@promptowl/contextnest-community 1.26.0 → 1.27.0

package/dist/index.js

@@ -38,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-M6PGYMBD.js";
+} from "./chunk-VRLAP4HB.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -59,7 +59,7 @@ import {
   stewardDocumentCreator,
   syncFromConfig,
   updateSteward
-} from "./chunk-DGPTJXIV.js";
+} from "./chunk-MB52DWWP.js";
 import {
   createGrant,
   deleteGrant,
@@ -68,7 +68,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-RPGFHESR.js";
+} from "./chunk-VHEMGQ3I.js";
 import {
   attributeRequest,
   checkConflict,
@@ -88,11 +88,12 @@ import {
   getVersions,
   listMyDrafts,
   mergeClient,
+  moveApprovedVersion,
   parseClientMetadata,
   serializeClient,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-IEAWRHMV.js";
+} from "./chunk-NFFUZF2B.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -104,7 +105,7 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-2QOJE7A5.js";
+} from "./chunk-SE5U4J4T.js";
 import {
   addMember,
   addWatcher,
@@ -205,7 +206,7 @@ import {
   unshareTeamFromNest,
   updateMemberRole,
   validateLicense
-} from "./chunk-SWA5M5XX.js";
+} from "./chunk-QMQDWRHN.js";
 import {
   AppError,
   ConflictError,
@@ -228,7 +229,7 @@ import {
   parseBearerToken,
   verifyKeyRequest,
   verifyPassword
-} from "./chunk-PICUHQEM.js";
+} from "./chunk-O3JEI33N.js";
 import {
   canApproveWith,
   canEditWith,
@@ -238,14 +239,14 @@ import {
   sendEmailToRecipient,
   transportSettings,
   verifyEmailTransport
-} from "./chunk-I5EDEZBQ.js";
+} from "./chunk-RXCVXG34.js";
 import {
   config,
   getDb,
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-TRSGPS27.js";
+} from "./chunk-H3W72HN3.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -259,7 +260,7 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono27 } from "hono";
+import { Hono as Hono28 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware3 } from "hono/factory";
 import { cors } from "hono/cors";
@@ -802,9 +803,9 @@ function isOidcReady() {
 }
 async function discover(issuer) {
   const now = Date.now();
-  const cached = discoveryCache.get(issuer);
-  if (cached && now - cached.fetchedAt < DISCOVERY_TTL_MS) {
-    return { doc: cached.doc, jwks: cached.jwks };
+  const cached2 = discoveryCache.get(issuer);
+  if (cached2 && now - cached2.fetchedAt < DISCOVERY_TTL_MS) {
+    return { doc: cached2.doc, jwks: cached2.jwks };
   }
   const res = await fetch(`${issuer}/.well-known/openid-configuration`, {
     headers: { Accept: "application/json" },
@@ -2164,6 +2165,35 @@ function stripUndefinedDeep(value) {
 // src/nodes/service.ts
 import { inputJsonSchema } from "@promptowl/contextnest-engine/api";
 
+// src/governance/approved-body.ts
+async function reconstructApproved(versionManager, nestId, nodeId, approved) {
+  try {
+    return { raw: await versionManager.reconstructVersion(nodeId, approved), version: approved };
+  } catch (err) {
+    const current = await getApprovedVersion(nestId, nodeId);
+    if (current != null && current !== approved) {
+      return { raw: await versionManager.reconstructVersion(nodeId, current), version: current };
+    }
+    const newer = (await getVersions(nestId, nodeId)).filter(
+      (v) => v.version > approved && (v.status === "published" || v.status === "approved")
+    );
+    for (const { version } of newer) {
+      let raw;
+      try {
+        raw = await versionManager.reconstructVersion(nodeId, version);
+      } catch {
+        continue;
+      }
+      if (await moveApprovedVersion(nestId, nodeId, approved, version)) {
+        console.warn(`[approved-heal] ${nestId}/${nodeId}: approved v${approved} \u2192 v${version} (v${approved} could not be rebuilt)`);
+      }
+      return { raw, version };
+    }
+    console.error(`[approved-heal] ${nestId}/${nodeId}: v${approved} can't be rebuilt and no newer published version can`, err);
+    throw err;
+  }
+}
+
 // src/governance/prime-service.ts
 async function isPrimeDocument(nestId, tags, metadata) {
   const flag = documentPrimeFlag(metadata);
@@ -2204,6 +2234,21 @@ function extractMentions(markdown2) {
   }
   return names;
 }
+function stripMentions(text) {
+  const spans = [];
+  const code = (text || "").replace(/```[\s\S]*?```/g, (m) => " ".repeat(m.length)).replace(/`[^`\n]*`/g, (m) => " ".repeat(m.length));
+  let match;
+  MENTION.lastIndex = 0;
+  while ((match = MENTION.exec(code)) !== null) {
+    const lead = match[0].startsWith("@") ? 0 : 1;
+    spans.push([match.index + lead, match.index + match[0].length]);
+  }
+  let out = text || "";
+  for (const [start, end] of spans.reverse()) {
+    out = out.slice(0, start) + out.slice(end);
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
 function newMentions(previous, next) {
   const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
   return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
@@ -2973,13 +3018,16 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         r.myGrant = grantRoleForNode(myGrants, doc.id);
       }
       if (approvedVersions) {
-        const approved = approvedVersions.get(doc.id);
+        let approved = approvedVersions.get(doc.id);
         if (approved != null) {
           try {
-            const raw = await versionManager.reconstructVersion(
+            let raw;
+            ({ raw, version: approved } = await reconstructApproved(
+              versionManager,
+              nestId,
               doc.id,
               approved
-            );
+            ));
             r.content = bodyOnly(doc.id, raw);
           } catch (err) {
             console.error(
@@ -5281,7 +5329,7 @@ async function requireManage(c, nestId, opts = {}) {
   }
 }
 async function resolveGrantee(email) {
-  const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+  const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-XEBX6BM4.js");
   return (await findOrCreateInvitedUser2(email)).id;
 }
 async function assertGrantAddsAccess(params) {
@@ -7017,7 +7065,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-TDZUC2Q6.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-KDBPWRZI.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -7038,7 +7086,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-2EWN7WWO.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-GB43UQVH.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -7194,14 +7242,16 @@ nodeRoutes.get("/:nodeId{.+}", async (c) => {
   response.myGrant = await resolveNodeGrant(nestId, userId, nodeId);
   const approvedOnly = c.req.query("approved_only") === "1" || c.req.query("approved_only") === "true";
   if (publicReader || approvedOnly) {
-    const approved = await getApprovedVersion(nestId, nodeId);
+    let approved = await getApprovedVersion(nestId, nodeId);
     if (approved != null) {
       let approvedRaw = "";
       try {
-        approvedRaw = await versionManager.reconstructVersion(
+        ({ raw: approvedRaw, version: approved } = await reconstructApproved(
+          versionManager,
+          nestId,
           nodeId,
           approved
-        );
+        ));
         response.content = bodyOnly(nodeId, approvedRaw);
         if (response.type === "pdf") {
           const approvedPdf = pdfMetaOf(nodeId, approvedRaw);
@@ -7890,7 +7940,7 @@ async function resolveReadableBody(nestId, nodeId, userId, workingBody) {
   if (approved == null) return "";
   try {
     const { versions } = await engineCache.get(nestId);
-    const raw = await versions.reconstructVersion(nodeId, approved);
+    const { raw } = await reconstructApproved(versions, nestId, nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
     return "";
@@ -7902,75 +7952,13 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
   if (approved == null) return null;
   try {
     const { versions } = await engineCache.get(nestId);
-    const raw = await versions.reconstructVersion(nodeId, approved);
+    const { raw } = await reconstructApproved(versions, nestId, nodeId, approved);
     return bodyOnly(nodeId, raw);
   } catch {
     return null;
   }
 }
 
-// src/nests/bundle-service.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join5, sep } from "path";
-import JSZip from "jszip";
-import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
-function walkFiles(root) {
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync2(root, { recursive: true });
-  } catch {
-    return out;
-  }
-  for (const rel of entries) {
-    try {
-      if (statSync2(join5(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
-    } catch {
-    }
-  }
-  return out;
-}
-async function exportNestBundle(nestId, includeDrafts) {
-  const db = getDb();
-  const approvedRows = await db.all(
-    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
-    [nestId]
-  );
-  const approvedByNode = new Map(
-    approvedRows.map((r) => [r.node_id, r.approved_version])
-  );
-  const { storage } = await engineCache.get(nestId);
-  const docs = await storage.discoverDocuments();
-  const zip = new JSZip();
-  let count = 0;
-  for (const doc of docs) {
-    const approved = approvedByNode.get(doc.id);
-    const frontmatter = stripUndefinedDeep({ ...doc.frontmatter });
-    let body = doc.body || "";
-    if (approved != null) {
-      const approvedBody = await resolveExportBody(nestId, doc.id, body);
-      if (approvedBody == null) continue;
-      body = approvedBody;
-      frontmatter.status = "published";
-      frontmatter.version = approved;
-    } else {
-      if (!includeDrafts) continue;
-      frontmatter.status = "draft";
-    }
-    zip.file(`${doc.id}.md`, serializeDocument2({ ...doc, frontmatter, body }));
-    count++;
-  }
-  const nestPath = resolveNestPath(nestId);
-  for (const rel of walkFiles(nestPath)) {
-    const segs = rel.split("/");
-    const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
-    if (!keep) continue;
-    zip.file(rel, readFileSync2(join5(nestPath, rel)));
-  }
-  trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
-  return zip.generateAsync({ type: "arraybuffer" });
-}
-
 // src/nodes/graph-service.ts
 import {
   contextLinkTarget,
@@ -8156,132 +8144,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
   };
 }
 
-// src/nodes/query-routes.ts
-var queryRoutes = new Hono14();
-queryRoutes.get("/changes", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const sinceRaw = c.req.query("since");
-  const sinceMs = sinceRaw ? Date.parse(sinceRaw) : NaN;
-  if (!sinceRaw || Number.isNaN(sinceMs)) {
-    throw new ValidationError(
-      "since must be an ISO-8601 date, e.g. ?since=2026-07-01T00:00:00Z"
-    );
-  }
-  const includeContent = ["1", "true"].includes(
-    c.req.query("include_content") || ""
-  );
-  const all = await listNodesForCaller(nestId, userId, {
-    ...includeContent ? { withContent: true } : {}
-  });
-  const db = getDb();
-  const publicReader = await isPublicReader(nestId, userId);
-  const approvedRows = await db.all(
-    "SELECT node_id, approved_at FROM approved_versions WHERE nest_id = ?",
-    [nestId]
-  );
-  const parseDbTs = (t) => Date.parse(t.includes("T") ? t : `${t.replace(" ", "T")}Z`);
-  const approvedAtMsByNode = new Map(
-    approvedRows.map((r) => [r.node_id, parseDbTs(r.approved_at)])
-  );
-  const publishedSince = new Set(
-    approvedRows.filter((r) => parseDbTs(r.approved_at) > sinceMs).map((r) => r.node_id)
-  );
-  const summarize = (n, updatedOverride) => ({
-    id: n.id,
-    title: n.title,
-    type: n.type,
-    status: n.status,
-    tags: n.tags,
-    created_at: n.created_at,
-    updated_at: updatedOverride ?? n.updated_at,
-    ...includeContent ? { content: n.content } : {}
-  });
-  const created = [];
-  const updated = [];
-  for (const n of all) {
-    if (publicReader) {
-      const approvedMs = approvedAtMsByNode.get(n.id);
-      if (approvedMs === void 0) continue;
-      const approvedIso = new Date(approvedMs).toISOString();
-      const createdAt2 = Date.parse(n.created_at || "");
-      if (!Number.isNaN(createdAt2) && createdAt2 > sinceMs) {
-        created.push(summarize(n, approvedIso));
-      } else if (approvedMs > sinceMs) {
-        updated.push(summarize(n, approvedIso));
-      }
-      continue;
-    }
-    const createdAt = Date.parse(n.created_at || "");
-    const updatedAt = Date.parse(n.updated_at || "");
-    if (!Number.isNaN(createdAt) && createdAt > sinceMs) created.push(summarize(n));
-    else if (!Number.isNaN(updatedAt) && updatedAt > sinceMs) updated.push(summarize(n));
-    else if (publishedSince.has(n.id)) updated.push(summarize(n));
-  }
-  const canSeeDeleted = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
-  let deleted = null;
-  if (canSeeDeleted) {
-    const rows = await db.all(
-      "SELECT node_id, deleted_by, deleted_at FROM node_deletions WHERE nest_id = ? AND deleted_at > ?",
-      [nestId, new Date(sinceMs).toISOString()]
-    );
-    const liveIds = new Set(all.map((n) => n.id));
-    deleted = rows.filter((r) => !liveIds.has(r.node_id)).map((r) => ({ id: r.node_id, deleted_by: r.deleted_by, deleted_at: r.deleted_at }));
-  }
-  return c.json({
-    since: new Date(sinceMs).toISOString(),
-    now: (/* @__PURE__ */ new Date()).toISOString(),
-    created,
-    updated,
-    deleted
-  });
-});
-queryRoutes.get("/runnables", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const all = await listNodesForCaller(nestId, userId, {
-    type: RUNNABLE_NODE_TYPES,
-    // The prompt/skill body IS the payload here — an orchestrator pulls it to
-    // run the thing, so this surface pays for the file reads.
-    withContent: true
-  });
-  const runnables = all.map((n) => ({
-    id: n.id,
-    title: n.title,
-    type: n.type,
-    schedule: n.schedule ?? null,
-    status: n.status,
-    tags: n.tags,
-    updated_at: n.updated_at,
-    content: n.content
-  }));
-  return c.json({ count: runnables.length, runnables });
-});
-queryRoutes.get("/graph", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
-  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
-  if (config.FEATURE_WORKFLOW_PLANE) {
-    const rows = await getDb().all(
-      `SELECT e.from_node, e.to_node, e.condition_mode, t.name as type, t.color, t.is_flow
-         FROM edges e JOIN edge_types t ON t.id = e.type_id
-        WHERE e.nest_id = ?`,
-      [nestId]
-    );
-    const visible = new Set(graph.nodes.map((n) => n.id));
-    graph.typedEdges = rows.filter((r) => visible.has(r.from_node) && visible.has(r.to_node)).map((r) => ({
-      source: r.from_node,
-      target: r.to_node,
-      type: r.type,
-      color: r.color,
-      is_flow: !!r.is_flow,
-      condition_mode: r.condition_mode
-    }));
-  }
-  return c.json(graph);
-});
+// src/nodes/context-service.ts
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -8300,13 +8163,11 @@ ${meta.join("\n")}
 `;
   return header + (node.body || "").trim();
 }
-queryRoutes.post("/context", async (c) => {
-  const body = await c.req.json();
+async function resolveContext(params) {
+  const { nestId, userId, baseUrl, body } = params;
   if (!body.prompt && !body.selector) {
     throw new ValidationError("prompt or selector is required");
   }
-  const nestId = c.req.param("nestId");
-  const baseUrl = requestBaseUrl(c.req.url);
   const { query: queryEngine, storage } = await engineCache.get(nestId);
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const promptPath = !body.selector?.trim() && !!body.prompt;
@@ -8321,17 +8182,23 @@ queryRoutes.post("/context", async (c) => {
   if (selector && selector.includes("[[")) {
     const parts = selector.split("|").map((p) => p.trim()).filter(Boolean);
     const wantedTitles = /* @__PURE__ */ new Set();
+    const wantedIds = /* @__PURE__ */ new Set();
     const rest = [];
     for (const p of parts) {
       const m = /^\[\[(.+)\]\]$/.exec(p);
-      if (m) wantedTitles.add(m[1].trim().toLowerCase());
-      else rest.push(p);
+      if (!m) {
+        rest.push(p);
+        continue;
+      }
+      const inner = m[1].trim();
+      if (inner.startsWith("nodes/")) wantedIds.add(inner);
+      else wantedTitles.add(inner.toLowerCase());
     }
-    if (wantedTitles.size > 0) {
+    if (wantedTitles.size > 0 || wantedIds.size > 0) {
       selector = rest.join("|") || null;
       resolvedTitleSelector = true;
       titleMatches = allDocs.filter(
-        (d) => wantedTitles.has(String(d.frontmatter.title || "").toLowerCase()) && isVisible(d)
+        (d) => (wantedIds.has(d.id) || wantedTitles.has(String(d.frontmatter.title || "").toLowerCase())) && isVisible(d)
       );
     }
   }
@@ -8436,7 +8303,6 @@ queryRoutes.post("/context", async (c) => {
     });
     documents.sort((a, b) => relevance.get(b.id).score - relevance.get(a.id).score);
   }
-  const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   const beforePermission = documents.length;
   const accessible = await filterAccessible(nestId, userId, userEmail, documents);
@@ -8470,8 +8336,13 @@ queryRoutes.post("/context", async (c) => {
     permission_filtered: permissionFiltered,
     token_count: tokenCount
   });
-  return c.json({
+  return {
     context: contextMarkdown,
+    blocks: included.map((n) => ({
+      id: n.id,
+      title: n.frontmatter.title,
+      markdown: formatContextBlock(n, n.url)
+    })),
     nodes: included.map((n) => ({
       id: n.id,
       title: n.frontmatter.title,
@@ -8498,37 +8369,236 @@ queryRoutes.post("/context", async (c) => {
       approx_tokens: tokenCount,
       max_tokens: maxTokens
     }
-  });
-});
-queryRoutes.post("/table-query", async (c) => {
-  const nestId = c.req.param("nestId");
-  const body = await c.req.json();
-  const ref = typeof body.table === "string" ? body.table.trim() : "";
-  if (!ref) throw new ValidationError("table is required \u2014 [[Title]] or node id");
-  const result = await queryTableNode(
-    nestId,
-    ref,
-    typeof body.query === "string" ? body.query : "",
-    body.include_drafts === true
-  );
-  return c.json(result);
-});
-queryRoutes.post("/query", async (c) => {
-  const body = await c.req.json();
-  if (!body.query) {
-    throw new ValidationError("query is required");
-  }
-  const nestId = c.req.param("nestId");
-  const { query: queryEngine } = await engineCache.get(nestId);
-  const result = await queryEngine.query(body.query, {
-    hops: body.hops ?? 2
-  });
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  const accessible = await filterAccessible(nestId, userId, userEmail, result.documents);
-  return c.json({
-    query: body.query,
-    count: accessible.length,
+  };
+}
+
+// src/nests/bundle-service.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { join as join5, sep } from "path";
+import JSZip from "jszip";
+import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
+function walkFiles(root) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync2(root, { recursive: true });
+  } catch {
+    return out;
+  }
+  for (const rel of entries) {
+    try {
+      if (statSync2(join5(root, rel)).isFile()) out.push(rel.split(sep).join("/"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function exportNestBundle(nestId, includeDrafts) {
+  const db = getDb();
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const approvedByNode = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const { storage } = await engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const zip = new JSZip();
+  let count = 0;
+  for (const doc of docs) {
+    const approved = approvedByNode.get(doc.id);
+    const frontmatter = stripUndefinedDeep({ ...doc.frontmatter });
+    let body = doc.body || "";
+    if (approved != null) {
+      const approvedBody = await resolveExportBody(nestId, doc.id, body);
+      if (approvedBody == null) continue;
+      body = approvedBody;
+      frontmatter.status = "published";
+      frontmatter.version = approved;
+    } else {
+      if (!includeDrafts) continue;
+      frontmatter.status = "draft";
+    }
+    zip.file(`${doc.id}.md`, serializeDocument2({ ...doc, frontmatter, body }));
+    count++;
+  }
+  const nestPath = resolveNestPath(nestId);
+  for (const rel of walkFiles(nestPath)) {
+    const segs = rel.split("/");
+    const keep = segs.includes(".versions") || rel === ".context/config.yaml" || rel === "CONTEXT.md";
+    if (!keep) continue;
+    zip.file(rel, readFileSync2(join5(nestPath, rel)));
+  }
+  trackEvent("nest.export.bundle", { nestId, documents: count, includeDrafts });
+  return zip.generateAsync({ type: "arraybuffer" });
+}
+
+// src/nodes/query-routes.ts
+var queryRoutes = new Hono14();
+queryRoutes.get("/changes", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const sinceRaw = c.req.query("since");
+  const sinceMs = sinceRaw ? Date.parse(sinceRaw) : NaN;
+  if (!sinceRaw || Number.isNaN(sinceMs)) {
+    throw new ValidationError(
+      "since must be an ISO-8601 date, e.g. ?since=2026-07-01T00:00:00Z"
+    );
+  }
+  const includeContent = ["1", "true"].includes(
+    c.req.query("include_content") || ""
+  );
+  const all = await listNodesForCaller(nestId, userId, {
+    ...includeContent ? { withContent: true } : {}
+  });
+  const db = getDb();
+  const publicReader = await isPublicReader(nestId, userId);
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_at FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const parseDbTs = (t) => Date.parse(t.includes("T") ? t : `${t.replace(" ", "T")}Z`);
+  const approvedAtMsByNode = new Map(
+    approvedRows.map((r) => [r.node_id, parseDbTs(r.approved_at)])
+  );
+  const publishedSince = new Set(
+    approvedRows.filter((r) => parseDbTs(r.approved_at) > sinceMs).map((r) => r.node_id)
+  );
+  const summarize = (n, updatedOverride) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    status: n.status,
+    tags: n.tags,
+    created_at: n.created_at,
+    updated_at: updatedOverride ?? n.updated_at,
+    ...includeContent ? { content: n.content } : {}
+  });
+  const created = [];
+  const updated = [];
+  for (const n of all) {
+    if (publicReader) {
+      const approvedMs = approvedAtMsByNode.get(n.id);
+      if (approvedMs === void 0) continue;
+      const approvedIso = new Date(approvedMs).toISOString();
+      const createdAt2 = Date.parse(n.created_at || "");
+      if (!Number.isNaN(createdAt2) && createdAt2 > sinceMs) {
+        created.push(summarize(n, approvedIso));
+      } else if (approvedMs > sinceMs) {
+        updated.push(summarize(n, approvedIso));
+      }
+      continue;
+    }
+    const createdAt = Date.parse(n.created_at || "");
+    const updatedAt = Date.parse(n.updated_at || "");
+    if (!Number.isNaN(createdAt) && createdAt > sinceMs) created.push(summarize(n));
+    else if (!Number.isNaN(updatedAt) && updatedAt > sinceMs) updated.push(summarize(n));
+    else if (publishedSince.has(n.id)) updated.push(summarize(n));
+  }
+  const canSeeDeleted = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  let deleted = null;
+  if (canSeeDeleted) {
+    const rows = await db.all(
+      "SELECT node_id, deleted_by, deleted_at FROM node_deletions WHERE nest_id = ? AND deleted_at > ?",
+      [nestId, new Date(sinceMs).toISOString()]
+    );
+    const liveIds = new Set(all.map((n) => n.id));
+    deleted = rows.filter((r) => !liveIds.has(r.node_id)).map((r) => ({ id: r.node_id, deleted_by: r.deleted_by, deleted_at: r.deleted_at }));
+  }
+  return c.json({
+    since: new Date(sinceMs).toISOString(),
+    now: (/* @__PURE__ */ new Date()).toISOString(),
+    created,
+    updated,
+    deleted
+  });
+});
+queryRoutes.get("/runnables", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const all = await listNodesForCaller(nestId, userId, {
+    type: RUNNABLE_NODE_TYPES,
+    // The prompt/skill body IS the payload here — an orchestrator pulls it to
+    // run the thing, so this surface pays for the file reads.
+    withContent: true
+  });
+  const runnables = all.map((n) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    schedule: n.schedule ?? null,
+    status: n.status,
+    tags: n.tags,
+    updated_at: n.updated_at,
+    content: n.content
+  }));
+  return c.json({ count: runnables.length, runnables });
+});
+queryRoutes.get("/graph", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
+  if (config.FEATURE_WORKFLOW_PLANE) {
+    const rows = await getDb().all(
+      `SELECT e.from_node, e.to_node, e.condition_mode, t.name as type, t.color, t.is_flow
+         FROM edges e JOIN edge_types t ON t.id = e.type_id
+        WHERE e.nest_id = ?`,
+      [nestId]
+    );
+    const visible = new Set(graph.nodes.map((n) => n.id));
+    graph.typedEdges = rows.filter((r) => visible.has(r.from_node) && visible.has(r.to_node)).map((r) => ({
+      source: r.from_node,
+      target: r.to_node,
+      type: r.type,
+      color: r.color,
+      is_flow: !!r.is_flow,
+      condition_mode: r.condition_mode
+    }));
+  }
+  return c.json(graph);
+});
+queryRoutes.post("/context", async (c) => {
+  const body = await c.req.json();
+  const { blocks: _blocks, ...result } = await resolveContext({
+    nestId: c.req.param("nestId"),
+    userId: c.get("userId"),
+    baseUrl: requestBaseUrl(c.req.url),
+    body
+  });
+  return c.json(result);
+});
+queryRoutes.post("/table-query", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const ref = typeof body.table === "string" ? body.table.trim() : "";
+  if (!ref) throw new ValidationError("table is required \u2014 [[Title]] or node id");
+  const result = await queryTableNode(
+    nestId,
+    ref,
+    typeof body.query === "string" ? body.query : "",
+    body.include_drafts === true
+  );
+  return c.json(result);
+});
+queryRoutes.post("/query", async (c) => {
+  const body = await c.req.json();
+  if (!body.query) {
+    throw new ValidationError("query is required");
+  }
+  const nestId = c.req.param("nestId");
+  const { query: queryEngine } = await engineCache.get(nestId);
+  const result = await queryEngine.query(body.query, {
+    hops: body.hops ?? 2
+  });
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  const accessible = await filterAccessible(nestId, userId, userEmail, result.documents);
+  return c.json({
+    query: body.query,
+    count: accessible.length,
     nodes: accessible.map((n) => ({
       id: n.id,
       title: n.frontmatter.title,
@@ -8754,8 +8824,393 @@ queryRoutes.post("/publish", async (c) => {
   );
 });
 
+// src/hootie/routes.ts
+import { Hono as Hono15 } from "hono";
+import { streamSSE } from "hono/streaming";
+
+// src/hootie/model.ts
+import Anthropic from "@anthropic-ai/sdk";
+var plainModels = /* @__PURE__ */ new Set();
+async function* streamAnswer(params) {
+  const client = clientFor(params.apiKey, params.baseUrl ?? null);
+  const key = `${params.baseUrl ?? ""}|${params.model}`;
+  if (plainModels.has(key)) {
+    yield* answer(client, params, false);
+    return;
+  }
+  const state = { started: false };
+  try {
+    yield* answer(client, params, true, state);
+  } catch (err) {
+    if (state.started || err?.status !== 400) throw err;
+    yield* answer(client, params, false);
+    plainModels.add(key);
+  }
+}
+async function* answer(client, params, tuned, state = { started: false }) {
+  const stream = client.messages.stream(
+    tuned ? {
+      model: params.model,
+      max_tokens: 4096,
+      // The system prompt carries the retrieved context — the bulk of the
+      // request, identical across a conversation's turns — so cache it.
+      system: [
+        { type: "text", text: params.system, cache_control: { type: "ephemeral" } }
+      ],
+      messages: params.turns,
+      thinking: { type: "adaptive" },
+      output_config: { effort: "medium" }
+    } : (
+      // The bare request every Messages-speaking model accepts.
+      {
+        model: params.model,
+        max_tokens: 4096,
+        system: params.system,
+        messages: params.turns
+      }
+    ),
+    { signal: params.signal }
+  );
+  for await (const event of stream) {
+    if (event.type === "content_block_delta" && event.delta.type === "text_delta") {
+      state.started = true;
+      yield event.delta.text;
+    }
+  }
+  const final = await stream.finalMessage();
+  if (final.stop_reason === "refusal") {
+    throw new ModelRefusedError(
+      final.stop_details?.explanation || "The model declined to answer that."
+    );
+  }
+}
+function describeModelError(err) {
+  const e = err;
+  const detail = (e?.error?.error?.message || "").toLowerCase();
+  const provider = config.ANTHROPIC_BASE_URL ? "The model gateway" : "Anthropic";
+  if (detail.includes("credit balance") || detail.includes("billing")) {
+    return "Hootie's Anthropic account is out of credit. A server admin needs to add credit in the Anthropic console (Plans & Billing).";
+  }
+  switch (e?.status) {
+    case 401:
+    case 403:
+      return `${provider} rejected this server's API key. A server admin can replace it under Settings \u2192 General.`;
+    case 404:
+      return `No model named "${config.HOOTIE_MODEL}" is available on this key. A server admin can change it under Settings \u2192 General.`;
+    case 413:
+      return "That question plus the documents behind it are too large for one request. Try asking something narrower.";
+    case 429:
+      return `${provider} is rate-limiting this server right now. Try again in a moment.`;
+    case 529:
+      return "The model is overloaded right now. Try again in a moment.";
+  }
+  if (typeof e?.status === "number" && e.status >= 500) {
+    return `${provider} is having trouble right now. Try again in a moment.`;
+  }
+  return "Hootie couldn't reach the model. Try again in a moment.";
+}
+async function verifyModelKey(apiKey, baseUrl) {
+  try {
+    await clientFor(apiKey, baseUrl).models.list(
+      { limit: 1 },
+      { signal: AbortSignal.timeout(1e4) }
+    );
+    return null;
+  } catch (err) {
+    const status = err?.status;
+    if (status === 401 || status === 403) {
+      return baseUrl ? `The model gateway rejected that key (${status}). Check the key and the gateway URL.` : "Anthropic rejected that key. Check it and paste it again.";
+    }
+    console.warn("[hootie] key check inconclusive, saving anyway", status ?? err?.message);
+    return null;
+  }
+}
+var cached = null;
+function clientFor(apiKey, baseUrl) {
+  if (!cached || cached.apiKey !== apiKey || cached.baseUrl !== baseUrl) {
+    cached = {
+      apiKey,
+      baseUrl,
+      client: new Anthropic({ apiKey, ...baseUrl ? { baseURL: baseUrl } : {} })
+    };
+  }
+  return cached.client;
+}
+var ModelRefusedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ModelRefusedError";
+  }
+};
+
+// src/hootie/routes.ts
+var hootieRoutes = new Hono15();
+var MAX_MESSAGE_CHARS = 4e3;
+var MAX_HISTORY_TURNS = 20;
+var MAX_HISTORY_CHARS = 8e3;
+var MAX_HISTORY_RAW = MAX_HISTORY_TURNS * 4;
+var CONTEXT_BUDGET = 6e3;
+var CHAT_BUDGET = { max: 30, windowMs: 5 * 6e4 };
+hootieRoutes.post("/chat", async (c) => {
+  if (!config.HOOTIE_ENABLED) return c.json({ error: "Not found" }, 404);
+  const apiKey = process.env.ANTHROPIC_API_KEY;
+  if (!apiKey) {
+    return c.json(
+      {
+        error: "Hootie needs an Anthropic API key. A server admin can add one under Settings \u2192 General.",
+        reason: "no_api_key"
+      },
+      503
+    );
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const message = typeof body.message === "string" ? body.message.trim() : "";
+  if (!message) return c.json({ error: "message is required" }, 400);
+  if (message.length > MAX_MESSAGE_CHARS) {
+    return c.json(
+      { error: `message is too long (max ${MAX_MESSAGE_CHARS} characters)` },
+      400
+    );
+  }
+  const nodeId = typeof body.node_id === "string" && body.node_id.trim() ? body.node_id.trim() : null;
+  if (nodeId !== null && !isNodeIdShaped(nodeId)) {
+    return c.json({ error: "Node not found" }, 404);
+  }
+  const history = normalizeHistory(body.history);
+  if (history === null) {
+    return c.json(
+      { error: "history must be a list of {role: user|assistant, content}" },
+      400
+    );
+  }
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  if (!tryConsume(`hootie:${userId}`, CHAT_BUDGET)) {
+    return c.json(
+      { error: "Too many questions in a short time \u2014 give it a few minutes." },
+      429
+    );
+  }
+  const userEmail = await resolveCallerEmail(userId);
+  const baseUrl = requestBaseUrl(c.req.url);
+  const nodes = [];
+  const blocks = [];
+  const seen = /* @__PURE__ */ new Set();
+  const take = (r) => {
+    for (let i = 0; i < r.nodes.length; i++) {
+      const n = r.nodes[i];
+      if (seen.has(n.id)) continue;
+      seen.add(n.id);
+      nodes.push(n);
+      blocks.push(r.blocks[i].markdown);
+    }
+  };
+  let anchor = null;
+  if (nodeId) {
+    const r = await resolveContext({
+      nestId,
+      userId,
+      baseUrl,
+      body: {
+        selector: `[[${nodeId}]]`,
+        hops: 1,
+        max_tokens: CONTEXT_BUDGET,
+        include_drafts: true
+      }
+    });
+    anchor = r.nodes.find((n) => n.id === nodeId) ?? null;
+    if (!anchor) return c.json({ error: "Node not found" }, 404);
+    take(r);
+  }
+  const question = stripMentions(message);
+  if (question) {
+    const r = await resolveContext({
+      nestId,
+      userId,
+      baseUrl,
+      body: { prompt: question, max_tokens: CONTEXT_BUDGET }
+    });
+    take(r);
+  }
+  const nest = await getNest(nestId);
+  const system = buildSystemPrompt({
+    nestName: nest?.name ?? "this nest",
+    userEmail,
+    anchor,
+    blocks
+  });
+  const turns = [...history, { role: "user", content: message }];
+  const mentionNames = extractMentions(message);
+  trackEvent("hootie.chat", {
+    nestId,
+    anchored: !!anchor,
+    context_nodes: nodes.length,
+    history_turns: history.length,
+    mentions: mentionNames.length
+  });
+  return streamSSE(c, async (stream) => {
+    const cancel = new AbortController();
+    const hangUp = () => cancel.abort();
+    stream.onAbort(hangUp);
+    c.req.raw.signal.addEventListener("abort", hangUp, { once: true });
+    await stream.writeSSE({
+      event: "meta",
+      data: JSON.stringify({ nodes, anchor })
+    });
+    let answer2 = "";
+    try {
+      for await (const chunk of streamAnswer({
+        apiKey,
+        model: config.HOOTIE_MODEL,
+        baseUrl: config.ANTHROPIC_BASE_URL || null,
+        system,
+        turns,
+        signal: cancel.signal
+      })) {
+        if (cancel.signal.aborted) return;
+        answer2 += chunk;
+        await stream.writeSSE({ event: "delta", data: JSON.stringify({ text: chunk }) });
+      }
+    } catch (err) {
+      if (cancel.signal.aborted) return;
+      const text = err instanceof ModelRefusedError ? err.message : describeModelError(err);
+      console.error("[hootie] model call failed", nestId, err);
+      await stream.writeSSE({ event: "error", data: JSON.stringify({ error: text }) });
+      return;
+    }
+    if (cancel.signal.aborted) return;
+    const cited = citedNodes(answer2, nodes);
+    let mention = null;
+    if (mentionNames.length > 0) {
+      mention = await deliverMentions({
+        nestId,
+        userEmail,
+        baseUrl,
+        message,
+        answer: answer2,
+        anchor: anchor ?? cited[0] ?? null
+      });
+    }
+    await stream.writeSSE({
+      event: "done",
+      data: JSON.stringify({ answer: answer2, cited, mention })
+    });
+  });
+});
+var NODE_ID_SHAPE = /^nodes(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)+$/;
+function isNodeIdShaped(id) {
+  return id.length <= 512 && NODE_ID_SHAPE.test(id);
+}
+function normalizeHistory(raw) {
+  if (raw === void 0 || raw === null) return [];
+  if (!Array.isArray(raw)) return null;
+  const tail = raw.length > MAX_HISTORY_RAW ? raw.slice(-MAX_HISTORY_RAW) : raw;
+  const turns = [];
+  for (const t of tail) {
+    if (!t || typeof t !== "object") return null;
+    const role = t.role;
+    const content = t.content;
+    if (role !== "user" && role !== "assistant" || typeof content !== "string")
+      return null;
+    const text = content.trim();
+    if (!text) continue;
+    turns.push({ role, content: text });
+  }
+  const merged = [];
+  for (const t of turns) {
+    const last = merged[merged.length - 1];
+    if (last && last.role === t.role) last.content += "\n\n" + t.content;
+    else merged.push({ ...t });
+  }
+  let kept = merged.slice(-MAX_HISTORY_TURNS);
+  let chars = kept.reduce((n, t) => n + t.content.length, 0);
+  while (kept.length > 0 && chars > MAX_HISTORY_CHARS) {
+    chars -= kept[0].content.length;
+    kept = kept.slice(1);
+  }
+  while (kept.length > 0 && kept[0].role !== "user") kept = kept.slice(1);
+  while (kept.length > 0 && kept[kept.length - 1].role !== "assistant")
+    kept = kept.slice(0, -1);
+  return kept;
+}
+function buildSystemPrompt(params) {
+  const { nestName: nestName2, userEmail, anchor, blocks } = params;
+  const context = blocks.length > 0 ? blocks.join("\n\n---\n\n").replace(/<\/documents>/gi, "</ documents>") : "(nothing in the nest matched this question)";
+  return [
+    `You are Hootie, the assistant inside the ContextNest nest "${nestName2}". You are talking with ${userEmail}.`,
+    "",
+    "Answer from the documents below and nothing else. They are the governed context this person is allowed to read; do not invent facts that are not in them.",
+    "When you use a document, cite it by its exact title as a wiki link, like [[Title]] \u2014 this is how the reader opens it. Cite every document you drew on, and only those.",
+    "If the documents do not answer the question, say so plainly and, if you can, point to which document comes closest or what to search for. Do not guess.",
+    "Be concise and direct. Use short paragraphs or a short list; no preamble.",
+    "Names written as @someone in the message are colleagues the person is looping in \u2014 they are not questions for you, and you should not address them.",
+    anchor ? `The person currently has the document [[${anchor.title}]] open; "this" in their message means that document unless they say otherwise.` : "The person is looking at the nest as a whole, not a particular document.",
+    "",
+    "<documents>",
+    context,
+    "</documents>"
+  ].join("\n");
+}
+function citedNodes(answer2, nodes) {
+  const lower = answer2.toLowerCase();
+  const seenTitles = /* @__PURE__ */ new Set();
+  const hits = [];
+  for (const n of nodes) {
+    const key = n.title.toLowerCase();
+    if (seenTitles.has(key)) continue;
+    const at = lower.indexOf(`[[${key}]]`);
+    if (at < 0) continue;
+    seenTitles.add(key);
+    hits.push({ n, at });
+  }
+  return hits.sort((a, b) => a.at - b.at).map((x) => x.n);
+}
+async function deliverMentions(params) {
+  const { nestId, userEmail, baseUrl, message, answer: answer2, anchor } = params;
+  if (!anchor) return { status: "undeliverable", reason: "no_anchor" };
+  const body = [
+    `**Asked Hootie:** ${message}`,
+    "",
+    "**Hootie answered:**",
+    answer2.trim()
+  ].join("\n");
+  let threadId;
+  try {
+    const thread = await createThread(
+      nestId,
+      anchor.id,
+      { body, anchor: null, snapshotVersion: null },
+      userEmail
+    );
+    threadId = thread.id;
+  } catch (err) {
+    console.error("[hootie] mention comment failed", nestId, anchor.id, err);
+    return { status: "undeliverable", reason: "post_failed" };
+  }
+  const notified = await notifyCommentMentions({
+    nestId,
+    nodeId: anchor.id,
+    body: message,
+    actorEmail: userEmail,
+    baseUrl
+  });
+  await syncAnnotationsNode(nestId, anchor.id, userEmail);
+  return {
+    status: "posted",
+    node_id: anchor.id,
+    node_title: anchor.title,
+    thread_id: threadId,
+    notified
+  };
+}
+
 // src/mcp/routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -9164,7 +9619,7 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 import { v4 as uuid10 } from "uuid";
 function toResponse(e, t) {
   return {
@@ -9283,7 +9738,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono15();
+var edgeRoutes = new Hono16();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10434,7 +10889,7 @@ async function resolveLlmBody(ctx, node, gate) {
   const approved = gate ? gate.approvedVersions?.get(node.id) ?? null : await getApprovedVersion(ctx.nestId, node.id);
   if (approved == null) return null;
   try {
-    return await ctx.versionManager.reconstructVersion(node.id, approved);
+    return (await reconstructApproved(ctx.versionManager, ctx.nestId, node.id, approved)).raw;
   } catch (err) {
     console.error("reconstructVersion failed", node.id, approved, err);
     return null;
@@ -11470,11 +11925,11 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-24GLUBY4.js");
+        const { createGrant: createGrant2 } = await import("./grants-service-WICV4Y2J.js");
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
-        const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-AM6A3WGO.js");
+        const { findOrCreateInvitedUser: findOrCreateInvitedUser2 } = await import("./invited-user-XEBX6BM4.js");
         const row = await findOrCreateInvitedUser2(e, { invitedBy: ctx.userEmail });
         await createGrant2({
           nestId: ctx.nestId,
@@ -11528,7 +11983,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z as z2 } from "zod";
-var mcpRoutes = new Hono16();
+var mcpRoutes = new Hono17();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -11598,7 +12053,7 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 import { v4 as uuid12 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
@@ -11717,7 +12172,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono17();
+var runTriggerRoutes = new Hono18();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -11825,7 +12280,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono17();
+var runListRoutes = new Hono18();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -11857,7 +12312,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono17();
+var runDetailRoutes = new Hono18();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -12008,7 +12463,7 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
@@ -12046,7 +12501,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono18();
+var scheduleRoutes = new Hono19();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -12142,7 +12597,7 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 import { v4 as uuid14 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
@@ -12190,7 +12645,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono19();
+var connectorRoutes = new Hono20();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -12252,7 +12707,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono20 } from "hono";
+import { Hono as Hono21 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -12275,7 +12730,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono20();
+var hookNestRoutes = new Hono21();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -12346,10 +12801,10 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
   const mine = createHmac2("sha256", Buffer.from(secret, "base64")).update(rawBody, "utf8").digest("base64");
   return safeEqual(mine, authHeader.slice(5).trim());
 }
-function stripMentions(text) {
+function stripMentions2(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono20();
+var hookFireRoutes = new Hono21();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -12397,7 +12852,7 @@ hookFireRoutes.post("/:token", async (c) => {
     if (payload.type === "event_callback") {
       const ev = payload.event ?? {};
       if (ev.type !== "app_mention") return c.json({ ok: true });
-      inputs = { input: stripMentions(String(ev.text ?? "")), from: ev.user, channel: ev.channel };
+      inputs = { input: stripMentions2(String(ev.text ?? "")), from: ev.user, channel: ev.channel };
       ack = () => c.json({ ok: true });
     } else {
       inputs = {
@@ -12415,7 +12870,7 @@ hookFireRoutes.post("/:token", async (c) => {
     if (secret && !teamsSignatureValid(secret, c.req.header("authorization"), raw)) {
       return c.json({ error: "bad signature" }, 401);
     }
-    inputs = { input: stripMentions(String(payload.text ?? "")), from: payload.from?.name };
+    inputs = { input: stripMentions2(String(payload.text ?? "")), from: payload.from?.name };
     ack = (runId2) => c.json({ type: "message", text: `\u23F3 Queued ${hook.agent_node} (run ${runId2.slice(0, 12)}\u2026)` });
   } else {
     inputs = Object.keys(payload).length ? payload : null;
@@ -12451,9 +12906,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono22 } from "hono";
 import { v4 as uuid15 } from "uuid";
-var definitionRoutes = new Hono21();
+var definitionRoutes = new Hono22();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -12561,11 +13016,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono23 } from "hono";
 import { v4 as uuid16 } from "uuid";
 import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
 import { join as join6 } from "path";
-var assetRoutes = new Hono22();
+var assetRoutes = new Hono23();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -12652,19 +13107,21 @@ assetRoutes.get("/:file", async (c) => {
 });
 
 // src/nodes/pdf-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { createHash as createHash3 } from "crypto";
 import { isPdf, readPdfBinary as readPdfBinary3 } from "@promptowl/contextnest-engine";
-var pdfNodeRoutes = new Hono23();
+var pdfNodeRoutes = new Hono24();
 var PDF_UPLOAD_PATH = /^\/nests\/[^/]+\/nodes\/pdf\/?$/;
 function pdfMaxRequestBytes() {
   return config.PDF_MAX_BYTES + 1024 * 1024;
 }
+function pdfTooLargeMessage(bytes) {
+  const size = bytes === void 0 ? "" : `${(bytes / (1024 * 1024)).toFixed(1)} MB, `;
+  return `PDF too large (${size}max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`;
+}
 function tooLarge(bytes) {
-  return new PayloadTooLargeError(
-    `PDF too large (${(bytes / (1024 * 1024)).toFixed(1)} MB, max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
-  );
+  return new PayloadTooLargeError(pdfTooLargeMessage(bytes));
 }
 function field(body, name) {
   const v = body[name];
@@ -12685,12 +13142,7 @@ pdfNodeRoutes.post(
   "/pdf",
   (c, next) => bodyLimit({
     maxSize: pdfMaxRequestBytes(),
-    onError: (c2) => c2.json(
-      {
-        error: `PDF too large (max ${config.PDF_MAX_BYTES / (1024 * 1024)} MB)`
-      },
-      413
-    )
+    onError: (c2) => c2.json({ error: pdfTooLargeMessage() }, 413)
   })(c, next),
   async (c) => {
     const nestId = c.req.param("nestId");
@@ -12829,7 +13281,7 @@ pdfNodeRoutes.get("/:nodeId{.+}/pdf", async (c, next) => {
 });
 
 // src/auth/community-sites-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono25 } from "hono";
 var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
 var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
 var serializeSite = (site) => ({
@@ -12841,7 +13293,7 @@ var serializeSite = (site) => ({
   created_at: site.created_at,
   updated_at: site.updated_at
 });
-var communitySiteRoutes = new Hono24();
+var communitySiteRoutes = new Hono25();
 communitySiteRoutes.get("/", async (c) => {
   if (!await serverAdminAllowed(c))
     return c.json({ error: "Only the server admin can view this." }, 403);
@@ -12929,7 +13381,7 @@ communitySiteRoutes.delete("/:id", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z3 } from "zod";
@@ -13265,7 +13717,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl, c) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono25();
+var serverMcpRoutes = new Hono26();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -13288,7 +13740,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono25();
+var nestIndexRoutes = new Hono26();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -13464,14 +13916,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono25();
+var llmsTxtRoutes = new Hono26();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono26 } from "hono";
+import { Hono as Hono27 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -13903,7 +14355,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono26();
+var governanceRoutes = new Hono27();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -14273,7 +14725,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono26();
+var governanceNodeRoutes = new Hono27();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -14905,7 +15357,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono27({ router: new LinearRouter() });
+  const app = new Hono28({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -14924,11 +15376,13 @@ function createApp() {
     if (lenStr) {
       const len = parseInt(lenStr, 10);
       const isPost = c.req.method === "POST";
-      const cap = isPost && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : isPost && PDF_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, pdfMaxRequestBytes()) : config.MAX_BODY_BYTES;
+      const isPdf2 = isPost && PDF_UPLOAD_PATH.test(c.req.path);
+      const cap = isPost && ASSET_UPLOAD_PATH.test(c.req.path) ? Math.max(config.MAX_BODY_BYTES, ASSET_MAX_REQUEST_BYTES) : isPdf2 ? Math.max(config.MAX_BODY_BYTES, pdfMaxRequestBytes()) : config.MAX_BODY_BYTES;
       if (Number.isFinite(len) && len > cap) {
         return c.json(
           {
-            error: `Request body too large (${len} bytes, max ${cap})`
+            // A PDF gets the same message as the route's own gates.
+            error: isPdf2 ? pdfTooLargeMessage(len) : `Request body too large (${len} bytes, max ${cap})`
           },
           413
         );
@@ -15001,6 +15455,11 @@ function createApp() {
       // API would refuse it — existing nodes of the type stay readable.
       type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
       type_table_enabled: config.TYPE_TABLE_ENABLED,
+      // Hootie in the nest (default ON). Off → POST /nests/:id/chat 404s and
+      // the UI hides the launcher. Whether it can actually answer is
+      // runner_key_configured above — the UI shows the launcher whenever the
+      // feature is on and explains the missing key, rather than hiding it.
+      hootie_enabled: config.HOOTIE_ENABLED,
       // This server hosts several organizations (PromptOwl-hosted) rather than
       // one. The visibility picker words 'Organization' and 'Public' by it and
       // confirms before 'org'; the server enforces the same in
@@ -15115,6 +15574,9 @@ function createApp() {
     promptowl_teams_enabled: config.PROMPTOWL_TEAMS_ENABLED,
     type_artifact_enabled: config.TYPE_ARTIFACT_ENABLED,
     type_table_enabled: config.TYPE_TABLE_ENABLED,
+    hootie_enabled: config.HOOTIE_ENABLED,
+    hootie_model: config.HOOTIE_MODEL,
+    anthropic_base_url: config.ANTHROPIC_BASE_URL,
     subagent_runs_enabled: config.FEATURE_SUBAGENT_RUNS,
     subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
     subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
@@ -15253,6 +15715,38 @@ function createApp() {
         value: body.type_table_enabled ? null : "false"
       });
     }
+    if ("hootie_enabled" in body) {
+      pending.push({
+        name: "HOOTIE_ENABLED",
+        value: body.hootie_enabled ? null : "false"
+      });
+    }
+    if ("hootie_model" in body) {
+      const v = String(body.hootie_model ?? "").trim();
+      if (!v) addError("hootie_model", "Model is required \u2014 e.g. claude-opus-5.");
+      else if (v.length > 200 || /\s/.test(v))
+        addError("hootie_model", "Model must be a single identifier with no spaces.");
+      else pending.push({ name: "HOOTIE_MODEL", value: v === "claude-opus-5" ? null : v });
+    }
+    if ("anthropic_base_url" in body) {
+      const v = String(body.anthropic_base_url ?? "").trim().replace(/\/$/, "");
+      if (!v) pending.push({ name: "ANTHROPIC_BASE_URL", value: null });
+      else {
+        let ok = false;
+        try {
+          const u = new URL(v);
+          ok = (u.protocol === "http:" || u.protocol === "https:") && !!u.host;
+        } catch {
+          ok = false;
+        }
+        if (!ok)
+          addError(
+            "anthropic_base_url",
+            "Model gateway URL must be an http(s) URL, e.g. http://gateway:4000 \u2014 or empty to call Anthropic directly."
+          );
+        else pending.push({ name: "ANTHROPIC_BASE_URL", value: v });
+      }
+    }
     if ("anthropic_api_key" in body) {
       const v = body.anthropic_api_key;
       if (v === null || v === "") {
@@ -15260,7 +15754,12 @@ function createApp() {
       } else if (typeof v !== "string" || !v.trim().startsWith("sk-")) {
         addError("anthropic_api_key", 'Anthropic API key must start with "sk-" (or be empty to clear it).');
       } else {
-        pending.push({ name: "ANTHROPIC_API_KEY", value: v.trim() });
+        const key = v.trim();
+        const patchedBase = pending.find((p) => p.name === "ANTHROPIC_BASE_URL");
+        const baseUrl = patchedBase ? patchedBase.value : config.ANTHROPIC_BASE_URL || null;
+        const rejected = await verifyModelKey(key, baseUrl);
+        if (rejected) addError("anthropic_api_key", rejected);
+        else pending.push({ name: "ANTHROPIC_API_KEY", value: key });
       }
     }
     if ("subagent_runs_enabled" in body) {
@@ -15976,7 +16475,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono27();
+  const nestsApp = new Hono28();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -16055,7 +16554,7 @@ function createApp() {
     if (access.archived && isMcpTransport) {
       return deny(404, "Nest not found");
     }
-    const isReadQuery = parts.length === 2 && ["context", "query", "search", "export"].includes(parts[1]);
+    const isReadQuery = parts.length === 2 && ["context", "query", "search", "export", "chat"].includes(parts[1]);
     let grantRole = null;
     let grantNestVisible = false;
     if (permission === "none") {
@@ -16202,6 +16701,7 @@ function createApp() {
   nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
+  nestsApp.route("/:nestId", hootieRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
   nestsApp.route("/:nestId", brandingRoutes);
   nestsApp.route("/:nestId/grants", grantRoutes);