@promptowl/contextnest-community 1.3.0 → 1.5.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-EDJRDWPL.js";
+} from "./chunk-IWA2UDAT.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +25,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-6AXBB65N.js";
+} from "./chunk-HIH7I232.js";
 import {
   AppError,
   ConflictError,
@@ -80,20 +80,21 @@ import {
   trackEvent,
   uniqueNestName,
   updateSteward,
+  upsertEnvVar,
   validateLicense
-} from "./chunk-SO74PQWI.js";
+} from "./chunk-EMOE53KX.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-UEHFNBNR.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/index.ts
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono9 } from "hono";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
 
@@ -249,11 +250,71 @@ function clear(key) {
   buckets.delete(key);
 }
 
+// src/auth/sso-token.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function b64urlToBuffer(input) {
+  const pad = input.length % 4 === 0 ? "" : "=".repeat(4 - input.length % 4);
+  return Buffer.from(input.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+var SsoTokenError = class extends Error {
+};
+function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
+  if (!secret) throw new SsoTokenError("SSO secret not configured");
+  if (!token || typeof token !== "string") {
+    throw new SsoTokenError("Missing ticket");
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new SsoTokenError("Malformed ticket");
+  const [headerB64, payloadB64, sigB64] = parts;
+  let header;
+  try {
+    header = JSON.parse(b64urlToBuffer(headerB64).toString("utf8"));
+  } catch {
+    throw new SsoTokenError("Invalid ticket header");
+  }
+  if (header.alg !== "HS256") {
+    throw new SsoTokenError(`Unsupported alg: ${header.alg}`);
+  }
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const expected = createHmac("sha256", secret).update(signingInput).digest();
+  const provided = b64urlToBuffer(sigB64);
+  if (expected.length !== provided.length || !timingSafeEqual(expected, provided)) {
+    throw new SsoTokenError("Bad signature");
+  }
+  let claims;
+  try {
+    claims = JSON.parse(b64urlToBuffer(payloadB64).toString("utf8"));
+  } catch {
+    throw new SsoTokenError("Invalid ticket payload");
+  }
+  const LEEWAY = 30;
+  if (typeof claims.exp !== "number") {
+    throw new SsoTokenError("Ticket missing exp");
+  }
+  if (nowSec > claims.exp + LEEWAY) {
+    throw new SsoTokenError("Ticket expired");
+  }
+  if (!claims.sub) throw new SsoTokenError("Ticket missing sub");
+  return claims;
+}
+
 // src/auth/routes.ts
 import { getConnInfo } from "@hono/node-server/conninfo";
 var LOGIN_LIMIT = { max: 5, windowMs: 15 * 6e4 };
 var REGISTER_LIMIT = { max: 3, windowMs: 60 * 6e4 };
 var DEVICE_LIMIT = { max: 10, windowMs: 15 * 6e4 };
+var warnedMissingSsoAudience = false;
+var MIN_PASSWORD_LENGTH = 8;
+function assertValidPassword(password, label = "password") {
+  if (password.trim().length === 0) {
+    throw new ValidationError(`${label} cannot be empty or only whitespace`);
+  }
+  if (password.length < MIN_PASSWORD_LENGTH) {
+    throw new ValidationError(
+      `${label} must be at least ${MIN_PASSWORD_LENGTH} characters`
+    );
+  }
+}
 function clientIp(c) {
   const xff = c.req.header("x-forwarded-for");
   if (xff) return xff.split(",")[0].trim();
@@ -301,12 +362,61 @@ function clearSessionCookie(c) {
     buildClearSessionCookie({ secure: isSecureRequest(c) })
   );
 }
+async function provisionPromptowlUser(c, rawEmail, rawName) {
+  const gate = config.PROMPTOWL_SIGN_IN_GATE;
+  if (gate !== "open") {
+    if (gate === "disabled" || !isLicenseAdminEmail(rawEmail)) {
+      return {
+        ok: false,
+        status: 403,
+        error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
+        gate
+      };
+    }
+  }
+  const db = getDb();
+  const meEmail = normalizeEmail(rawEmail);
+  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
+  if (!user) {
+    const userId = uuid();
+    const placeholderHash = await hashPassword(uuid());
+    db.prepare(
+      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
+    ).run(userId, meEmail, rawName || null, placeholderHash);
+    user = { id: userId, email: meEmail, name: rawName || null };
+    trackEvent("user.register", {
+      userId,
+      email: rawEmail,
+      method: "promptowl"
+    });
+  } else {
+    trackEvent("user.login", { userId: user.id, method: "promptowl" });
+  }
+  let claimBlocked = null;
+  const lic = getCurrentLicense();
+  let isAdmin = false;
+  if (!lic?.valid) {
+    claimBlocked = { reason: "license_required" };
+  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === rawEmail.toLowerCase()) {
+    isAdmin = true;
+    trackEvent("admin.claim", { userId: user.id, email: user.email });
+  } else {
+    claimBlocked = {
+      reason: "email_mismatch",
+      license_owner_email: lic.ownerEmail
+    };
+  }
+  const sessionId = createSession(user.id, c.req.header("User-Agent"));
+  setSessionCookie(c, sessionId);
+  return { ok: true, user, isAdmin, claimBlocked };
+}
 var authRoutes = new Hono();
 authRoutes.post("/register", async (c) => {
   const body = await c.req.json();
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
   }
+  assertValidPassword(body.password);
   const email = normalizeEmail(body.email);
   const ip = clientIp(c);
   if (!tryConsume(`register:ip:${ip}`, REGISTER_LIMIT)) {
@@ -533,62 +643,76 @@ authRoutes.post("/promptowl", async (c) => {
       401
     );
   }
-  const gate = config.PROMPTOWL_SIGN_IN_GATE;
-  if (gate !== "open") {
-    if (gate === "disabled" || !isLicenseAdminEmail(me.email)) {
-      return c.json(
-        {
-          error: "PromptOwl sign-in is restricted on this server. Use email and password, or contact your admin.",
-          gate
-        },
-        403
-      );
-    }
-  }
-  const db = getDb();
-  const meEmail = normalizeEmail(me.email);
-  let user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = ?").get(meEmail);
-  if (!user) {
-    const userId = uuid();
-    const placeholderHash = await hashPassword(uuid());
-    db.prepare(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)"
-    ).run(userId, meEmail, me.name || null, placeholderHash);
-    user = { id: userId, email: meEmail, name: me.name || null };
-    trackEvent("user.register", {
-      userId,
-      email: me.email,
-      method: "promptowl"
-    });
-  } else {
-    trackEvent("user.login", { userId: user.id, method: "promptowl" });
-  }
-  let claimBlocked = null;
-  const lic = getCurrentLicense();
-  let isAdmin = false;
-  if (!lic?.valid) {
-    claimBlocked = { reason: "license_required" };
-  } else if (lic.ownerEmail && lic.ownerEmail.toLowerCase() === me.email.toLowerCase()) {
-    isAdmin = true;
-    trackEvent("admin.claim", { userId: user.id, email: user.email });
-  } else {
-    claimBlocked = {
-      reason: "email_mismatch",
-      license_owner_email: lic.ownerEmail
-    };
+  const result = await provisionPromptowlUser(c, me.email, me.name);
+  if (!result.ok) {
+    return c.json({ error: result.error, gate: result.gate }, result.status);
   }
-  const sessionId = createSession(user.id, c.req.header("User-Agent"));
-  setSessionCookie(c, sessionId);
   return c.json({
     user: {
-      id: user.id,
-      email: user.email,
-      name: user.name,
-      is_admin: isAdmin
+      id: result.user.id,
+      email: result.user.email,
+      name: result.user.name,
+      is_admin: result.isAdmin
     },
-    ...claimBlocked ? { claim_blocked: claimBlocked } : {}
+    ...result.claimBlocked ? { claim_blocked: result.claimBlocked } : {}
   });
 });
+authRoutes.get("/sso", async (c) => {
+  const ssoError = (code) => c.redirect(`/?sso_error=${code}`, 302);
+  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+  if (!secret) return ssoError("not_supported");
+  if (!tryConsume(`sso:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
+    return ssoError("rate_limited");
+  }
+  const ticket = c.req.query("ticket");
+  if (!ticket) return ssoError("missing_ticket");
+  let claims;
+  try {
+    claims = verifySsoTicket(ticket, secret);
+  } catch {
+    return ssoError("invalid_ticket");
+  }
+  const expectedAud = config.PUBLIC_BASE_URL;
+  if (!expectedAud && !warnedMissingSsoAudience) {
+    warnedMissingSsoAudience = true;
+    console.warn(
+      "[sso] OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is empty \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL so a ticket minted for another server cannot be replayed against this one."
+    );
+  }
+  if (expectedAud) {
+    const aud = (claims.aud || "").replace(/\/$/, "");
+    if (aud !== expectedAud) return ssoError("bad_audience");
+  }
+  const sub = (claims.sub || "").trim();
+  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(sub) || sub.length > 254) {
+    return ssoError("invalid_ticket");
+  }
+  if (!claims.jti) return ssoError("invalid_ticket");
+  const db = getDb();
+  db.prepare("DELETE FROM sso_used_jti WHERE expires_at < datetime('now')").run();
+  const expiresAtIso = new Date((claims.exp ?? 0) * 1e3).toISOString();
+  try {
+    db.prepare(
+      "INSERT INTO sso_used_jti (jti, expires_at) VALUES (?, ?)"
+    ).run(claims.jti, expiresAtIso);
+  } catch (err) {
+    if (err?.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+      return ssoError("ticket_used");
+    }
+    console.error("[sso] failed to record ticket jti:", err);
+    return ssoError("service_error");
+  }
+  let result;
+  try {
+    result = await provisionPromptowlUser(c, sub, claims.name);
+  } catch (err) {
+    db.prepare("DELETE FROM sso_used_jti WHERE jti = ?").run(claims.jti);
+    console.error("[sso] provisioning failed; released jti for retry:", err);
+    return ssoError("service_error");
+  }
+  if (!result.ok) return ssoError("sign_in_restricted");
+  return c.redirect("/", 302);
+});
 authRoutes.get("/admin-status", async (c) => {
   const db = getDb();
   const lic = getCurrentLicense();
@@ -621,9 +745,7 @@ authRoutes.post("/password", authMiddleware, async (c) => {
   if (!body.current || !body.next) {
     throw new ValidationError("current and next are required");
   }
-  if (body.next.length < 8) {
-    throw new ValidationError("new password must be at least 8 characters");
-  }
+  assertValidPassword(body.next, "new password");
   const db = getDb();
   const userId = c.get("userId");
   const user = db.prepare("SELECT password_hash FROM users WHERE id = ?").get(userId);
@@ -668,8 +790,8 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   } catch {
     supplied = void 0;
   }
-  if (supplied && supplied.length < 8) {
-    throw new ValidationError("password must be at least 8 characters");
+  if (supplied !== void 0) {
+    assertValidPassword(supplied);
   }
   const generated = supplied ? null : uuid().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
@@ -1079,7 +1201,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-624QTR5K.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
     createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1235,7 +1357,7 @@ async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = engineCache.get(nestId);
   const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  const id = `nodes/${slug}`;
+  const id = input.id ?? `nodes/${slug}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
   const hasStewards = isStewardshipEnabled(nestId);
@@ -1830,6 +1952,11 @@ async function addCollaborator(params) {
   if (!params.permission || !VALID_PERMISSIONS.includes(params.permission)) {
     throw new ValidationError("permission must be read, write, or admin");
   }
+  if (params.callerPermission && permissionLevel(params.permission) > permissionLevel(params.callerPermission)) {
+    throw new ForbiddenError(
+      `You can only grant access up to your own level ('${params.callerPermission}'). Ask a nest admin to grant '${params.permission}'.`
+    );
+  }
   const db = getDb();
   let userId = params.userId;
   if (!userId && params.email) {
@@ -1905,7 +2032,10 @@ sharingRoutes.post("/collaborators", async (c) => {
     email: body.email,
     userId: body.user_id,
     permission: body.permission ?? "",
-    grantedByUserId: c.get("userId")
+    grantedByUserId: c.get("userId"),
+    // Enforce the escalation cap against the caller's own nest permission
+    // (set by the access guard) — a write collaborator can't grant admin.
+    callerPermission: c.get("nestPermission")
   });
   return c.json({ collaborator: collab }, 201);
 });
@@ -1915,17 +2045,22 @@ sharingRoutes.patch("/collaborators/:collabId", async (c) => {
     throw new ValidationError("permission must be read, write, or admin");
   }
   const db = getDb();
-  db.prepare("UPDATE nest_collaborators SET permission = ? WHERE id = ?").run(
-    body.permission,
-    c.req.param("collabId")
-  );
+  const info = db.prepare(
+    "UPDATE nest_collaborators SET permission = ? WHERE id = ? AND nest_id = ?"
+  ).run(body.permission, c.req.param("collabId"), c.req.param("nestId"));
+  if (info.changes === 0) {
+    throw new NotFoundError("Collaborator not found");
+  }
   return c.json({ updated: true });
 });
 sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   const db = getDb();
-  db.prepare("DELETE FROM nest_collaborators WHERE id = ?").run(
-    c.req.param("collabId")
-  );
+  const info = db.prepare(
+    "DELETE FROM nest_collaborators WHERE id = ? AND nest_id = ?"
+  ).run(c.req.param("collabId"), c.req.param("nestId"));
+  if (info.changes === 0) {
+    throw new NotFoundError("Collaborator not found");
+  }
   return c.json({ removed: true });
 });
 sharingRoutes.patch("/visibility", async (c) => {
@@ -2013,7 +2148,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZUSHJCNR.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-P4M5UEJW.js");
   const { stewards, fallbackToOwner, ownerEmail } = resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -2034,7 +2169,7 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-624QTR5K.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-REGL5CUT.js");
   const allVersions = getVersions2(nestId, nodeId);
   const approved = getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -2065,7 +2200,7 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
 nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-QU7Q7XX2.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-XNXHF6Q7.js");
   const history = getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -2259,8 +2394,407 @@ function getUserEmail(c) {
   return user?.email || "anonymous@localhost";
 }
 
-// src/nodes/query-routes.ts
+// src/annotations/routes.ts
 import { Hono as Hono5 } from "hono";
+
+// src/annotations/service.ts
+import { v4 as uuid3 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
+}
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
+  }
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
+}
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
+  });
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
+  );
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
+  });
+  for (const key of keys) {
+    lines.push(`## ${snapshotLabel(key)}`);
+    lines.push("");
+    for (const thread of orderThreads(buckets2.get(key))) {
+      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
+      lines.push(renderAnchor(thread.anchor));
+      for (const comment of thread.comments) {
+        lines.push(
+          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/annotations/service.ts
+function loadComments(threadId) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC"
+  ).all(threadId);
+  return rows.map((r) => ({
+    id: r.id,
+    author: r.author,
+    body: r.body,
+    createdAt: r.created_at
+  }));
+}
+function rowToThread(row) {
+  let anchor = null;
+  if (row.anchor_json) {
+    try {
+      anchor = JSON.parse(row.anchor_json);
+    } catch {
+      anchor = null;
+    }
+  }
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    snapshotVersion: row.snapshot_version,
+    anchor,
+    status: row.status,
+    createdBy: row.created_by,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by,
+    resolvedAt: row.resolved_at,
+    comments: loadComments(row.id)
+  };
+}
+function getThreadRow(threadId) {
+  return getDb().prepare("SELECT * FROM annotation_threads WHERE id = ?").get(threadId);
+}
+function listThreads(nestId, nodeId) {
+  const rows = getDb().prepare(
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC"
+  ).all(nestId, nodeId);
+  return rows.map(rowToThread);
+}
+function createThread(nestId, nodeId, input, authorEmail) {
+  const body = (input.body ?? "").trim();
+  if (!body) {
+    throw new Error("comment body is required");
+  }
+  const db = getDb();
+  const id = uuid3();
+  const anchor = clampAnchor(input.anchor);
+  const snapshot = input.snapshotVersion ?? getApprovedVersion(nestId, nodeId) ?? null;
+  const tx = db.transaction(() => {
+    db.prepare(
+      `INSERT INTO annotation_threads
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
+       VALUES (?, ?, ?, ?, ?, 'open', ?)`
+    ).run(
+      id,
+      nestId,
+      nodeId,
+      snapshot,
+      anchor ? JSON.stringify(anchor) : null,
+      authorEmail
+    );
+    db.prepare(
+      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
+    ).run(uuid3(), id, authorEmail, body);
+  });
+  tx();
+  return rowToThread(getThreadRow(id));
+}
+function getScopedThreadRow(threadId, nestId, nodeId) {
+  const row = getThreadRow(threadId);
+  if (!row || row.nest_id !== nestId || row.node_id !== nodeId) {
+    throw new NotFoundError(`Thread not found: ${threadId}`);
+  }
+  return row;
+}
+function addComment(nestId, nodeId, threadId, authorEmail, body) {
+  const trimmed = (body ?? "").trim();
+  if (!trimmed) {
+    throw new Error("comment body is required");
+  }
+  getScopedThreadRow(threadId, nestId, nodeId);
+  getDb().prepare(
+    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)"
+  ).run(uuid3(), threadId, authorEmail, trimmed);
+  return rowToThread(getThreadRow(threadId));
+}
+function setThreadStatus(nestId, nodeId, threadId, status, byEmail) {
+  getScopedThreadRow(threadId, nestId, nodeId);
+  if (status === "resolved") {
+    getDb().prepare(
+      "UPDATE annotation_threads SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now') WHERE id = ?"
+    ).run(byEmail, threadId);
+  } else {
+    getDb().prepare(
+      "UPDATE annotation_threads SET status = 'open', resolved_by = NULL, resolved_at = NULL WHERE id = ?"
+    ).run(threadId);
+  }
+  return rowToThread(getThreadRow(threadId));
+}
+async function readArtifact(nestId, nodeId, version) {
+  const { storage, versions: versionManager } = engineCache.get(nestId);
+  const target = version ?? getApprovedVersion(nestId, nodeId) ?? null;
+  let title = nodeId;
+  let type = null;
+  let liveHtml = "";
+  let liveExists = true;
+  try {
+    const node = await storage.readDocument(nodeId);
+    title = node.frontmatter?.title || nodeId;
+    type = node.frontmatter?.type || null;
+    liveHtml = node.body || "";
+  } catch {
+    liveExists = false;
+  }
+  if (target != null) {
+    try {
+      const raw = await versionManager.reconstructVersion(nodeId, target);
+      return { title, html: bodyOnly(nodeId, raw), version: target, type };
+    } catch (err) {
+      console.warn(
+        `[annotations] reconstruct v${target} failed for ${nestId}/${nodeId}; falling back to live body:`,
+        err
+      );
+    }
+  }
+  if (!liveExists) {
+    throw new NotFoundError(`Artifact not found: ${nodeId}`);
+  }
+  return { title, html: liveHtml, version: target, type };
+}
+function derivedAnnotationsId(sourceNodeId) {
+  const base = sourceNodeId.replace(/^nodes\//, "");
+  return `nodes/${base}--annotations`;
+}
+async function syncAnnotationsNode(nestId, nodeId, userEmail) {
+  try {
+    let title = nodeId;
+    try {
+      const { storage } = engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+    } catch {
+    }
+    const threads = listThreads(nestId, nodeId);
+    const derivedTitle = `${title} \u2014 Annotations`;
+    const markdown = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
+    );
+  }
+}
+
+// src/annotations/types.ts
+var ARTIFACT_NODE_TYPE = "artifact";
+
+// src/annotations/routes.ts
+var annotationRoutes = new Hono5();
+function getNodeId(c) {
+  const raw = c.req.param("nodeId");
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+annotationRoutes.get("/:nodeId{.+}/annotations", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  return c.json({ threads: listThreads(nestId, nodeId) });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const input = await c.req.json();
+  if (!input.body || !input.body.trim()) {
+    throw new ValidationError("body is required");
+  }
+  const thread = createThread(
+    nestId,
+    nodeId,
+    {
+      body: input.body,
+      anchor: input.anchor ?? null,
+      snapshotVersion: input.snapshotVersion ?? null
+    },
+    userEmail
+  );
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread }, 201);
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const input = await c.req.json();
+  if (!input.body || !input.body.trim()) {
+    throw new ValidationError("body is required");
+  }
+  const thread = addComment(nestId, nodeId, threadId, userEmail, input.body);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/resolve", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const thread = setThreadStatus(nestId, nodeId, threadId, "resolved", userEmail);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/reopen", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const threadId = c.req.param("threadId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const thread = setThreadStatus(nestId, nodeId, threadId, "open", userEmail);
+  await syncAnnotationsNode(nestId, nodeId, userEmail);
+  return c.json({ thread });
+});
+annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = getNodeId(c);
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  if (!canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json({ error: "Access denied" }, 403);
+  }
+  const vRaw = c.req.query("v");
+  const vNum = vRaw !== void 0 ? Number(vRaw) : NaN;
+  const version = Number.isFinite(vNum) && vNum > 0 ? Math.floor(vNum) : void 0;
+  const { html, version: served, type } = await readArtifact(
+    nestId,
+    nodeId,
+    version
+  );
+  if (type !== null && type !== ARTIFACT_NODE_TYPE) {
+    return c.json({ error: "Not a hosted artifact" }, 404);
+  }
+  c.header(
+    "Content-Security-Policy",
+    [
+      "sandbox allow-scripts allow-popups allow-modals",
+      "default-src 'none'",
+      "script-src 'unsafe-inline'",
+      "style-src 'unsafe-inline'",
+      "img-src data: blob:",
+      "font-src data:",
+      "connect-src 'none'",
+      "base-uri 'none'",
+      "form-action 'none'"
+    ].join("; ")
+  );
+  c.header("X-Content-Type-Options", "nosniff");
+  c.header("Referrer-Policy", "no-referrer");
+  if (served != null) c.header("X-Artifact-Snapshot", String(served));
+  return c.html(html);
+});
+
+// src/nodes/query-routes.ts
+import { Hono as Hono6 } from "hono";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 
 // src/nodes/prompt-compiler.ts
@@ -2478,8 +3012,158 @@ async function resolveExportBody(nestId, nodeId, workingBody) {
   }
 }
 
+// src/nodes/graph-service.ts
+var MAX_GRAPH_NODES = 150;
+var WIKILINK_RE = /\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g;
+function extractWikiTargets(body) {
+  const out = [];
+  if (!body) return out;
+  WIKILINK_RE.lastIndex = 0;
+  let m;
+  while ((m = WIKILINK_RE.exec(body)) !== null) {
+    const t = (m[1] || "").trim();
+    if (t) out.push(t);
+  }
+  return out;
+}
+async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
+  const { storage } = engineCache.get(nestId);
+  const docs = await storage.discoverDocuments();
+  const accessible = filterAccessible(nestId, userId, userEmail, docs);
+  const idSet = new Set(accessible.map((d) => d.id));
+  const titleToId = /* @__PURE__ */ new Map();
+  for (const d of accessible) {
+    const t = (d.frontmatter?.title || "").toLowerCase().trim();
+    if (t && !titleToId.has(t)) titleToId.set(t, d.id);
+  }
+  const allNodes = accessible.map((d) => ({
+    id: d.id,
+    title: d.frontmatter?.title || d.id,
+    type: d.frontmatter?.type || "document",
+    tags: (d.frontmatter?.tags || []).map(normalizeTag)
+  }));
+  const allLinks = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const d of accessible) {
+    for (const raw of extractWikiTargets(d.body || "")) {
+      const targetId = idSet.has(raw) ? raw : titleToId.get(raw.toLowerCase().trim());
+      if (!targetId || targetId === d.id) continue;
+      const key = `${d.id}->${targetId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      allLinks.push({ source: d.id, target: targetId });
+    }
+  }
+  const tagCounts = /* @__PURE__ */ new Map();
+  const tagToDocs = /* @__PURE__ */ new Map();
+  for (const n of allNodes) {
+    for (const t of n.tags) {
+      tagCounts.set(t, (tagCounts.get(t) || 0) + 1);
+      let s = tagToDocs.get(t);
+      if (!s) tagToDocs.set(t, s = /* @__PURE__ */ new Set());
+      s.add(n.id);
+    }
+  }
+  const tags = [...tagCounts.entries()].map(([name, count]) => ({ name, count })).sort((a, b) => b.count - a.count);
+  const exposeStewards = isStewardshipEnabled(nestId) && !isPublicReader(nestId, userId);
+  const stewardRows = exposeStewards ? (await listStewards({ nestId })).filter(
+    // Drop document-scoped rows whose node the caller can't see.
+    (s) => s.scope !== "document" || idSet.has(s.nodePattern || "")
+  ) : [];
+  const maskId = /* @__PURE__ */ new Map();
+  if (!canSeeIdentities) {
+    const emails = [...new Set(stewardRows.map((s) => s.userEmail))].sort();
+    emails.forEach((e, i) => maskId.set(e, `s${i + 1}`));
+  }
+  const identity = (email) => {
+    if (canSeeIdentities) return { id: email, label: email };
+    const id = maskId.get(email);
+    return { id, label: `Steward ${id.slice(1)}` };
+  };
+  const stewardRowsMapped = stewardRows.map((s) => {
+    const { id, label } = identity(s.userEmail);
+    return {
+      id,
+      label,
+      role: s.role,
+      scope: s.scope,
+      target: s.scope === "document" ? s.nodePattern || "" : s.scope === "tag" ? normalizeTag(s.tagName || "") : "*"
+    };
+  });
+  const stewardEdges = stewardRowsMapped.map((s) => ({
+    steward: s.id,
+    target: s.scope === "tag" ? `tag:${s.target}` : s.scope === "document" ? s.target : "*",
+    scope: s.scope
+  }));
+  const seenSteward = /* @__PURE__ */ new Set();
+  const stewards = stewardRowsMapped.filter(
+    (s) => seenSteward.has(s.id) ? false : (seenSteward.add(s.id), true)
+  );
+  const linkedIds = /* @__PURE__ */ new Set();
+  for (const l of allLinks) {
+    linkedIds.add(l.source);
+    linkedIds.add(l.target);
+  }
+  const orphans = allNodes.filter((n) => !linkedIds.has(n.id));
+  const stewardedTags = new Set(
+    stewardRows.filter((s) => s.scope === "tag").map((s) => normalizeTag(s.tagName || ""))
+  );
+  const unstewardedTags = tags.filter((t) => !stewardedTags.has(t.name));
+  const coveredBySteward = /* @__PURE__ */ new Map();
+  const labelById = /* @__PURE__ */ new Map();
+  for (const s of stewardRowsMapped) {
+    labelById.set(s.id, s.label);
+    let cov = coveredBySteward.get(s.id);
+    if (!cov) coveredBySteward.set(s.id, cov = /* @__PURE__ */ new Set());
+    if (s.scope === "nest") for (const id of idSet) cov.add(id);
+    else if (s.scope === "tag")
+      for (const id of tagToDocs.get(s.target) || []) cov.add(id);
+    else if (idSet.has(s.target)) cov.add(s.target);
+  }
+  const denom = idSet.size;
+  const bottlenecks = denom === 0 ? [] : [...coveredBySteward.entries()].map(([steward, cov]) => ({
+    steward,
+    label: labelById.get(steward) || steward,
+    share: Math.round(cov.size / denom * 100)
+  })).filter((b) => b.share >= 50).sort((a, b) => b.share - a.share);
+  const signals = { orphans, unstewardedTags, bottlenecks };
+  const truncated = allNodes.length > MAX_GRAPH_NODES;
+  let nodes = allNodes;
+  let links = allLinks;
+  if (truncated) {
+    const degree = /* @__PURE__ */ new Map();
+    for (const l of allLinks) {
+      degree.set(l.source, (degree.get(l.source) || 0) + 1);
+      degree.set(l.target, (degree.get(l.target) || 0) + 1);
+    }
+    nodes = [...allNodes].sort(
+      (a, b) => (degree.get(b.id) || 0) - (degree.get(a.id) || 0) || (a.id < b.id ? -1 : 1)
+    ).slice(0, MAX_GRAPH_NODES);
+    const kept = new Set(nodes.map((n) => n.id));
+    links = allLinks.filter((l) => kept.has(l.source) && kept.has(l.target));
+  }
+  return {
+    nodes,
+    links,
+    stewards,
+    stewardEdges,
+    tags,
+    signals,
+    truncated,
+    totalNodes: allNodes.length
+  };
+}
+
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono5();
+var queryRoutes = new Hono6();
+queryRoutes.get("/graph", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const userEmail = resolveCallerEmail(userId);
+  const canSeeIdentities = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  const graph = await buildNestGraph(nestId, userId, userEmail, canSeeIdentities);
+  return c.json(graph);
+});
 function approxTokens(text) {
   return Math.ceil(text.length / 4);
 }
@@ -2798,7 +3482,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -3410,7 +4094,7 @@ ${list}`;
     case "context_share_nest": {
       const roles = resolveUserRoles(ctx.nestId, ctx.userEmail);
       if (!canManageWith(roles)) {
-        return "You don't have permission to share this nest. Only the nest owner or an admin can add people.";
+        return "You don't have permission to share this nest via this tool (admin only). You can still invite from the UI with write access, or ask a nest admin.";
       }
       const permission = args.permission || "read";
       try {
@@ -3461,7 +4145,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono6();
+var mcpRoutes = new Hono7();
 function getUserEmail2(userId) {
   const db = getDb();
   const user = db.prepare("SELECT email FROM users WHERE id = ?").get(userId);
@@ -3520,7 +4204,214 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/governance/routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
+
+// src/governance/comment-service.ts
+import { v4 as uuid4 } from "uuid";
+function createComment(params) {
+  const db = getDb();
+  const body = (params.body ?? "").trim();
+  if (!body) {
+    throw new Error("Comment body is required");
+  }
+  if (params.parentId) {
+    const parent = db.prepare(
+      "SELECT id FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
+    ).get(params.parentId, params.nestId, params.nodeId);
+    if (!parent) {
+      throw new Error("Parent comment not found on this node");
+    }
+  }
+  const id = uuid4();
+  db.prepare(
+    `INSERT INTO comments
+       (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
+        parent_id, author, body)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    params.nestId,
+    params.nodeId,
+    params.version ?? null,
+    params.anchor?.start ?? null,
+    params.anchor?.end ?? null,
+    params.anchor?.text ?? null,
+    params.parentId ?? null,
+    params.author,
+    body
+  );
+  return getComment(id);
+}
+function listComments(nestId, nodeId, opts = {}) {
+  const db = getDb();
+  const args = [nestId, nodeId];
+  let statusClause = "";
+  if (opts.status) {
+    statusClause = " AND status = ?";
+    args.push(opts.status);
+  }
+  const rows = db.prepare(
+    `SELECT * FROM comments
+        WHERE nest_id = ? AND node_id = ?${statusClause}
+        ORDER BY created_at ASC`
+  ).all(...args);
+  return rows.map(rowToComment);
+}
+function getComment(id) {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM comments WHERE id = ?").get(id);
+  return row ? rowToComment(row) : null;
+}
+function resolveComment(params) {
+  const db = getDb();
+  const existing = db.prepare(
+    "SELECT id, status FROM comments WHERE id = ? AND nest_id = ? AND node_id = ?"
+  ).get(params.commentId, params.nestId, params.nodeId);
+  if (!existing) {
+    throw new Error("Comment not found");
+  }
+  if (existing.status === "resolved") {
+    throw new Error("Comment is already resolved");
+  }
+  db.prepare(
+    `UPDATE comments
+        SET status = 'resolved', resolved_by = ?, resolved_at = datetime('now')
+      WHERE id = ?`
+  ).run(params.resolvedBy, params.commentId);
+  return getComment(params.commentId);
+}
+async function getActivity(params) {
+  const db = getDb();
+  const limit = Number.isFinite(params.limit) && params.limit > 0 ? Math.min(params.limit, 1e3) : 100;
+  const entries = [];
+  const nodeFilter = params.nodeId ? " AND node_id = ?" : "";
+  const baseArgs = params.nodeId ? [params.nestId, params.nodeId] : [params.nestId];
+  const commentRows = db.prepare(
+    `SELECT id, node_id, author, body, status, created_at, resolved_by, resolved_at
+         FROM comments
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY COALESCE(resolved_at, created_at) DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of commentRows) {
+    entries.push({
+      type: "comment",
+      nodeId: r.node_id,
+      actor: r.author,
+      at: r.created_at,
+      detail: excerpt(r.body),
+      refId: r.id
+    });
+    if (r.status === "resolved" && r.resolved_by && r.resolved_at) {
+      entries.push({
+        type: "comment_resolved",
+        nodeId: r.node_id,
+        actor: r.resolved_by,
+        at: r.resolved_at,
+        detail: excerpt(r.body),
+        refId: r.id
+      });
+    }
+  }
+  const versionRows = db.prepare(
+    `SELECT node_id, version, author, change_note, created_at
+         FROM node_versions
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY created_at DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of versionRows) {
+    entries.push({
+      type: "edit",
+      nodeId: r.node_id,
+      actor: r.author,
+      at: r.created_at,
+      detail: r.change_note || `v${r.version}`,
+      refId: String(r.version)
+    });
+  }
+  const reviewRows = db.prepare(
+    `SELECT id, node_id, requested_by, requested_at, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ?${nodeFilter}
+        ORDER BY COALESCE(resolved_at, requested_at) DESC
+        LIMIT ?`
+  ).all(...baseArgs, limit);
+  for (const r of reviewRows) {
+    entries.push({
+      type: "review_requested",
+      nodeId: r.node_id,
+      actor: r.requested_by,
+      at: r.requested_at,
+      detail: "requested review",
+      refId: r.id
+    });
+    if (r.resolved_by && r.resolved_at) {
+      entries.push({
+        type: "review_resolved",
+        nodeId: r.node_id,
+        actor: r.resolved_by,
+        at: r.resolved_at,
+        detail: r.status,
+        // approved | rejected | cancelled
+        refId: r.id
+      });
+    }
+  }
+  try {
+    const pending = await listNestExternalEdits(params.nestId);
+    for (const e of pending) {
+      if (params.nodeId && e.document_id !== params.nodeId) continue;
+      entries.push({
+        type: "edit_proposed",
+        nodeId: e.document_id,
+        actor: e.actor,
+        at: e.detected_at,
+        detail: e.note || `proposed an edit (${e.source})`,
+        refId: e.suggestion_id
+      });
+    }
+  } catch (err) {
+    console.error(
+      `[comments] failed to load pending external edits for activity feed (nest ${params.nestId}):`,
+      err
+    );
+  }
+  const ms = (at) => {
+    if (!at) return 0;
+    const norm = at.includes("T") ? at : at.replace(" ", "T") + "Z";
+    const t = Date.parse(norm);
+    return Number.isNaN(t) ? 0 : t;
+  };
+  entries.sort((a, b) => ms(b.at) - ms(a.at));
+  return entries.slice(0, limit);
+}
+function excerpt(body, max = 80) {
+  const s = (body || "").replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function rowToComment(row) {
+  const hasOffsets = row.anchor_start !== null && row.anchor_end !== null;
+  const hasText = row.anchor_text !== null && row.anchor_text !== void 0;
+  const anchor = hasOffsets || hasText ? {
+    ...hasOffsets ? { start: row.anchor_start, end: row.anchor_end } : {},
+    ...hasText ? { text: row.anchor_text } : {}
+  } : void 0;
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    nodeId: row.node_id,
+    version: row.version ?? void 0,
+    anchor,
+    parentId: row.parent_id ?? void 0,
+    author: row.author,
+    body: row.body,
+    status: row.status,
+    createdAt: row.created_at,
+    resolvedBy: row.resolved_by ?? void 0,
+    resolvedAt: row.resolved_at ?? void 0
+  };
+}
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
@@ -3605,7 +4496,12 @@ function loadStewardsConfig(nestId) {
 }
 
 // src/governance/routes.ts
-var governanceRoutes = new Hono7();
+function parseLimit(raw, def = 100, max = 1e3) {
+  const n = parseInt(raw ?? "", 10);
+  if (Number.isNaN(n) || n < 1) return def;
+  return Math.min(n, max);
+}
+var governanceRoutes = new Hono8();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -3708,7 +4604,17 @@ governanceRoutes.get("/review-queue", async (c) => {
     limit,
     offset
   });
-  return c.json(result);
+  const email = getUserEmail3(c);
+  const canReviewCache = /* @__PURE__ */ new Map();
+  const requests = result.requests.map((r) => {
+    let canReview = canReviewCache.get(r.nodeId);
+    if (canReview === void 0) {
+      canReview = canUserApprove(nestId, r.nodeId, email).allowed;
+      canReviewCache.set(r.nodeId, canReview);
+    }
+    return { ...r, canReview };
+  });
+  return c.json({ ...result, requests });
 });
 governanceRoutes.get("/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
@@ -3725,7 +4631,13 @@ governanceRoutes.post("/external-edits/scan", async (c) => {
   const result = await scanNestForDrift(nestId, actor);
   return c.json(result);
 });
-var governanceNodeRoutes = new Hono7();
+governanceRoutes.get("/activity", async (c) => {
+  const nestId = c.req.param("nestId");
+  const limit = parseLimit(c.req.query("limit"));
+  const activity = await getActivity({ nestId, limit });
+  return c.json({ activity });
+});
+var governanceNodeRoutes = new Hono8();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3771,6 +4683,68 @@ governanceNodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const history = getReviewHistory(nestId, nodeId);
   return c.json({ reviews: history });
 });
+governanceNodeRoutes.get("/:nodeId{.+}/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const status = c.req.query("status");
+  const list = listComments(nestId, nodeId, {
+    status: status === "open" || status === "resolved" ? status : void 0
+  });
+  return c.json({ comments: list });
+});
+governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const author = getUserEmail3(c);
+  try {
+    const comment = createComment({
+      nestId,
+      nodeId,
+      author,
+      body: body.body ?? "",
+      version: body.version,
+      anchor: body.anchor,
+      parentId: body.parentId
+    });
+    return c.json({ comment }, 201);
+  } catch (err) {
+    throw new ValidationError(
+      err instanceof Error ? err.message : String(err)
+    );
+  }
+});
+governanceNodeRoutes.post(
+  "/:nodeId{.+?}/comments/:commentId/resolve",
+  async (c) => {
+    const nestId = c.req.param("nestId");
+    const nodeId = c.req.param("nodeId");
+    const commentId = c.req.param("commentId");
+    const resolvedBy = getUserEmail3(c);
+    try {
+      const comment = resolveComment({
+        nestId,
+        nodeId,
+        commentId,
+        resolvedBy
+      });
+      return c.json({ comment });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg === "Comment not found") return c.json({ error: msg }, 404);
+      if (msg === "Comment is already resolved")
+        return c.json({ error: msg }, 409);
+      throw err;
+    }
+  }
+);
+governanceNodeRoutes.get("/:nodeId{.+}/activity", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const limit = parseLimit(c.req.query("limit"));
+  const activity = await getActivity({ nestId, nodeId, limit });
+  return c.json({ activity });
+});
 governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -4029,7 +5003,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
-  const app = new Hono8();
+  const app = new Hono9();
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -4142,6 +5116,73 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
+  app.use("/admin/settings", flexAuthMiddleware);
+  const adminSettingsAllowed = (c) => config.AUTH_MODE === "open" || isLicenseAdminUserId(c.get("userId"));
+  const currentServerSettings = () => ({
+    promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
+    logo_url: config.LOGO_URL,
+    telemetry_enabled: config.TELEMETRY_ENABLED,
+    public_base_url: config.PUBLIC_BASE_URL,
+    max_body_bytes: config.MAX_BODY_BYTES
+  });
+  app.get("/admin/settings", (c) => {
+    if (!adminSettingsAllowed(c))
+      return c.json({ error: "Only the server admin can view this." }, 403);
+    return c.json(currentServerSettings());
+  });
+  app.patch("/admin/settings", async (c) => {
+    if (!adminSettingsAllowed(c))
+      return c.json({ error: "Only the server admin can change this." }, 403);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+    const errors = [];
+    const pending = [];
+    if ("promptowl_sign_in_gate" in body) {
+      const v = String(body.promptowl_sign_in_gate ?? "").trim().toLowerCase();
+      if (!["open", "admin-only", "disabled"].includes(v))
+        errors.push("promptowl_sign_in_gate must be open | admin-only | disabled");
+      else pending.push({ name: "PROMPTOWL_SIGN_IN_GATE", value: v });
+    }
+    if ("logo_url" in body) {
+      const v = String(body.logo_url ?? "").trim();
+      pending.push({ name: "LOGO_URL", value: v || null });
+    }
+    if ("public_base_url" in body) {
+      const v = String(body.public_base_url ?? "").trim().replace(/\/$/, "");
+      pending.push({ name: "PUBLIC_BASE_URL", value: v || null });
+    }
+    if ("telemetry_enabled" in body) {
+      pending.push({ name: "TELEMETRY_ENABLED", value: body.telemetry_enabled ? "true" : "false" });
+    }
+    if ("max_body_bytes" in body) {
+      const n = Number(body.max_body_bytes);
+      if (!Number.isFinite(n) || n < 1024 * 1024 || n > 500 * 1024 * 1024)
+        errors.push("max_body_bytes must be between 1MB and 500MB");
+      else pending.push({ name: "MAX_BODY_BYTES", value: String(Math.floor(n)) });
+    }
+    if (errors.length)
+      return c.json({ error: errors.join("; "), settings: currentServerSettings() }, 400);
+    for (const { name, value } of pending) {
+      try {
+        upsertEnvVar(config.ENV_FILE_PATH, name, value);
+      } catch (e) {
+        return c.json(
+          {
+            error: `Could not persist ${name}: ${e instanceof Error ? e.message : String(e)}`,
+            settings: currentServerSettings()
+          },
+          500
+        );
+      }
+      if (value === null) delete process.env[name];
+      else process.env[name] = value;
+    }
+    return c.json({ settings: currentServerSettings() });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
@@ -4164,7 +5205,7 @@ function createApp() {
       users: usersRow.c
     });
   });
-  const nestsApp = new Hono8();
+  const nestsApp = new Hono9();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
     const localPath = c.req.path.replace(/^\/nests\//, "");
@@ -4189,7 +5230,9 @@ function createApp() {
     }
     {
       const path2 = c.req.path;
-      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit");
+      const isCommentPath = /\/comments$/.test(path2) || /\/comments\/[^/]+\/resolve$/.test(path2);
+      const isActivityPath = /\/activity$/.test(path2);
+      const isGovernance = path2.includes("/stewards") || path2.includes("/review-queue") || path2.includes("/versions") || path2.includes("/reviews") || path2.includes("/submit-review") || path2.includes("/cancel-review") || path2.includes("/approve") || path2.includes("/reject") || path2.includes("/can-access") || path2.includes("/can-approve") || path2.includes("/can-edit") || isCommentPath || isActivityPath;
       const needsLicense = c.req.method !== "GET" || isGovernance;
       if (needsLicense) {
         const lic = getCurrentLicense();
@@ -4216,6 +5259,8 @@ function createApp() {
     let required = "read";
     const path = c.req.path;
     const isStewardActionPath = path.includes("/approve") || path.includes("/reject") || path.includes("/submit-review") || path.includes("/cancel-review");
+    const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
+    const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
     if (isStewardRoster && !canManageStewards(resolveCallerEmail(userId))) {
       return c.json(
@@ -4225,9 +5270,12 @@ function createApp() {
         403
       );
     }
-    if (path.includes("/collaborators") || path.includes("/visibility")) {
+    const resource = parts[1];
+    if (resource === "visibility") {
       required = "admin";
-    } else if (c.req.method !== "GET" && !isStewardActionPath) {
+    } else if (resource === "collaborators") {
+      required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
+    } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction) {
       required = "write";
     }
     const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
@@ -4269,6 +5317,7 @@ function createApp() {
   nestsApp.route("/", nestRoutes);
   nestsApp.route("/:nestId", governanceRoutes);
   nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
+  nestsApp.route("/:nestId/nodes", annotationRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);
@@ -4473,6 +5522,13 @@ async function main() {
        or set PROMPTOWL_KEY=pk_... in your environment and restart.
 `);
   }
+  if (config.OFFICIAL_COMMUNITY_SSO_SECRET && !config.PUBLIC_BASE_URL) {
+    console.warn(`
+      WARNING: OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is not.
+      One-click SSO will skip the audience check, weakening cross-server replay
+      protection. Set PUBLIC_BASE_URL to this server's public URL.
+    `);
+  }
   const app = createApp();
   startLicenseSafetyPoll();
   const driftScanIntervalMs = Number(process.env.DRIFT_SCAN_INTERVAL_MS) || 3e4;