push({ ...t });
+  }
+  let kept = merged.slice(-MAX_HISTORY_TURNS);
+  let chars = kept.reduce((n, t) => n + t.content.length, 0);
+  while (kept.length > 0 && chars > MAX_HISTORY_CHARS) {
+    chars -= kept[0].content.length;
+    kept = kept.slice(1);
+  }
+  while (kept.length > 0 && kept[0].role !== "user") kept = kept.slice(1);
+  while (kept.length > 0 && kept[kept.length - 1].role !== "assistant")
+    kept = kept.slice(0, -1);
+  return kept;
+}
+function buildSystemPrompt(params) {
+  const { nestName: nestName2, userEmail, anchor, blocks } = params;
+  const context = blocks.length > 0 ? blocks.join("\n\n---\n\n").replace(/<\/documents>/gi, "</ documents>") : "(nothing in the nest matched this question)";
+  return [
+    `You are Hootie, the assistant inside the ContextNest nest "${nestName2}". You are talking with ${userEmail}.`,
+    "",
+    "Answer from the documents below and nothing else. They are the governed context this person is allowed to read; do not invent facts that are not in them.",
+    "When you use a document, cite it by its exact title as a wiki link, like [[Title]] \u2014 this is how the reader opens it. Cite every document you drew on, and only those.",
+    "If the documents do not answer the question, say so plainly and, if you can, point to which document comes closest or what to search for. Do not guess.",
+    "Be concise and direct. Use short paragraphs or a short list; no preamble.",
+    "Names written as @someone in the message are colleagues the person is looping in \u2014 they are not questions for you, and you should not address them.",
+    anchor ? `The person currently has the document [[${anchor.title}]] open; "this" in their message means that document unless they say otherwise.` : "The person is looking at the nest as a whole, not a particular document.",
+    "",
+    "<documents>",
+    context,
+    "</documents>"
+  ].join("\n");
+}
+function citedNodes(answer2, nodes) {
+  const lower = answer2.toLowerCase();
+  const seenTitles = /* @__PURE__ */ new Set();
+  const hits = [];
+  for (const n of nodes) {
+    const key = n.title.toLowerCase();
+    if (seenTitles.has(key)) continue;
+    const at = lower.indexOf(`[[${key}]]`);
+    if (at < 0) continue;
+    seenTitles.add(key);
+    hits.push({ n, at });
+  }
+  return hits.sort((a, b) => a.at - b.at).map((x) => x.n);
+}
+async function deliverMentions(params) {
+  const { nestId, userEmail, baseUrl, message, answer: answer2, anchor } = params;
+  if (!anchor) return { status: "undeliverable", reason: "no_anchor" };
+  const body = [
+    `**Asked Hootie:** ${message}`,
+    "",
+    "**Hootie answered:**",
+    answer2.trim()
+  ].join("\n");
+  let threadId;
+  try {
+    const thread = await createThread(
+      nestId,
+      anchor.id,
+      { body, anchor: null, snapshotVersion: null },
+      userEmail
+    );
+    threadId = thread.id;
+  } catch (err) {
+    console.error("[hootie] mention comment failed", nestId, anchor.id, err);
+    return { status: "undeliverable", reason: "post_failed" };
+  }
+  const notified = await notifyCommentMentions({
+    nestId,
+    nodeId: anchor.id,
+    body: message,
+    actorEmail: userEmail,
+    baseUrl
+  });
+  await syncAnnotationsNode(nestId, anchor.id, userEmail);
+  return {
+    status: "posted",
+    node_id: anchor.id,
+    node_title: anchor.title,
+    thread_id: threadId,
+    notified
+  };
+}
+
+// src/mcp/routes.ts
+import { Hono as Hono17 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -8297,10 +9300,10 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid12 } from "uuid";
+import { v4 as uuid11 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid10 } from "uuid";
+import { v4 as uuid9 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -8430,7 +9433,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid10()}`;
+  const id = `run_${uuid9()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -8616,8 +9619,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono14 } from "hono";
-import { v4 as uuid11 } from "uuid";
+import { Hono as Hono16 } from "hono";
+import { v4 as uuid10 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -8735,7 +9738,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono14();
+var edgeRoutes = new Hono16();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -8803,7 +9806,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid11();
+  const id = uuid10();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -9204,7 +10207,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid12();
+  const id = uuid11();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -9268,7 +10271,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid12(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid11(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -9886,7 +10889,7 @@ async function resolveLlmBody(ctx, node, gate) {
   const approved = gate ? gate.approvedVersions?.get(node.id) ?? null : await getApprovedVersion(ctx.nestId, node.id);
   if (approved == null) return null;
   try {
-    return await ctx.versionManager.reconstructVersion(node.id, approved);
+    return (await reconstructApproved(ctx.versionManager, ctx.nestId, node.id, approved)).raw;
   } catch (err) {
     console.error("reconstructVersion failed", node.id, approved, err);
     return null;
@@ -10922,22 +11925,12 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-2OTFS7EH.js");
-        const db = (await import("./client-D44ZHDTJ.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-WICV4Y2J.js");
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
-        let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
-        if (!row) {
-          const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid20 } = await import("uuid");
-          const id = uuid20();
-          await db.run(
-            "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid20())]
-          );
-          row = { id };
-        }
+        const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-XEBX6BM4.js");
+        const row = await findOrCreateInvitedUser2(e, { invitedBy: ctx.userEmail });
         await createGrant2({
           nestId: ctx.nestId,
           targetType,
@@ -10989,8 +11982,8 @@ ${list}`;
 }
 
 // src/mcp/routes.ts
-import { z } from "zod";
-var mcpRoutes = new Hono15();
+import { z as z2 } from "zod";
+var mcpRoutes = new Hono17();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -11008,10 +12001,10 @@ function createMcpServerForNest(nestId, userId, userEmail, baseUrl, c) {
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
       let field2;
-      if (def.type === "string") field2 = z.string();
-      else if (def.type === "number") field2 = z.number();
-      else if (def.type === "array") field2 = z.array(z.string());
-      else field2 = z.any();
+      if (def.type === "string") field2 = z2.string();
+      else if (def.type === "number") field2 = z2.number();
+      else if (def.type === "array") field2 = z2.array(z2.string());
+      else field2 = z2.any();
       if (!required.includes(key)) field2 = field2.optional();
       shape[key] = field2;
     }
@@ -11060,8 +12053,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono16 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid12 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -11179,7 +12172,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono16();
+var runTriggerRoutes = new Hono18();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -11258,7 +12251,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid13()}`;
+  const id = `run_${uuid12()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -11287,7 +12280,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono16();
+var runListRoutes = new Hono18();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11319,7 +12312,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono16();
+var runDetailRoutes = new Hono18();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -11470,8 +12463,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid14 } from "uuid";
+import { Hono as Hono19 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -11508,7 +12501,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono17();
+var scheduleRoutes = new Hono19();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11549,7 +12542,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid14()}`;
+  const id = `sch_${uuid13()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -11604,8 +12597,8 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono18 } from "hono";
-import { v4 as uuid15 } from "uuid";
+import { Hono as Hono20 } from "hono";
+import { v4 as uuid14 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
@@ -11652,7 +12645,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono18();
+var connectorRoutes = new Hono20();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -11671,7 +12664,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid15()}`;
+  const id = `con_${uuid14()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -11714,7 +12707,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono21 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -11737,7 +12730,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono19();
+var hookNestRoutes = new Hono21();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -11808,10 +12801,10 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
   const mine = createHmac2("sha256", Buffer.from(secret, "base64")).update(rawBody, "utf8").digest("base64");
   return safeEqual(mine, authHeader.slice(5).trim());
 }
-function stripMentions(text) {
+function stripMentions2(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono19();
+var hookFireRoutes = new Hono21();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -11859,7 +12852,7 @@ hookFireRoutes.post("/:token", async (c) => {
     if (payload.type === "event_callback") {
       const ev = payload.event ?? {};
       if (ev.type !== "app_mention") return c.json({ ok: true });
-      inputs = { input: stripMentions(String(ev.text ?? "")), from: ev.user, channel: ev.channel };
+      inputs = { input: stripMentions2(String(ev.text ?? "")), from: ev.user, channel: ev.channel };
       ack = () => c.json({ ok: true });
     } else {
       inputs = {
@@ -11877,7 +12870,7 @@ hookFireRoutes.post("/:token", async (c) => {
     if (secret && !teamsSignatureValid(secret, c.req.header("authorization"), raw)) {
       return c.json({ error: "bad signature" }, 401);
     }
-    inputs = { input: stripMentions(String(payload.text ?? "")), from: payload.from?.name };
+    inputs = { input: stripMentions2(String(payload.text ?? "")), from: payload.from?.name };
     ack = (runId2) => c.json({ type: "message", text: `\u23F3 Queued ${hook.agent_node} (run ${runId2.slice(0, 12)}\u2026)` });
   } else {
     inputs = Object.keys(payload).length ? payload : null;
@@ -11913,9 +12906,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono20 } from "hono";
-import { v4 as uuid16 } from "uuid";
-var definitionRoutes = new Hono20();
+import { Hono as Hono22 } from "hono";
+import { v4 as uuid15 } from "uuid";
+var definitionRoutes = new Hono22();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11994,7 +12987,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid16();
+      targetId = uuid15();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -12023,11 +13016,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono21 } from "hono";
-import { v4 as uuid17 } from "uuid";
-import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
-import { join as join4 } from "path";
-var assetRoutes = new Hono21();
+import { Hono as Hono23 } from "hono";
+import { v4 as uuid16 } from "uuid";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { join as join6 } from "path";
+var assetRoutes = new Hono23();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -12073,10 +13066,10 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid17()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join4(resolveNestPath(nestId), "assets");
+  const name = `${uuid16()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const dir = join6(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
-  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
+  await writeFile(join6(dir, name), Buffer.from(await file.arrayBuffer()));
   const url = `/nests/${nestId}/assets/${name}`;
   return c.json(
     {
@@ -12098,7 +13091,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile(join4(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile2(join6(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -12114,19 +13107,21 @@ assetRoutes.get("/:file", async (c) => {
 });
 
 // src/nodes/pdf-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono24 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { createHash as createHash3 } from "crypto";
 import { isPdf, readPdfBinary as readPdfBinary3 } from "@promptowl/contextnest-engine";
-var pdfNodeRoutes = new Hono22();
+var pdfNodeRoutes = new Hono24();
 var PDF_UPLOAD_PATH = /^\/nests\/[^/]+\/nodes\/pdf\/?$/;
 function pdfMaxRequestBytes() {
   return config.PDF_MAX_BYTES + 1024 * 1024;
 }
+function pdfTooLargeMessage(bytes) {
+  const size = bytes === void 0 ? "" : `${(bytes / (1024 * 1024)).toFixed(1)} MB, `;
+  return `PDF too large (${size}max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`;
+}
 function tooLarge(bytes) {
-  return new PayloadTooLargeError(
-    `PDF too large (${(bytes / (1024 * 1024)).toFixed(1)} MB, max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
-  );
+  return new PayloadTooLargeError(pdfTooLargeMessage(bytes));
 }
 function field(body, name) {
   const v = body[name];
@@ -12147,12 +13142,7 @@ pdfNodeRoutes.post(
   "/pdf",
   (c, next) => bodyLimit({
     maxSize: pdfMaxRequestBytes(),
-    onError: (c2) => c2.json(
-      {
-        error: `PDF too large (max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
-      },
-      413
-    )
+    onError: (c2) => c2.json({ error: pdfTooLargeMessage() }, 413)
   })(c, next),
   async (c) => {
     const nestId = c.req.param("nestId");
@@ -12291,7 +13281,7 @@ pdfNodeRoutes.get("/:nodeId{.+}/pdf", async (c, next) => {
 });
 
 // src/auth/community-sites-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono25 } from "hono";
 var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
 var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
 var serializeSite = (site) => ({
@@ -12303,7 +13293,7 @@ var serializeSite = (site) => ({
   created_at: site.created_at,
   updated_at: site.updated_at
 });
-var communitySiteRoutes = new Hono23();
+var communitySiteRoutes = new Hono25();
 communitySiteRoutes.get("/", async (c) => {
   if (!await serverAdminAllowed(c))
     return c.json({ error: "Only the server admin can view this." }, 403);
@@ -12391,10 +13381,10 @@ communitySiteRoutes.delete("/:id", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono26 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var SERVER_WRITE_TOOLS = /* @__PURE__ */ new Set([
   "nest_create",
   "context_create",
@@ -12593,7 +13583,7 @@ async function handleServerToolCall(toolName, args, userId, userEmail, nestScope
       );
       return `Created nest "${nest2.name}" (id: ${nest2.id}). Add documents with context_create, retrieve with the other tools.`;
     } catch (err) {
-      if (err instanceof ValidationError) return err.message;
+      if (err instanceof ValidationError || err instanceof ForbiddenError) return err.message;
       throw err;
     }
   }
@@ -12704,10 +13694,10 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
     const shape = {};
     for (const [key, def] of Object.entries(props)) {
       let field2;
-      if (def.type === "string") field2 = z2.string();
-      else if (def.type === "number") field2 = z2.number();
-      else if (def.type === "array") field2 = z2.array(z2.string());
-      else field2 = z2.any();
+      if (def.type === "string") field2 = z3.string();
+      else if (def.type === "number") field2 = z3.number();
+      else if (def.type === "array") field2 = z3.array(z3.string());
+      else field2 = z3.any();
       if (!required.includes(key)) field2 = field2.optional();
       shape[key] = field2;
     }
@@ -12727,7 +13717,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono24();
+var serverMcpRoutes = new Hono26();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -12750,7 +13740,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono24();
+var nestIndexRoutes = new Hono26();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -12926,14 +13916,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono24();
+var llmsTxtRoutes = new Hono26();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono27 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -13064,7 +14054,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid18 } from "uuid";
+import { v4 as uuid17 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -13080,7 +14070,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid18();
+  const id = uuid17();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -13280,7 +14270,7 @@ function rowToComment(row) {
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync3, existsSync } from "fs";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -13346,9 +14336,9 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join5(nestPath, "stewards.yaml"),
-    join5(nestPath, "stewards.yml"),
-    join5(nestPath, ".context", "stewards.yaml")
+    join7(nestPath, "stewards.yaml"),
+    join7(nestPath, "stewards.yml"),
+    join7(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
@@ -13365,7 +14355,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono25();
+var governanceRoutes = new Hono27();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -13609,7 +14599,7 @@ governanceRoutes.post("/request-deletion", async (c) => {
   if (body.targetType === "folder") {
     const { storage } = await engineCache.get(nestId);
     const docs = await storage.discoverDocuments();
-    if (!docs.some((d) => isIdUnderFolder(d.id, target))) {
+    if (!docs.some((d) => isIdUnderFolder(d.id, target)) && !await vaultFolderExists(nestId, target)) {
       return c.json({ error: `Folder not found: ${target}` }, 404);
     }
   }
@@ -13735,7 +14725,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono25();
+var governanceNodeRoutes = new Hono27();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -14230,23 +15220,29 @@ function publicBaseUrlError(value) {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname as dirname2, join as join6, relative as relative2 } from "path";
+import { dirname as dirname2, join as join8, relative as relative2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 var HERE = dirname2(fileURLToPath(import.meta.url));
 var SERVICE_VERSION = (() => {
   try {
-    return JSON.parse(readFileSync4(join6(HERE, "..", "package.json"), "utf8")).version;
+    return JSON.parse(readFileSync4(join8(HERE, "..", "package.json"), "utf8")).version;
   } catch {
     return "unknown";
   }
 })();
 var UI_DIR_CANDIDATES = [
-  join6(HERE, "web3"),
-  join6(process.cwd(), "dist", "web3")
+  join8(HERE, "web3"),
+  join8(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
-var openModeMiddleware = createMiddleware2(async (c, next) => {
+var isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
+var serveIndexShell = serveStatic({
+  root: UI_DIR_REL,
+  path: "index.html",
+  onFound: (_p, c) => c.header("Cache-Control", "no-cache")
+});
+var openModeMiddleware = createMiddleware3(async (c, next) => {
   const anonId = await ensureAnonymousUser();
   c.set("userId", anonId);
   c.set("nestScope", null);
@@ -14258,7 +15254,7 @@ function isPublicReadEligiblePath(method, path) {
   if (/^\/nests\/[^/]+\/stewards/.test(path)) return false;
   return !/\/(collaborators|visibility|settings|mcp)/.test(path);
 }
-var flexAuthMiddleware = createMiddleware2(async (c, next) => {
+var flexAuthMiddleware = createMiddleware3(async (c, next) => {
   const hasBearer = c.req.header("Authorization")?.startsWith("Bearer cnst_");
   const hasCookie = !!c.req.header("Cookie")?.includes("cnst_session=");
   if (hasBearer || hasCookie) {
@@ -14284,7 +15280,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
 function nestPathParts(path) {
   return path.replace(/^\/nests\//, "").split("/").filter(Boolean);
 }
-var flexAuthWithPromptowlTicket = createMiddleware2(
+var flexAuthWithPromptowlTicket = createMiddleware3(
   async (c, next) => {
     const header = c.req.header("Authorization") || "";
     const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
@@ -14361,7 +15357,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono26({ router: new LinearRouter() });
+  const app = new Hono28({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -14380,11 +15376,13 @@ function createApp() {
     if (lenStr) {
       const len = parseInt(lenStr, 10);
       const isPost = c.req.method === "POST";
-      const cap = isPost && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : isPost && PDF_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, pdfMaxRequestBytes()) : config.MAX_BODY_BYTES;
+      const isPdf2 = isPost && PDF_UPLOAD_PATH.test(c.req.path);
+      const cap = isPost && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : isPdf2 ? Math.max(config.MAX_BODY_BYTES, pdfMaxRequestBytes()) : config.MAX_BODY_BYTES;
       if (Number.isFinite(len) && len > cap) {
         return c.json(
           {
-            error: `Request body too large (${len} bytes, max ${cap})`
+            // A PDF gets the same message as the route's own gates.
+            error: isPdf2 ? pdfTooLargeMessage(len) : `Request body too large (${len} bytes, max ${cap})`
           },
           413
         );
@@ -14411,6 +15409,7 @@ function createApp() {
       client: c.get("clientMetadata")
     });
   });
+  app.use("*", nestScopedKeyGuard);
   app.get("/health", (c) => {
     const oidcReady = isOidcReady();
     return c.json({
@@ -14425,6 +15424,9 @@ function createApp() {
       // Presence only: the publish dialog hides the email/invite gates when
       // this server cannot send mail, because their only way in is a mailed link.
       email_configured: isEmailConfigured(),
+      // Who may create nests (admins | everyone) — the Nests page hides the
+      // create buttons from non-admins when it's admins-only.
+      nest_creation: config.NEST_CREATION,
       // Product analytics for the SPA. The PostHog project key is a public
       // client key, but it only ships while usage telemetry is on — one switch
       // covers everything this server sends outward.
@@ -14453,6 +15455,11 @@ function createApp() {
       // API would refuse it — existing nodes of the type stay readable.
       type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
       type_table_enabled: config.TYPE_TABLE_ENABLED,
+      // Hootie in the nest (default ON). Off → POST /nests/:id/chat 404s and
+      // the UI hides the launcher. Whether it can actually answer is
+      // runner_key_configured above — the UI shows the launcher whenever the
+      // feature is on and explains the missing key, rather than hiding it.
+      hootie_enabled: config.HOOTIE_ENABLED,
       // This server hosts several organizations (PromptOwl-hosted) rather than
       // one. The visibility picker words 'Organization' and 'Public' by it and
       // confirms before 'org'; the server enforces the same in
@@ -14567,6 +15574,9 @@ function createApp() {
     promptowl_teams_enabled: config.PROMPTOWL_TEAMS_ENABLED,
     type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
     type_table_enabled: config.TYPE_TABLE_ENABLED,
+    hootie_enabled: config.HOOTIE_ENABLED,
+    hootie_model: config.HOOTIE_MODEL,
+    anthropic_base_url: config.ANTHROPIC_BASE_URL,
     subagent_runs_enabled: config.FEATURE_SUBAGENT_RUNS,
     subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
     subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
@@ -14580,6 +15590,7 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    nest_creation: config.NEST_CREATION,
     people_suggest_all_users: config.PEOPLE_SUGGEST_ALL_USERS,
     shared_deployment: config.SHARED_DEPLOYMENT,
     // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
@@ -14601,7 +15612,12 @@ function createApp() {
     anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
     msteams_webhook_url: config.MSTEAMS_WEBHOOK_URL ?? "",
+    email_provider: config.EMAIL_PROVIDER,
     smtp_url: config.SMTP_URL ?? "",
+    ses_region: config.SES_REGION ?? "",
+    ses_access_key_id: config.SES_ACCESS_KEY_ID ?? "",
+    // Write-only, like the OIDC secret — presence only, never the value.
+    ses_secret_access_key_set: !!config.SES_SECRET_ACCESS_KEY,
     notify_email_from: config.NOTIFY_EMAIL_FROM ?? "",
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
@@ -14699,6 +15715,38 @@ function createApp() {
         value: body.type_table_enabled ? null : "false"
       });
     }
+    if ("hootie_enabled" in body) {
+      pending.push({
+        name: "HOOTIE_ENABLED",
+        value: body.hootie_enabled ? null : "false"
+      });
+    }
+    if ("hootie_model" in body) {
+      const v = String(body.hootie_model ?? "").trim();
+      if (!v) addError("hootie_model", "Model is required \u2014 e.g. claude-opus-5.");
+      else if (v.length > 200 || /\s/.test(v))
+        addError("hootie_model", "Model must be a single identifier with no spaces.");
+      else pending.push({ name: "HOOTIE_MODEL", value: v === "claude-opus-5" ? null : v });
+    }
+    if ("anthropic_base_url" in body) {
+      const v = String(body.anthropic_base_url ?? "").trim().replace(/\/$/, "");
+      if (!v) pending.push({ name: "ANTHROPIC_BASE_URL", value: null });
+      else {
+        let ok = false;
+        try {
+          const u = new URL(v);
+          ok = (u.protocol === "http:" || u.protocol === "https:") && !!u.host;
+        } catch {
+          ok = false;
+        }
+        if (!ok)
+          addError(
+            "anthropic_base_url",
+            "Model gateway URL must be an http(s) URL, e.g. http://gateway:4000 \u2014 or empty to call Anthropic directly."
+          );
+        else pending.push({ name: "ANTHROPIC_BASE_URL", value: v });
+      }
+    }
     if ("anthropic_api_key" in body) {
       const v = body.anthropic_api_key;
       if (v === null || v === "") {
@@ -14706,7 +15754,12 @@ function createApp() {
       } else if (typeof v !== "string" || !v.trim().startsWith("sk-")) {
         addError("anthropic_api_key", 'Anthropic API key must start with "sk-" (or be empty to clear it).');
       } else {
-        pending.push({ name: "ANTHROPIC_API_KEY", value: v.trim() });
+        const key = v.trim();
+        const patchedBase = pending.find((p) => p.name === "ANTHROPIC_BASE_URL");
+        const baseUrl = patchedBase ? patchedBase.value : config.ANTHROPIC_BASE_URL || null;
+        const rejected = await verifyModelKey(key, baseUrl);
+        if (rejected) addError("anthropic_api_key", rejected);
+        else pending.push({ name: "ANTHROPIC_API_KEY", value: key });
       }
     }
     if ("subagent_runs_enabled" in body) {
@@ -14806,6 +15859,12 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("nest_creation" in body) {
+      const v = String(body.nest_creation ?? "").trim().toLowerCase();
+      if (v !== "admins" && v !== "everyone")
+        addError("nest_creation", "Nest creation must be admins or everyone.");
+      else pending.push({ name: "NEST_CREATION", value: v });
+    }
     if ("people_suggest_all_users" in body) {
       pending.push({
         name: "PEOPLE_SUGGEST_ALL_USERS",
@@ -14915,6 +15974,50 @@ function createApp() {
         addError("smtp_url", "SMTP connection URL must start with smtp:// or smtps:// (or leave it empty to turn email notifications off).");
       else pending.push({ name: "SMTP_URL", value: v || null });
     }
+    if ("email_provider" in body) {
+      const v = String(body.email_provider ?? "").trim().toLowerCase();
+      if (v !== "smtp" && v !== "ses")
+        addError("email_provider", "Email provider must be SMTP or AWS SES.");
+      else pending.push({ name: "EMAIL_PROVIDER", value: v });
+    }
+    if ("ses_region" in body) {
+      const v = String(body.ses_region ?? "").trim();
+      if (v && !/^[a-z]{2}(-[a-z]+)+-\d+$/.test(v))
+        addError("ses_region", "AWS region must look like us-east-1.");
+      else pending.push({ name: "SES_REGION", value: v || null });
+    }
+    if ("ses_access_key_id" in body) {
+      const v = String(body.ses_access_key_id ?? "").trim();
+      pending.push({ name: "SES_ACCESS_KEY_ID", value: v || null });
+    }
+    if ("ses_secret_access_key" in body) {
+      const v = body.ses_secret_access_key;
+      if (v !== null && typeof v !== "string")
+        addError("ses_secret_access_key", "AWS secret access key must be a string (or empty to clear it).");
+      else pending.push({ name: "SES_SECRET_ACCESS_KEY", value: v?.trim() || null });
+    }
+    const provider = String(body.email_provider ?? "").trim().toLowerCase();
+    if (provider === "smtp" || provider === "ses") {
+      const stale = provider === "ses" ? ["SMTP_URL"] : ["SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"];
+      for (const name of stale) {
+        const i = pending.findIndex((p) => p.name === name);
+        if (i >= 0) pending.splice(i, 1);
+        pending.push({ name, value: null });
+      }
+    }
+    if ("ses_access_key_id" in body || "ses_secret_access_key" in body) {
+      const next = (name, current) => {
+        const p = pending.find((x) => x.name === name);
+        return p ? p.value : current;
+      };
+      const hasId = !!next("SES_ACCESS_KEY_ID", config.SES_ACCESS_KEY_ID);
+      const hasSecret = !!next("SES_SECRET_ACCESS_KEY", config.SES_SECRET_ACCESS_KEY);
+      if (hasId !== hasSecret)
+        addError(
+          "ses_access_key_id",
+          "Set both the AWS access key ID and secret access key, or leave both empty to use the server's IAM role."
+        );
+    }
     if ("notify_email_from" in body) {
       const v = String(body.notify_email_from ?? "").trim();
       if (v && v.includes(","))
@@ -14952,15 +16055,18 @@ function createApp() {
         { error: errorMessages.join("; "), fieldErrors, settings: currentServerSettings() },
         400
       );
-    const smtpChange = pending.find((p) => p.name === "SMTP_URL");
-    if (smtpChange && smtpChange.value) {
-      const result = await verifySmtp(smtpChange.value);
+    const over = Object.fromEntries(pending.map((p) => [p.name, p.value]));
+    const nextEmail = transportSettings(over);
+    const emailFields = nextEmail?.provider === "ses" ? ["EMAIL_PROVIDER", "SES_REGION", "SES_ACCESS_KEY_ID", "SES_SECRET_ACCESS_KEY"] : ["EMAIL_PROVIDER", "SMTP_URL"];
+    if (nextEmail && emailFields.some((k) => k in over)) {
+      const result = await verifyEmailTransport(nextEmail);
       if (!result.ok) {
-        const message = `SMTP connection failed: ${result.error}`;
+        const ses = nextEmail.provider === "ses";
+        const message = `${ses ? "AWS SES" : "SMTP"} connection failed: ${result.error}`;
         return c.json(
           {
             error: message,
-            fieldErrors: { smtp_url: message },
+            fieldErrors: { [ses ? "ses_region" : "smtp_url"]: message },
             settings: currentServerSettings()
           },
           400
@@ -15119,6 +16225,10 @@ function createApp() {
   app.use("/admin/community-sites", flexAuthMiddleware);
   app.use("/admin/community-sites/*", flexAuthMiddleware);
   app.route("/admin/community-sites", communitySiteRoutes);
+  app.get("/teams", async (c, next) => {
+    if (isDocumentNavigation(c)) return serveIndexShell(c, next);
+    return next();
+  });
   app.use("/teams/*", flexAuthMiddleware);
   app.use("/teams", flexAuthMiddleware);
   app.route("/teams", teamRoutes);
@@ -15172,7 +16282,7 @@ function createApp() {
     const others = requests.filter((r) => r.requestedBy !== me);
     const nestApprove = new Map(
       await Promise.all(
-        [...new Set(others.map((r) => r.nestId))].map(
+        [...nestName2.keys()].map(
           async (nestId) => [
             nestId,
             await canApproveInNest(nestId, me)
@@ -15202,13 +16312,33 @@ function createApp() {
     );
     waiting.sort(byNewest);
     const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
+    const approvableNestIds = [...nestName2.keys()].filter(
+      (id) => nestApprove.get(id)
+    );
+    const restNestIds = [...nestName2.keys()].filter(
+      (id) => !nestApprove.get(id)
+    );
+    const [{ total: approvableReviewTotal }, { total: myReviewsElsewhereTotal }] = await Promise.all([
+      getReviewQueue({ status: "pending", nestIds: approvableNestIds, limit: 1 }),
+      getReviewQueue({
+        status: "pending",
+        nestIds: restNestIds,
+        requestedByEmail: me,
+        limit: 1
+      })
+    ]);
+    const reviewTotal = approvableReviewTotal + myReviewsElsewhereTotal;
+    const deletionsShown = items.filter((i) => i.type === "deletion").length + waiting.filter((i) => i.type === "deletion").length;
     return c.json({
       items,
       waiting,
       notifications,
-      // total = all pending across visible nests (both buckets); has_more drives
-      // the "Load more" control on the client.
-      pagination: { total, limit, offset, has_more: offset + requests.length < total }
+      pagination: {
+        total: reviewTotal + deletionsShown,
+        limit,
+        offset,
+        has_more: offset + requests.length < total
+      }
     });
   });
   app.get("/me/drafts", async (c) => {
@@ -15257,12 +16387,29 @@ function createApp() {
     await markNotificationsRead(me, body.ids === "all" ? "all" : body.ids ?? []);
     return c.json({ ok: true });
   });
+  app.post("/me/nests/:nestId/leave", async (c) => {
+    const nestId = c.req.param("nestId");
+    const me = await resolveCallerEmail(c.get("userId"));
+    const db = getDb();
+    const info = await db.run(
+      "DELETE FROM nest_collaborators WHERE nest_id = ? AND user_id = ?",
+      [nestId, c.get("userId")]
+    );
+    await db.run(
+      `UPDATE notifications SET read_at = ? WHERE LOWER(user_email) = LOWER(?) AND nest_id = ? AND kind = 'nest_invite' AND read_at IS NULL`,
+      [(/* @__PURE__ */ new Date()).toISOString(), me, nestId]
+    );
+    return c.json({ left: info.changes > 0 });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
-    const visibleNests = await listVisibleNests(userId);
+    const nestScope = c.get("nestScope");
+    const visibleNests = (await listVisibleNests(userId)).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     let documents = 0;
     for (const nest of visibleNests) {
       try {
@@ -15290,8 +16437,12 @@ function createApp() {
     const limit = Math.min(Math.max(Number(c.req.query("limit")) || 20, 1), 50);
     const userId = c.get("userId");
     const userEmail = await resolveCallerEmail(userId);
+    const nestScope = c.get("nestScope");
+    const searchable = (await listVisibleNests(userId, { readable: true })).filter(
+      (n) => !nestScope || n.id === nestScope
+    );
     const perNest = await Promise.all(
-      (await listVisibleNests(userId, { readable: true })).map(async (nest) => {
+      searchable.map(async (nest) => {
         try {
           const { storage } = await engineCache.get(nest.id);
           const matches = matchDocuments(await discoverForSearch(storage), q);
@@ -15324,7 +16475,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono26();
+  const nestsApp = new Hono28();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -15403,7 +16554,7 @@ function createApp() {
     if (access.archived && isMcpTransport) {
       return deny(404, "Nest not found");
     }
-    const isReadQuery = parts.length === 2 && ["context", "query", "search", "export"].includes(parts[1]);
+    const isReadQuery = parts.length === 2 && ["context", "query", "search", "export", "chat"].includes(parts[1]);
     let grantRole = null;
     let grantNestVisible = false;
     if (permission === "none") {
@@ -15454,7 +16605,7 @@ function createApp() {
       );
     }
     const resource = parts[1];
-    if (resource === "visibility" || resource === "reader-mode") {
+    if (resource === "visibility" || resource === "reader-mode" || resource === "branding") {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
@@ -15550,7 +16701,9 @@ function createApp() {
   nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
+  nestsApp.route("/:nestId", hootieRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
+  nestsApp.route("/:nestId", brandingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);
   nestsApp.route("/:nestId/publications", publishRoutes);
   nestsApp.route("/:nestId/teams", nestTeamRoutes);
@@ -15574,18 +16727,13 @@ function createApp() {
       onFound: (_p, c) => c.header("Cache-Control", "public, max-age=31536000, immutable")
     })
   );
-  const isDocumentNavigation = (c) => c.req.header("Sec-Fetch-Mode") === "navigate" || (c.req.header("Accept") || "").includes("text/html");
   app.get(
     "*",
     async (c, next) => {
       if (isDocumentNavigation(c)) return next();
       return c.json({ error: "Not found" }, 404);
     },
-    serveStatic({
-      root: UI_DIR_REL,
-      path: "index.html",
-      onFound: (_p, c) => c.header("Cache-Control", "no-cache")
-    })
+    serveIndexShell
   );
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
@@ -15873,7 +17021,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid19 } from "uuid";
+import { v4 as uuid18 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -15901,7 +17049,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid19()}`;
+      const id = `run_${uuid18()}`;
       const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)