@promptowl/contextnest-community 1.6.0 → 1.8.0

package/dist/index.js

@@ -13,10 +13,11 @@ import {
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
+  notifySlackForNest,
   reject,
   safePublishDocument,
   submitForReview
-} from "./chunk-MZGFKBOK.js";
+} from "./chunk-Z3Y46ZGU.js";
 import {
   checkConflict,
   createVersion,
@@ -25,7 +26,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-T5L4LYU4.js";
+} from "./chunk-XNGOO6RI.js";
 import {
   AppError,
   ConflictError,
@@ -35,10 +36,10 @@ import {
   ValidationError,
   canCreateInNest,
   canManageStewards,
-  canManageWith,
   canUserAccess,
   canUserApprove,
   canUserEdit,
+  collabPermToRole,
   createNest,
   createStewardRecord,
   deleteNest,
@@ -84,14 +85,14 @@ import {
   updateSteward,
   upsertEnvVar,
   validateLicense
-} from "./chunk-2TUMMVBG.js";
+} from "./chunk-PJTAUVD7.js";
 import {
   config,
   getDb,
   initDb,
   insertOrIgnore,
   nowExpr
-} from "./chunk-7V33Z6CS.js";
+} from "./chunk-PLAHCDQG.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
@@ -101,7 +102,8 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono10 } from "hono";
+import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
 
@@ -487,7 +489,7 @@ authRoutes.post("/login", async (c) => {
     throw new ValidationError("email and password are required");
   }
   const ip = clientIp(c);
-  const emailLower = body.email.toLowerCase();
+  const emailLower = normalizeEmail(body.email);
   const hasIp = ip !== "unknown";
   const ipKey = `login:ip:${ip}`;
   const emailKey = `login:email:${emailLower}`;
@@ -496,7 +498,7 @@ authRoutes.post("/login", async (c) => {
   }
   const db = getDb();
   const user = await db.get(
-    "SELECT id, email, name, password_hash, is_admin FROM users WHERE LOWER(email) = ?",
+    "SELECT id, email, name, password_hash, is_admin, is_invited FROM users WHERE LOWER(email) = ?",
     [emailLower]
   );
   const check = user ? await verifyPassword(body.password, user.password_hash) : { ok: false, needsRehash: false };
@@ -509,6 +511,12 @@ authRoutes.post("/login", async (c) => {
   console.log(`[auth] login OK \u2014 counter reset ip=${ip} email=${emailLower}`);
   if (hasIp) clear(ipKey);
   clear(emailKey);
+  if (user.is_invited === 1) {
+    try {
+      await db.run("UPDATE users SET is_invited = 0 WHERE id = ?", [user.id]);
+    } catch {
+    }
+  }
   if (check.needsRehash) {
     try {
       const newHash = await hashPassword(body.password);
@@ -810,7 +818,7 @@ authRoutes.post("/password", authMiddleware, async (c) => {
     );
   }
   const newHash = await hashPassword(body.next);
-  await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
+  await db.run("UPDATE users SET password_hash = ?, is_invited = 0 WHERE id = ?", [
     newHash,
     userId
   ]);
@@ -853,14 +861,13 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
       newHash,
       target.id
     ]);
-    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [target.id]);
   });
   await deleteAllSessionsForUser(target.id);
   trackEvent("admin.reset_password", { adminId: callerId, userId: target.id });
   return c.json({
     ok: true,
     email: target.email,
-    keys_revoked: true,
+    keys_revoked: false,
     // Plaintext returned ONCE, only when the server generated it.
     temporary_password: generated ?? void 0
   });
@@ -936,40 +943,40 @@ authRoutes.post("/invite", async (c) => {
       403
     );
   }
-  let user = await db.get(
-    "SELECT id, email FROM users WHERE LOWER(email) = ?",
+  const existing = await db.get(
+    "SELECT id, email, is_invited FROM users WHERE LOWER(email) = ?",
     [email]
   );
-  if (!user) {
-    const userId = uuid();
-    const placeholderHash = await hashPassword(uuid());
+  if (existing && existing.is_invited === 0) {
+    return c.json(
+      {
+        error: "A user with this email already exists. Use Reset password to issue them a new password."
+      },
+      409
+    );
+  }
+  const tempPassword = uuid().replace(/-/g, "").slice(0, 16);
+  const passwordHash = await hashPassword(tempPassword);
+  let userId;
+  if (existing) {
+    userId = existing.id;
+    await db.run("UPDATE users SET password_hash = ? WHERE id = ?", [
+      passwordHash,
+      userId
+    ]);
+  } else {
+    userId = uuid();
     await db.run(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-      [userId, email, null, placeholderHash]
+      [userId, email, null, passwordHash]
     );
-    user = { id: userId, email };
   }
-  const apiKey = generateApiKey();
-  const keyId = uuid();
-  await db.transaction(async (tx) => {
-    await tx.run("DELETE FROM api_keys WHERE user_id = ?", [user.id]);
-    await tx.run(
-      "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, label) VALUES (?, ?, ?, ?, ?)",
-      [
-        keyId,
-        user.id,
-        hashApiKey(apiKey),
-        getKeyPrefix(apiKey),
-        body.label || "teammate"
-      ]
-    );
-  });
-  trackEvent("admin.invite", { adminId: callerId, email: body.email });
+  trackEvent("admin.invite", { adminId: callerId, email });
   return c.json(
     {
-      api_key: apiKey,
-      user: { id: user.id, email: user.email },
-      message: "Copy this key and share it securely \u2014 it won't be shown again."
+      temporary_password: tempPassword,
+      user: { id: userId, email },
+      message: "Share this temporary password securely. Your teammate signs in with their email + this password, then can change it and create their own API key."
     },
     201
   );
@@ -1284,7 +1291,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-MUZYTYMW.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-B3SDOJQE.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1370,6 +1377,10 @@ function bodyOnly(nodeId, raw) {
     return raw;
   }
 }
+var RUNNABLE_NODE_TYPES = ["agent", "skill"];
+function isRunnableType(type) {
+  return RUNNABLE_NODE_TYPES.includes(type || "");
+}
 function toNodeResponse(node) {
   const fm = node.frontmatter;
   const title = fm.title === void 0 || fm.title === null ? "" : String(fm.title);
@@ -1386,14 +1397,20 @@ function toNodeResponse(node) {
     created_at: fm.created_at,
     updated_at: fm.updated_at,
     content: node.body || "",
-    pendingChange: node.pendingChange ?? void 0
+    pendingChange: node.pendingChange ?? void 0,
+    // Same YAML-coercion rule as title above: `schedule: 123` parses as a
+    // number — normalize to string at the API boundary.
+    schedule: fm.metadata?.schedule != null ? String(fm.metadata.schedule) : void 0
   };
 }
 async function listNodesForCaller(nestId, userId, filters = {}) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
   let documents = await storage.discoverDocuments();
   if (filters.type) {
-    documents = documents.filter((n) => n.frontmatter.type === filters.type);
+    const wanted = new Set(
+      Array.isArray(filters.type) ? filters.type : [filters.type]
+    );
+    documents = documents.filter((n) => wanted.has(n.frontmatter.type));
   }
   if (filters.tag) {
     const tag = normalizeTag2(filters.tag);
@@ -1444,10 +1461,26 @@ async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
 }
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const slug = input.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  const id = input.id ?? `nodes/${slug}`;
+  const slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const slug = slugify(input.title);
+  let id = input.id;
+  if (!id) {
+    const folderSegments = (input.folder ?? "").split("/").map(slugify).filter(Boolean);
+    if (folderSegments.length > 8) {
+      throw new ValidationError("folder may nest at most 8 levels deep");
+    }
+    if ([...folderSegments, slug].some((seg) => seg.length > 100)) {
+      throw new ValidationError("each folder or title segment must be at most 100 characters");
+    }
+    id = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/${slug}` : `nodes/${slug}`;
+  }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const tags = (input.tags || []).map(normalizeTag2);
+  if (input.schedule !== void 0 && !isRunnableType(input.type)) {
+    throw new ValidationError(
+      `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(", ")})`
+    );
+  }
   const hasStewards = await isStewardshipEnabled(nestId);
   const initialStatus = hasStewards ? "draft" : "published";
   const initialVersion = hasStewards ? 1 : 0;
@@ -1462,7 +1495,11 @@ async function createNode(nestId, input, userEmail) {
       version: initialVersion,
       created_at: now,
       updated_at: now,
-      metadata: { owners: ["*"], scope: input.scope || "team" }
+      metadata: {
+        owners: ["*"],
+        scope: input.scope || "team",
+        ...input.schedule ? { schedule: input.schedule } : {}
+      }
     },
     body: input.content,
     rawContent: ""
@@ -1589,6 +1626,17 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
   if (patch.title) {
     node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
   }
+  if (patch.schedule !== void 0) {
+    if (!isRunnableType(node.frontmatter.type)) {
+      throw new ValidationError(
+        `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(", ")})`
+      );
+    }
+    const metadata = { ...node.frontmatter.metadata };
+    if (patch.schedule === "") delete metadata.schedule;
+    else metadata.schedule = patch.schedule;
+    node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
+  }
   const hasStewards = await isStewardshipEnabled(nestId);
   const currentTags = node.frontmatter.tags || [];
   if (hasStewards && await getPendingReview(nestId, nodeId)) {
@@ -1881,7 +1929,18 @@ nestRoutes.get("/", async (c) => {
     const permission = await effectivePermission(n.id, userId);
     const is_owner = permission === "owner";
     let owner_email = null;
-    const roles = is_owner ? ["owner"] : await resolveUserRoles(n.id, callerEmail);
+    let roles;
+    if (is_owner) {
+      roles = ["owner"];
+    } else {
+      const grantRole = collabPermToRole(
+        await getCollaboratorRole(n.id, callerEmail)
+      );
+      const stewardRoles = await getStewardRolesForUser(n.id, callerEmail);
+      roles = [
+        ...new Set([grantRole, ...stewardRoles].filter(Boolean))
+      ];
+    }
     if (!is_owner && n.user_id !== ANON_USER_ID) {
       const row = await db.get(ownerEmailSql, [n.user_id]);
       owner_email = row?.email ?? null;
@@ -1895,7 +1954,25 @@ nestRoutes.get("/", async (c) => {
     seen.add(n.id);
     out.push(await annotate(n));
   }
-  return c.json({ nests: out });
+  const docRows = await db.all(
+    "SELECT nest_id, COUNT(DISTINCT node_id) AS c FROM node_versions GROUP BY nest_id"
+  );
+  const docByNest = new Map(docRows.map((r) => [r.nest_id, r.c]));
+  const collabRows = await db.all(
+    "SELECT nest_id, COUNT(*) AS c FROM nest_collaborators GROUP BY nest_id"
+  );
+  const collabByNest = new Map(collabRows.map((r) => [r.nest_id, r.c]));
+  const stewardRows = await db.all(
+    "SELECT nest_id, COUNT(DISTINCT user_email) AS c FROM stewards WHERE is_active = 1 GROUP BY nest_id"
+  );
+  const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, r.c]));
+  const withMeta = out.map((n) => ({
+    ...n,
+    document_count: docByNest.get(n.id) ?? 0,
+    collaborator_count: collabByNest.get(n.id) ?? 0,
+    steward_count: stewardByNest.get(n.id) ?? 0
+  }));
+  return c.json({ nests: withMeta });
 });
 nestRoutes.post("/", async (c) => {
   const body = await c.req.json();
@@ -2011,10 +2088,10 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
   const userId = c.get("userId");
   const isServerAdmin = await isLicenseAdminUserId(userId);
   const permission = await effectivePermission(nestId, userId);
-  if (!isServerAdmin && permission !== "owner") {
+  if (!isServerAdmin && permission !== "owner" && permission !== "admin") {
     return c.json(
       {
-        error: "Only the nest owner or the server license-admin can update nest settings."
+        error: "Only a nest admin, the nest owner, or the server license-admin can update nest settings."
       },
       403
     );
@@ -2025,6 +2102,14 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
     if (body.stewardship_enabled) {
       await setStewardshipEnabled(nestId, true);
     } else {
+      if (!isServerAdmin && permission !== "owner") {
+        return c.json(
+          {
+            error: "Only the nest owner or the server license-admin can disable stewardship (this permanently wipes stewards and pending reviews)."
+          },
+          403
+        );
+      }
       wiped = await disableStewardshipAndWipeGovernance(nestId);
     }
   }
@@ -2112,6 +2197,10 @@ async function addCollaborator(params) {
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
     [collabId, nestId, userId, params.permission, granterId]
   );
+  void notifySlackForNest(
+    nestId,
+    `:key: ${params.email || userId} added as *${params.permission}*${params.grantedByEmail ? ` by ${params.grantedByEmail}` : ""}`
+  );
   return await db.get(
     "SELECT * FROM nest_collaborators WHERE id = ?",
     [collabId]
@@ -2220,416 +2309,113 @@ function isMarkdownFormat(c) {
   return c.req.query("format") === "markdown";
 }
 
-// src/nodes/routes.ts
-var nodeRoutes = new Hono4();
-function nodeAsMarkdown(response, nodeId) {
-  return nodeToMarkdown({
-    id: nodeId,
-    title: response.title,
-    tags: response.tags,
-    status: response.status,
-    body: response.content
-  });
+// src/annotations/service.ts
+import { v4 as uuid3 } from "uuid";
+
+// src/annotations/projection.ts
+var MAX_CONTEXT_CHARS = 250;
+var MAX_QUOTE_CHARS = 1e3;
+function clampAnchor(raw) {
+  if (!raw) return null;
+  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
+  if (!quote) return null;
+  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
+  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
+  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
+  return { quote, before, after, ...line !== void 0 ? { line } : {} };
 }
-nodeRoutes.get("/", async (c) => {
-  const nestId = c.req.param("nestId");
-  const userId = c.get("userId");
-  const nodes = await listNodesForCaller(nestId, userId);
-  return c.json({ count: nodes.length, nodes });
-});
-nodeRoutes.post("/", async (c) => {
-  const body = await c.req.json();
-  if (!body.title || !body.content) {
-    throw new ValidationError("title and content are required");
+function oneLine(s) {
+  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
+}
+function renderAnchor(anchor) {
+  if (!anchor) {
+    return "<!-- anchor: whole-artifact -->";
   }
-  const nestId = c.req.param("nestId");
-  const authorEmail = await getUserEmail(c);
-  const { node } = await createNode(
-    nestId,
-    {
-      title: body.title,
-      content: body.content,
-      type: body.type,
-      tags: body.tags,
-      scope: body.scope,
-      status: body.status
-    },
-    authorEmail
-  );
-  const resolved = await resolveStewardsForNode(nestId, node.id);
-  return c.json({
-    node: toNodeResponse(node),
-    stewards: resolved.length > 0 ? resolved.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      source: r.source
-    })) : void 0
-  }, 201);
-});
-nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-VIKF3VZB.js");
-  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
-    nestId,
-    nodeId
+  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
+  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
+    anchor.after
+  )}\u2026`;
+  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
+}
+function statusHeading(thread) {
+  if (thread.status === "resolved") {
+    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
+    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
+    const meta = who || when ? ` (${who}${when})` : "";
+    return `\u2705 RESOLVED${meta}`;
+  }
+  return "\u{1F7E0} OPEN";
+}
+function snapshotLabel(v) {
+  return v == null ? "Unpinned" : `Snapshot v${v}`;
+}
+function orderThreads(threads) {
+  return [...threads].sort((a, b) => {
+    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
+    return a.createdAt.localeCompare(b.createdAt);
+  });
+}
+function projectThreadsToMarkdown(artifactTitle, threads) {
+  const lines = [];
+  lines.push(`# ${artifactTitle} \u2014 Annotations`);
+  lines.push("");
+  lines.push(
+    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
   );
-  return c.json({
-    nodeId,
-    stewards: stewards.map((r) => ({
-      email: r.steward.userEmail,
-      role: r.steward.role,
-      scope: r.steward.scope,
-      source: r.source,
-      priority: r.priority
-    })),
-    fallbackToOwner,
-    ownerEmail
+  lines.push("");
+  if (threads.length === 0) {
+    lines.push("_No annotations yet._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const t of threads) {
+    const key = t.snapshotVersion ?? null;
+    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
+  }
+  const keys = [...buckets2.keys()].sort((a, b) => {
+    if (a == null) return 1;
+    if (b == null) return -1;
+    return b - a;
   });
-});
-nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-MUZYTYMW.js");
-  const allVersions = await getVersions2(nestId, nodeId);
-  const approved = await getApprovedVersion2(nestId, nodeId);
+  for (const key of keys) {
+    lines.push(`## ${snapshotLabel(key)}`);
+    lines.push("");
+    for (const thread of orderThreads(buckets2.get(key))) {
+      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
+      lines.push(renderAnchor(thread.anchor));
+      for (const comment of thread.comments) {
+        lines.push(
+          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/annotations/service.ts
+async function loadComments(threadId) {
   const db = getDb();
-  const resolutions = await db.all(
-    `SELECT version, status, resolved_by, resolved_at
-         FROM review_requests
-        WHERE nest_id = ? AND node_id = ?
-          AND status IN ('approved', 'rejected')
-          AND resolved_by IS NOT NULL
-        ORDER BY resolved_at DESC`,
-    [nestId, nodeId]
+  const rows = await db.all(
+    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, id ASC",
+    [threadId]
   );
-  const byVersion = /* @__PURE__ */ new Map();
-  for (const r of resolutions) {
-    if (!byVersion.has(r.version)) {
-      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
-    }
-  }
-  const enriched = allVersions.map((v) => {
-    const r = byVersion.get(v.version);
-    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
-  });
-  return c.json({
-    versions: enriched,
-    approvedVersion: approved,
-    currentVersion: allVersions[0]?.version || 0
-  });
-});
-nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-QJ3FBOML.js");
-  const history = await getReviewHistory2(nestId, nodeId);
-  return c.json({ reviews: history });
-});
-nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { versions: versionManager } = await engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
-    );
-  }
-  const body = await c.req.json().catch(() => ({}));
-  const targetVersion = Number(body.targetVersion);
-  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
-    throw new ValidationError("targetVersion (a positive integer) is required");
-  }
-  let raw;
-  try {
-    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
-  } catch {
-    throw new NotFoundError(
-      `Version ${targetVersion} not found for ${nodeId}`
-    );
-  }
-  const content = bodyOnly(nodeId, raw);
-  const { node, version } = await updateNode(
-    nestId,
-    nodeId,
-    { content, changeNote: `Restored from version ${targetVersion}` },
-    userEmail
-  );
-  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
-  return c.json({ ok: true, version, node: toNodeResponse(node) });
-});
-nodeRoutes.get("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const userId = c.get("userId");
-  const userEmail = await resolveCallerEmail(userId);
-  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
-    return c.json(
-      { error: "Access denied \u2014 no steward assignment for this node" },
-      403
-    );
-  }
-  let node;
-  try {
-    node = await storage.readDocument(nodeId, { verifyChecksum: true });
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  if (node.pendingChange) {
-    try {
-      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
-      const refreshed = await getPendingChange(nestId, nodeId);
-      if (refreshed) node.pendingChange = refreshed;
-    } catch (err) {
-      console.error("[external-edit] stage-on-read failed:", err);
-    }
-    try {
-      const latest = await loadLatestApprovedNode(nestId, nodeId);
-      if (latest) {
-        node = { ...latest, pendingChange: node.pendingChange };
-      }
-    } catch (err) {
-      console.error("[external-edit] reconstruct-latest failed:", err);
-    }
-  }
-  const response = toNodeResponse(node);
-  if (await isPublicReader(nestId, userId)) {
-    const approved = await getApprovedVersion(nestId, nodeId);
-    if (approved != null) {
-      try {
-        const raw = await versionManager.reconstructVersion(
-          nodeId,
-          approved
-        );
-        response.content = bodyOnly(nodeId, raw);
-      } catch (err) {
-        console.error(
-          "reconstructVersion failed (public single)",
-          nodeId,
-          approved,
-          err
-        );
-        response.content = "";
-      }
-      response.version = approved;
-      response.status = "published";
-      if (isMarkdownFormat(c)) {
-        return c.body(nodeAsMarkdown(response, nodeId), 200, {
-          "Content-Type": "text/markdown; charset=utf-8"
-        });
-      }
-      return c.json({ node: response });
-    }
-  }
-  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
-  if (response.status === "pending_review") {
-    const pending = await getPendingReview(nestId, nodeId);
-    response.pendingReviewBy = pending?.requestedBy ?? null;
-  }
-  if (isMarkdownFormat(c)) {
-    return c.body(nodeAsMarkdown(response, nodeId), 200, {
-      "Content-Type": "text/markdown; charset=utf-8"
-    });
-  }
-  return c.json({ node: response });
-});
-nodeRoutes.patch("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const body = await c.req.json();
-  const baseVersionHeader = c.req.header("X-Base-Version");
-  if (baseVersionHeader) {
-    const baseVersion = parseInt(baseVersionHeader, 10);
-    const conflict = await checkConflict(nestId, nodeId, baseVersion);
-    if (conflict.conflict) {
-      return c.json(
-        {
-          error: "Version conflict",
-          your_version: baseVersion,
-          current_version: conflict.currentVersion,
-          updated_by: conflict.updatedBy,
-          updated_at: conflict.updatedAt,
-          rejected_content: body.content || body.append || null
-        },
-        409
-      );
-    }
-  }
-  const authorEmail = await getUserEmail(c);
-  const { node, version: responseVersion } = await updateNode(
-    nestId,
-    nodeId,
-    {
-      content: body.content,
-      append: body.append,
-      tags: body.tags,
-      title: body.title,
-      status: body.status,
-      changeNote: body.changeNote
-    },
-    authorEmail
-  );
-  return c.json({ node: toNodeResponse(node), version: responseVersion });
-});
-nodeRoutes.delete("/:nodeId{.+}", async (c) => {
-  const nestId = c.req.param("nestId");
-  const nodeId = c.req.param("nodeId");
-  const { storage } = await engineCache.get(nestId);
-  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
-    throw new LockedError(
-      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
-    );
-  }
-  try {
-    await storage.deleteDocument(nodeId);
-  } catch {
-    throw new NotFoundError(`Node not found: ${nodeId}`);
-  }
-  await removeNodeFromTagIndex(nestId, nodeId);
-  const db = getDb();
-  await db.transaction(async (tx) => {
-    await tx.run(
-      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
-    );
-    await tx.run(
-      `DELETE FROM stewards
-       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
-      [nestId, nodeId]
-    );
-  });
-  await trackEvent("node.delete", { nestId, nodeId });
-  return c.json({ deleted: true });
-});
-async function getUserEmail(c) {
-  const userId = c.get("userId");
-  const db = getDb();
-  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
-  return user?.email || "anonymous@localhost";
-}
-
-// src/annotations/routes.ts
-import { Hono as Hono5 } from "hono";
-
-// src/annotations/service.ts
-import { v4 as uuid3 } from "uuid";
-
-// src/annotations/projection.ts
-var MAX_CONTEXT_CHARS = 250;
-var MAX_QUOTE_CHARS = 1e3;
-function clampAnchor(raw) {
-  if (!raw) return null;
-  const quote = (raw.quote ?? "").trim().slice(0, MAX_QUOTE_CHARS);
-  if (!quote) return null;
-  const before = (raw.before ?? "").slice(-MAX_CONTEXT_CHARS);
-  const after = (raw.after ?? "").slice(0, MAX_CONTEXT_CHARS);
-  const line = typeof raw.line === "number" && Number.isFinite(raw.line) && raw.line > 0 ? Math.floor(raw.line) : void 0;
-  return { quote, before, after, ...line !== void 0 ? { line } : {} };
-}
-function oneLine(s) {
-  return s.replace(/\s+/g, " ").replace(/--+>/g, "-\u2192").trim();
-}
-function renderAnchor(anchor) {
-  if (!anchor) {
-    return "<!-- anchor: whole-artifact -->";
-  }
-  const linePart = anchor.line !== void 0 ? `line ${anchor.line} \xB7 ` : "";
-  const context = `\u2026${oneLine(anchor.before)}\u3008${oneLine(anchor.quote)}\u3009${oneLine(
-    anchor.after
-  )}\u2026`;
-  return `<!-- anchor: ${linePart}quote "${oneLine(anchor.quote)}" \xB7 context ${context} -->`;
-}
-function statusHeading(thread) {
-  if (thread.status === "resolved") {
-    const who = thread.resolvedBy ? `${thread.resolvedBy}, ` : "";
-    const when = thread.resolvedAt ? `${thread.resolvedAt}` : "";
-    const meta = who || when ? ` (${who}${when})` : "";
-    return `\u2705 RESOLVED${meta}`;
-  }
-  return "\u{1F7E0} OPEN";
-}
-function snapshotLabel(v) {
-  return v == null ? "Unpinned" : `Snapshot v${v}`;
-}
-function orderThreads(threads) {
-  return [...threads].sort((a, b) => {
-    if (a.status !== b.status) return a.status === "open" ? -1 : 1;
-    return a.createdAt.localeCompare(b.createdAt);
-  });
-}
-function projectThreadsToMarkdown(artifactTitle, threads) {
-  const lines = [];
-  lines.push(`# ${artifactTitle} \u2014 Annotations`);
-  lines.push("");
-  lines.push(
-    "> Auto-generated from review comments, grouped by the artifact snapshot each was anchored to. **Open** threads are unresolved feedback for the next iteration; **resolved** threads were already addressed (don't re-break them)."
-  );
-  lines.push("");
-  if (threads.length === 0) {
-    lines.push("_No annotations yet._");
-    lines.push("");
-    return lines.join("\n");
-  }
-  const buckets2 = /* @__PURE__ */ new Map();
-  for (const t of threads) {
-    const key = t.snapshotVersion ?? null;
-    (buckets2.get(key) ?? buckets2.set(key, []).get(key)).push(t);
-  }
-  const keys = [...buckets2.keys()].sort((a, b) => {
-    if (a == null) return 1;
-    if (b == null) return -1;
-    return b - a;
-  });
-  for (const key of keys) {
-    lines.push(`## ${snapshotLabel(key)}`);
-    lines.push("");
-    for (const thread of orderThreads(buckets2.get(key))) {
-      lines.push(`### Thread \xB7 ${statusHeading(thread)}`);
-      lines.push(renderAnchor(thread.anchor));
-      for (const comment of thread.comments) {
-        lines.push(
-          `- **${comment.author}** \xB7 ${comment.createdAt} \u2014 ${comment.body}`
-        );
-      }
-      lines.push("");
-    }
-  }
-  return lines.join("\n");
-}
-
-// src/annotations/service.ts
-async function loadComments(threadId) {
-  const db = getDb();
-  const rows = await db.all(
-    "SELECT id, author, body, created_at FROM annotation_comments WHERE thread_id = ? ORDER BY created_at ASC, rowid ASC",
-    [threadId]
-  );
-  return rows.map((r) => ({
-    id: r.id,
-    author: r.author,
-    body: r.body,
-    createdAt: r.created_at
-  }));
-}
-async function rowToThread(row) {
-  let anchor = null;
-  if (row.anchor_json) {
-    try {
-      anchor = JSON.parse(row.anchor_json);
-    } catch {
-      anchor = null;
+  return rows.map((r) => ({
+    id: r.id,
+    author: r.author,
+    body: r.body,
+    createdAt: r.created_at
+  }));
+}
+async function rowToThread(row) {
+  let anchor = null;
+  if (row.anchor_json) {
+    try {
+      anchor = JSON.parse(row.anchor_json);
+    } catch {
+      anchor = null;
     }
   }
   return {
@@ -2649,9 +2435,21 @@ async function rowToThread(row) {
 async function getThreadRow(threadId) {
   return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
 }
+async function countThreadsByNode(nestId) {
+  const rows = await getDb().all(
+    `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
+         FROM annotation_threads
+        WHERE nest_id = ?
+        GROUP BY node_id`,
+    [nestId]
+  );
+  const out = {};
+  for (const r of rows) out[r.node_id] = { count: r.count, lastAt: r.last_at };
+  return out;
+}
 async function listThreads(nestId, nodeId) {
   const rows = await getDb().all(
-    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, rowid ASC",
+    "SELECT * FROM annotation_threads WHERE nest_id = ? AND node_id = ? ORDER BY created_at ASC, id ASC",
     [nestId, nodeId]
   );
   return Promise.all(rows.map(rowToThread));
@@ -2758,44 +2556,389 @@ function derivedAnnotationsId(sourceNodeId) {
 }
 async function syncAnnotationsNode(nestId, nodeId, userEmail) {
   try {
-    let title = nodeId;
+    let title = nodeId;
+    let type = null;
+    try {
+      const { storage } = await engineCache.get(nestId);
+      const node = await storage.readDocument(nodeId);
+      title = node.frontmatter?.title || nodeId;
+      type = node.frontmatter?.type || "document";
+    } catch {
+    }
+    if (type !== null && type !== "artifact") return;
+    const threads = await listThreads(nestId, nodeId);
+    const derivedTitle = `${title} \u2014 Annotations`;
+    const markdown = projectThreadsToMarkdown(title, threads);
+    const derivedId = derivedAnnotationsId(nodeId);
+    try {
+      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+    } catch (err) {
+      if (err instanceof NotFoundError) {
+        await createNode(
+          nestId,
+          {
+            id: derivedId,
+            title: derivedTitle,
+            content: markdown,
+            type: "document",
+            tags: ["annotations"]
+          },
+          userEmail
+        );
+      } else {
+        throw err;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
+      err
+    );
+  }
+}
+
+// src/nodes/routes.ts
+var nodeRoutes = new Hono4();
+function nodeAsMarkdown(response, nodeId) {
+  return nodeToMarkdown({
+    id: nodeId,
+    title: response.title,
+    tags: response.tags,
+    status: response.status,
+    body: response.content
+  });
+}
+nodeRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const nodes = await listNodesForCaller(nestId, userId);
+  return c.json({ count: nodes.length, nodes });
+});
+nodeRoutes.post("/", async (c) => {
+  const body = await c.req.json();
+  if (!body.title || !body.content) {
+    throw new ValidationError("title and content are required");
+  }
+  if (body.folder !== void 0 && typeof body.folder !== "string") {
+    throw new ValidationError('folder must be a string path like "gtm/deals"');
+  }
+  const nestId = c.req.param("nestId");
+  const authorEmail = await getUserEmail(c);
+  const { node } = await createNode(
+    nestId,
+    {
+      title: body.title,
+      content: body.content,
+      type: body.type,
+      tags: body.tags,
+      scope: body.scope,
+      status: body.status,
+      schedule: body.schedule,
+      folder: body.folder
+    },
+    authorEmail
+  );
+  const resolved = await resolveStewardsForNode(nestId, node.id);
+  return c.json({
+    node: toNodeResponse(node),
+    stewards: resolved.length > 0 ? resolved.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      source: r.source
+    })) : void 0
+  }, 201);
+});
+nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-ZXAMFTXO.js");
+  const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
+    nestId,
+    nodeId
+  );
+  return c.json({
+    nodeId,
+    stewards: stewards.map((r) => ({
+      email: r.steward.userEmail,
+      role: r.steward.role,
+      scope: r.steward.scope,
+      source: r.source,
+      priority: r.priority
+    })),
+    fallbackToOwner,
+    ownerEmail
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-B3SDOJQE.js");
+  const allVersions = await getVersions2(nestId, nodeId);
+  const approved = await getApprovedVersion2(nestId, nodeId);
+  const db = getDb();
+  const resolutions = await db.all(
+    `SELECT version, status, resolved_by, resolved_at
+         FROM review_requests
+        WHERE nest_id = ? AND node_id = ?
+          AND status IN ('approved', 'rejected')
+          AND resolved_by IS NOT NULL
+        ORDER BY resolved_at DESC`,
+    [nestId, nodeId]
+  );
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const r of resolutions) {
+    if (!byVersion.has(r.version)) {
+      byVersion.set(r.version, { status: r.status, resolvedBy: r.resolved_by });
+    }
+  }
+  const enriched = allVersions.map((v) => {
+    const r = byVersion.get(v.version);
+    return r ? { ...v, resolvedBy: r.resolvedBy, resolutionStatus: r.status } : v;
+  });
+  return c.json({
+    versions: enriched,
+    approvedVersion: approved,
+    currentVersion: allVersions[0]?.version || 0
+  });
+});
+nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-G5US3SMG.js");
+  const history = await getReviewHistory2(nestId, nodeId);
+  return c.json({ reviews: history });
+});
+nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  const targetVersion = Number(body.targetVersion);
+  if (!Number.isInteger(targetVersion) || targetVersion < 1) {
+    throw new ValidationError("targetVersion (a positive integer) is required");
+  }
+  let raw;
+  try {
+    raw = await versionManager.reconstructVersion(nodeId, targetVersion);
+  } catch {
+    throw new NotFoundError(
+      `Version ${targetVersion} not found for ${nodeId}`
+    );
+  }
+  const content = bodyOnly(nodeId, raw);
+  const { node, version } = await updateNode(
+    nestId,
+    nodeId,
+    { content, changeNote: `Restored from version ${targetVersion}` },
+    userEmail
+  );
+  await trackEvent("node.revert", { nestId, nodeId, targetVersion });
+  return c.json({ ok: true, version, node: toNodeResponse(node) });
+});
+nodeRoutes.get("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  let node;
+  try {
+    node = await storage.readDocument(nodeId, { verifyChecksum: true });
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  if (node.pendingChange) {
     try {
-      const { storage } = await engineCache.get(nestId);
-      const node = await storage.readDocument(nodeId);
-      title = node.frontmatter?.title || nodeId;
-    } catch {
+      await scanDocumentForDrift(nestId, nodeId, userEmail || "system:read");
+      const refreshed = await getPendingChange(nestId, nodeId);
+      if (refreshed) node.pendingChange = refreshed;
+    } catch (err) {
+      console.error("[external-edit] stage-on-read failed:", err);
     }
-    const threads = await listThreads(nestId, nodeId);
-    const derivedTitle = `${title} \u2014 Annotations`;
-    const markdown = projectThreadsToMarkdown(title, threads);
-    const derivedId = derivedAnnotationsId(nodeId);
     try {
-      await updateNode(nestId, derivedId, { content: markdown }, userEmail);
+      const latest = await loadLatestApprovedNode(nestId, nodeId);
+      if (latest) {
+        node = { ...latest, pendingChange: node.pendingChange };
+      }
     } catch (err) {
-      if (err instanceof NotFoundError) {
-        await createNode(
-          nestId,
-          {
-            id: derivedId,
-            title: derivedTitle,
-            content: markdown,
-            type: "document",
-            tags: ["annotations"]
-          },
-          userEmail
+      console.error("[external-edit] reconstruct-latest failed:", err);
+    }
+  }
+  const response = toNodeResponse(node);
+  if (await isPublicReader(nestId, userId)) {
+    const approved = await getApprovedVersion(nestId, nodeId);
+    if (approved != null) {
+      try {
+        const raw = await versionManager.reconstructVersion(
+          nodeId,
+          approved
         );
-      } else {
-        throw err;
+        response.content = bodyOnly(nodeId, raw);
+      } catch (err) {
+        console.error(
+          "reconstructVersion failed (public single)",
+          nodeId,
+          approved,
+          err
+        );
+        response.content = "";
+      }
+      response.version = approved;
+      response.status = "published";
+      if (isMarkdownFormat(c)) {
+        return c.body(nodeAsMarkdown(response, nodeId), 200, {
+          "Content-Type": "text/markdown; charset=utf-8"
+        });
       }
+      return c.json({ node: response });
     }
-  } catch (err) {
-    console.warn(
-      `[annotations] failed to sync derived node for ${nestId}/${nodeId}:`,
-      err
+  }
+  response.status = node.pendingChange ? "external_edit_pending" : await getDisplayStatus(nestId, nodeId);
+  if (response.status === "pending_review") {
+    const pending = await getPendingReview(nestId, nodeId);
+    response.pendingReviewBy = pending?.requestedBy ?? null;
+  }
+  if (isMarkdownFormat(c)) {
+    return c.body(nodeAsMarkdown(response, nodeId), 200, {
+      "Content-Type": "text/markdown; charset=utf-8"
+    });
+  }
+  return c.json({ node: response });
+});
+nodeRoutes.patch("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json();
+  const baseVersionHeader = c.req.header("X-Base-Version");
+  if (baseVersionHeader) {
+    const baseVersion = parseInt(baseVersionHeader, 10);
+    const conflict = await checkConflict(nestId, nodeId, baseVersion);
+    if (conflict.conflict) {
+      return c.json(
+        {
+          error: "Version conflict",
+          your_version: baseVersion,
+          current_version: conflict.currentVersion,
+          updated_by: conflict.updatedBy,
+          updated_at: conflict.updatedAt,
+          rejected_content: body.content || body.append || null
+        },
+        409
+      );
+    }
+  }
+  const authorEmail = await getUserEmail(c);
+  const { node, version: responseVersion } = await updateNode(
+    nestId,
+    nodeId,
+    {
+      content: body.content,
+      append: body.append,
+      tags: body.tags,
+      title: body.title,
+      status: body.status,
+      changeNote: body.changeNote,
+      schedule: body.schedule
+    },
+    authorEmail
+  );
+  return c.json({ node: toNodeResponse(node), version: responseVersion });
+});
+nodeRoutes.delete("/:nodeId{.+}", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const { storage } = await engineCache.get(nestId);
+  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before deleting."
     );
   }
+  try {
+    await storage.deleteDocument(nodeId);
+  } catch {
+    throw new NotFoundError(`Node not found: ${nodeId}`);
+  }
+  await removeNodeFromTagIndex(nestId, nodeId);
+  const derivedId = derivedAnnotationsId(nodeId);
+  try {
+    await storage.deleteDocument(derivedId);
+    await removeNodeFromTagIndex(nestId, derivedId);
+  } catch {
+  }
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    await tx.run(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      `DELETE FROM stewards
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
+      [nestId, nodeId]
+    );
+    await tx.run(
+      "DELETE FROM node_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM review_requests WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      "DELETE FROM annotation_threads WHERE nest_id = ? AND node_id = ?",
+      [nestId, derivedId]
+    );
+    await tx.run(
+      `INSERT INTO node_deletions (nest_id, node_id, deleted_by, deleted_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(nest_id, node_id) DO UPDATE
+         SET deleted_by = excluded.deleted_by, deleted_at = excluded.deleted_at`,
+      [nestId, nodeId, await getUserEmail(c), (/* @__PURE__ */ new Date()).toISOString()]
+    );
+  });
+  await trackEvent("node.delete", { nestId, nodeId });
+  return c.json({ deleted: true });
+});
+async function getUserEmail(c) {
+  const userId = c.get("userId");
+  const db = getDb();
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
+  return user?.email || "anonymous@localhost";
 }
 
+// src/annotations/routes.ts
+import { Hono as Hono5 } from "hono";
+
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
@@ -3290,6 +3433,100 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 
 // src/nodes/query-routes.ts
 var queryRoutes = new Hono6();
+queryRoutes.get("/changes", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const sinceRaw = c.req.query("since");
+  const sinceMs = sinceRaw ? Date.parse(sinceRaw) : NaN;
+  if (!sinceRaw || Number.isNaN(sinceMs)) {
+    throw new ValidationError(
+      "since must be an ISO-8601 date, e.g. ?since=2026-07-01T00:00:00Z"
+    );
+  }
+  const includeContent = ["1", "true"].includes(
+    c.req.query("include_content") || ""
+  );
+  const all = await listNodesForCaller(nestId, userId);
+  const db = getDb();
+  const publicReader = await isPublicReader(nestId, userId);
+  const approvedRows = await db.all(
+    "SELECT node_id, approved_at FROM approved_versions WHERE nest_id = ?",
+    [nestId]
+  );
+  const parseDbTs = (t) => Date.parse(t.includes("T") ? t : `${t.replace(" ", "T")}Z`);
+  const approvedAtMsByNode = new Map(
+    approvedRows.map((r) => [r.node_id, parseDbTs(r.approved_at)])
+  );
+  const publishedSince = new Set(
+    approvedRows.filter((r) => parseDbTs(r.approved_at) > sinceMs).map((r) => r.node_id)
+  );
+  const summarize = (n, updatedOverride) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    status: n.status,
+    tags: n.tags,
+    created_at: n.created_at,
+    updated_at: updatedOverride ?? n.updated_at,
+    ...includeContent ? { content: n.content } : {}
+  });
+  const created = [];
+  const updated = [];
+  for (const n of all) {
+    if (publicReader) {
+      const approvedMs = approvedAtMsByNode.get(n.id);
+      if (approvedMs === void 0) continue;
+      const approvedIso = new Date(approvedMs).toISOString();
+      const createdAt2 = Date.parse(n.created_at || "");
+      if (!Number.isNaN(createdAt2) && createdAt2 > sinceMs) {
+        created.push(summarize(n, approvedIso));
+      } else if (approvedMs > sinceMs) {
+        updated.push(summarize(n, approvedIso));
+      }
+      continue;
+    }
+    const createdAt = Date.parse(n.created_at || "");
+    const updatedAt = Date.parse(n.updated_at || "");
+    if (!Number.isNaN(createdAt) && createdAt > sinceMs) created.push(summarize(n));
+    else if (!Number.isNaN(updatedAt) && updatedAt > sinceMs) updated.push(summarize(n));
+    else if (publishedSince.has(n.id)) updated.push(summarize(n));
+  }
+  const canSeeDeleted = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  let deleted = null;
+  if (canSeeDeleted) {
+    const rows = await db.all(
+      "SELECT node_id, deleted_by, deleted_at FROM node_deletions WHERE nest_id = ? AND deleted_at > ?",
+      [nestId, new Date(sinceMs).toISOString()]
+    );
+    const liveIds = new Set(all.map((n) => n.id));
+    deleted = rows.filter((r) => !liveIds.has(r.node_id)).map((r) => ({ id: r.node_id, deleted_by: r.deleted_by, deleted_at: r.deleted_at }));
+  }
+  return c.json({
+    since: new Date(sinceMs).toISOString(),
+    now: (/* @__PURE__ */ new Date()).toISOString(),
+    created,
+    updated,
+    deleted
+  });
+});
+queryRoutes.get("/runnables", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const all = await listNodesForCaller(nestId, userId, {
+    type: RUNNABLE_NODE_TYPES
+  });
+  const runnables = all.map((n) => ({
+    id: n.id,
+    title: n.title,
+    type: n.type,
+    schedule: n.schedule ?? null,
+    status: n.status,
+    tags: n.tags,
+    updated_at: n.updated_at,
+    content: n.content
+  }));
+  return c.json({ count: runnables.length, runnables });
+});
 queryRoutes.get("/graph", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -3322,11 +3559,30 @@ queryRoutes.post("/context", async (c) => {
   const maxTokens = Math.max(50, body.max_tokens ?? 4e3);
   const hops = body.hops ?? 2;
   const includeDrafts = body.include_drafts === true;
+  const isVisible = (d) => includeDrafts || d.frontmatter.status === "published";
   let selector = body.selector?.trim() || null;
   let compileDetail = null;
   let titleMatches = [];
+  let resolvedTitleSelector = false;
   const allDocs = await storage.discoverDocuments();
-  if (!selector && body.prompt) {
+  if (selector && selector.includes("[[")) {
+    const parts = selector.split("|").map((p) => p.trim()).filter(Boolean);
+    const wantedTitles = /* @__PURE__ */ new Set();
+    const rest = [];
+    for (const p of parts) {
+      const m = /^\[\[(.+)\]\]$/.exec(p);
+      if (m) wantedTitles.add(m[1].trim().toLowerCase());
+      else rest.push(p);
+    }
+    if (wantedTitles.size > 0) {
+      selector = rest.join("|") || null;
+      resolvedTitleSelector = true;
+      titleMatches = allDocs.filter(
+        (d) => wantedTitles.has(String(d.frontmatter.title || "").toLowerCase()) && isVisible(d)
+      );
+    }
+  }
+  if (!selector && !resolvedTitleSelector && body.prompt) {
     const titles = allDocs.map((d) => d.frontmatter.title);
     compileDetail = await compilePrompt(body.prompt, nestId, titles);
     selector = compileDetail.selector;
@@ -3352,6 +3608,44 @@ queryRoutes.post("/context", async (c) => {
     hopsUsed = result.hopsUsed;
     nodesTraversed = result.nodesTraversed;
   }
+  if (titleMatches.length > 0 && hops > 0) {
+    const byTitle = new Map(
+      allDocs.map((d) => [
+        String(d.frontmatter.title || "").toLowerCase(),
+        d
+      ])
+    );
+    const byId = new Map(allDocs.map((d) => [d.id, d]));
+    const adj = /* @__PURE__ */ new Map();
+    const link = (a, b) => {
+      (adj.get(a) ?? adj.set(a, /* @__PURE__ */ new Set()).get(a)).add(b);
+      (adj.get(b) ?? adj.set(b, /* @__PURE__ */ new Set()).get(b)).add(a);
+    };
+    for (const d of allDocs) {
+      for (const target of extractWikiTargets(d.body || "")) {
+        const t = byId.get(target) ?? byTitle.get(target.toLowerCase());
+        if (t && t.id !== d.id) link(d.id, t.id);
+      }
+    }
+    const seen = new Set(titleMatches.map((d) => d.id));
+    let frontier = titleMatches.map((d) => d.id);
+    for (let depth = 0; depth < hops && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        for (const nb of adj.get(id) ?? []) {
+          if (seen.has(nb)) continue;
+          seen.add(nb);
+          const doc = byId.get(nb);
+          if (!doc || !isVisible(doc)) continue;
+          next.push(nb);
+          titleMatches.push(doc);
+        }
+      }
+      frontier = next;
+      hopsUsed = Math.max(hopsUsed, depth + 1);
+    }
+    nodesTraversed += seen.size;
+  }
   if (titleMatches.length > 0) {
     const seen = new Set(documents.map((d) => d.id));
     for (const t of titleMatches) {
@@ -3500,6 +3794,10 @@ queryRoutes.get("/overview", async (c) => {
     }))
   });
 });
+queryRoutes.get("/comment-counts", async (c) => {
+  const counts = await countThreadsByNode(c.req.param("nestId"));
+  return c.json({ counts });
+});
 queryRoutes.get("/context", async (c) => {
   const { storage } = await engineCache.get(c.req.param("nestId"));
   const content = await storage.readContextMd();
@@ -3620,7 +3918,87 @@ import { Hono as Hono7 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
+// src/telemetry/trace-log.ts
+var RETENTION_DAYS = 14;
+var PRUNE_EVERY = 500;
+var insertsSincePrune = 0;
+async function logTraceEvent(e) {
+  try {
+    const db = getDb();
+    await db.run(
+      `INSERT INTO api_events
+         (ts, kind, method, path, tool, nest_id, user_id, user_email, status, duration_ms)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        (/* @__PURE__ */ new Date()).toISOString(),
+        e.kind,
+        e.method ?? null,
+        e.path ?? null,
+        e.tool ?? null,
+        e.nestId ?? null,
+        e.userId ?? null,
+        e.userEmail ?? null,
+        e.status ?? null,
+        e.durationMs ?? null
+      ]
+    );
+    if (++insertsSincePrune >= PRUNE_EVERY) {
+      insertsSincePrune = 0;
+      const cutoff = new Date(
+        Date.now() - RETENTION_DAYS * 864e5
+      ).toISOString();
+      await db.run("DELETE FROM api_events WHERE ts < ?", [cutoff]);
+    }
+  } catch {
+  }
+}
+async function listTraceEvents(filters = {}) {
+  const db = getDb();
+  const limit = Number.isFinite(filters.limit) ? Math.min(Math.max(filters.limit, 1), 1e3) : 25;
+  const offset = Number.isFinite(filters.offset) ? Math.max(filters.offset, 0) : 0;
+  const from = "FROM api_events e LEFT JOIN users u ON u.id = e.user_id";
+  const where = [];
+  const args = [];
+  if (filters.kind) {
+    where.push("e.kind = ?");
+    args.push(filters.kind);
+  }
+  if (filters.nestId) {
+    where.push("e.nest_id = ?");
+    args.push(filters.nestId);
+  }
+  if (filters.user) {
+    where.push("(COALESCE(e.user_email, u.email) LIKE ? OR e.user_id = ?)");
+    args.push(`%${filters.user}%`, filters.user);
+  }
+  const whereSql = where.length ? ` WHERE ${where.join(" AND ")}` : "";
+  try {
+    const totalRow = await db.get(
+      `SELECT COUNT(*) AS n ${from}${whereSql}`,
+      args
+    );
+    const total = Number(totalRow?.n ?? 0);
+    const events = await db.all(
+      `SELECT e.*, COALESCE(e.user_email, u.email) AS caller
+         ${from}${whereSql}
+        ORDER BY e.id DESC
+        LIMIT ? OFFSET ?`,
+      [...args, limit, offset]
+    );
+    return { events, total };
+  } catch {
+    return { events: [], total: 0 };
+  }
+}
+
 // src/mcp/tools.ts
+var MAX_HOPS = 10;
+function normalizeHops(raw) {
+  if (raw == null) return 2;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return 2;
+  return Math.max(0, Math.min(MAX_HOPS, Math.floor(n)));
+}
 var TOOL_DEFINITIONS = [
   {
     name: "context_init",
@@ -3649,7 +4027,11 @@ var TOOL_DEFINITIONS = [
     inputSchema: {
       type: "object",
       properties: {
-        query: { type: "string", description: "Selector query" }
+        query: { type: "string", description: "Selector query" },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matched nodes (default: 2). Use 1 for just the matches + direct links, higher to pull in more of the neighborhood."
+        }
       },
       required: ["query"]
     }
@@ -3690,9 +4072,37 @@ var TOOL_DEFINITIONS = [
         max_tokens: {
           type: "number",
           description: "Approximate token budget (default: 8000)"
+        },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matched nodes (default: 2)"
+        }
+      },
+      required: ["selector"]
+    }
+  },
+  {
+    name: "context_export",
+    description: "Export the ENTIRE nest as one markdown bundle \u2014 every accessible document's FULL content. Use when you need the whole nest as context rather than a targeted query. Respects an optional token budget.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        max_tokens: {
+          type: "number",
+          description: "Approximate token budget; documents are included until it's reached (omit for no cap)."
         }
-      },
-      required: ["selector"]
+      }
+    }
+  },
+  {
+    name: "context_comments",
+    description: "Get the review comments/annotations on a document \u2014 anchored quotes, threaded replies, and open/resolved status \u2014 by title or ID. Use to pull human feedback into context.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      }
     }
   },
   {
@@ -3715,7 +4125,11 @@ var TOOL_DEFINITIONS = [
           items: { type: "string" },
           description: "Tags"
         },
-        scope: { type: "string", description: "Visibility scope" }
+        scope: { type: "string", description: "Visibility scope" },
+        folder: {
+          type: "string",
+          description: 'Folder path under nodes/ (e.g. "gtm/deals"); segments are slugified'
+        }
       },
       required: ["title", "content"]
     }
@@ -3882,6 +4296,26 @@ async function resolveLlmBody(ctx, node) {
   }
 }
 async function handleToolCall(toolName, args, ctx) {
+  const started = Date.now();
+  let status = 200;
+  try {
+    return await runTool(toolName, args, ctx);
+  } catch (err) {
+    status = 500;
+    throw err;
+  } finally {
+    void logTraceEvent({
+      kind: "mcp",
+      tool: toolName,
+      nestId: ctx.nestId,
+      userId: ctx.userId,
+      userEmail: ctx.userEmail,
+      status,
+      durationMs: Date.now() - started
+    });
+  }
+}
+async function runTool(toolName, args, ctx) {
   const { storage, queryEngine, versionManager, nestId, userId, userEmail } = ctx;
   switch (toolName) {
     case "context_init": {
@@ -3946,8 +4380,16 @@ ${nodeList}`;
 ${results}`;
     }
     case "context_query": {
-      const result = await queryEngine.query(args.query, { hops: 2 });
-      const nodes = result.documents;
+      const result = await queryEngine.query(args.query, {
+        hops: normalizeHops(args.hops)
+      });
+      const visibility = await Promise.all(
+        result.documents.map(async (n) => ({
+          node: n,
+          visible: await resolveLlmBody(ctx, n) !== null
+        }))
+      );
+      const nodes = visibility.filter((e) => e.visible).map((e) => e.node);
       if (!nodes.length) return `No nodes matched: ${args.query}`;
       const list = nodes.map(
         (n, i) => `${i + 1}. **${n.frontmatter.title}** [${n.frontmatter.type || "document"}] ${(n.frontmatter.tags || []).join(" ")}`
@@ -3995,21 +4437,99 @@ ${body || "(no content)"}`;
 ${list}`;
     }
     case "context_resolve": {
-      const result = await queryEngine.query(args.selector, { hops: 2 });
+      const result = await queryEngine.query(args.selector, {
+        hops: normalizeHops(args.hops)
+      });
       const maxTokens = args.max_tokens || 8e3;
       const approxChars = maxTokens * 4;
+      const resolvedBodies = await Promise.all(
+        result.documents.map(async (n) => ({
+          node: n,
+          body: await resolveLlmBody(ctx, n)
+        }))
+      );
       let total = 0;
       const resolved = [];
-      for (const n of result.documents) {
+      for (const { node: n, body } of resolvedBodies) {
+        if (body === null) continue;
         const entry = `## ${n.frontmatter.title}
 
-${n.body || ""}`;
+${body}`;
         if (total + entry.length > approxChars) break;
         resolved.push(entry);
         total += entry.length;
       }
       return resolved.join("\n\n---\n\n") || "No nodes resolved.";
     }
+    case "context_export": {
+      const docs = await storage.discoverDocuments();
+      const approxChars = args.max_tokens ? args.max_tokens * 4 : Infinity;
+      const resolved = await Promise.all(
+        docs.map(async (n) => ({ node: n, body: await resolveLlmBody(ctx, n) }))
+      );
+      let total = 0;
+      let budgetHit = false;
+      const parts = [];
+      for (const { node: n, body } of resolved) {
+        if (body === null) continue;
+        const meta = [
+          `**Title:** ${n.frontmatter.title}`,
+          `**Type:** ${n.frontmatter.type || "document"}`,
+          n.frontmatter.tags?.length ? `**Tags:** ${n.frontmatter.tags.join(" ")}` : null
+        ].filter(Boolean).join("\n");
+        const entry = `${meta}
+
+${body || "(no content)"}`;
+        if (total + entry.length > approxChars) {
+          budgetHit = true;
+          break;
+        }
+        parts.push(entry);
+        total += entry.length;
+      }
+      if (!parts.length) {
+        return budgetHit ? "Token budget reached before any document fit \u2014 raise max_tokens, or use context_query/context_resolve to target." : "No documents available to export.";
+      }
+      const note = budgetHit ? `
+
+_(Token budget reached \u2014 ${parts.length} of ${docs.length} documents included. Raise max_tokens, or use context_query/context_resolve to target.)_` : "";
+      return `# Nest export \u2014 ${parts.length} document(s)
+
+${parts.join(
+        "\n\n---\n\n"
+      )}${note}`;
+    }
+    case "context_comments": {
+      const docs = await storage.discoverDocuments();
+      let node;
+      if (args.title) {
+        node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === args.title.toLowerCase()
+        );
+      } else if (args.id) {
+        node = docs.find((n) => n.id === args.id);
+      }
+      if (!node) return `Node not found: ${args.title || args.id}`;
+      if (await resolveLlmBody(ctx, node) === null) {
+        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      }
+      const threads = await listThreads(nestId, node.id);
+      if (!threads.length)
+        return `No comments on "${node.frontmatter.title}".`;
+      const openCount = threads.filter((t) => t.status === "open").length;
+      const sections = threads.map((t, i) => {
+        const quote = t.anchor?.quote ? `> ${t.anchor.quote.replace(/\n/g, " ")}
+
+` : "";
+        const head = `### ${i + 1}. [${t.status}]${t.anchor?.quote ? "" : " (whole-document)"}`;
+        const comments = t.comments.map((c) => `- **${c.author}** (${c.createdAt}): ${c.body}`).join("\n");
+        return `${head}
+${quote}${comments}`;
+      }).join("\n\n");
+      return `# Comments on "${node.frontmatter.title}" \u2014 ${threads.length} thread(s), ${openCount} open
+
+${sections}`;
+    }
     case "context_create": {
       if (!await canCreateInNest(nestId, userEmail)) {
         return "You don't have permission to create documents in this nest.";
@@ -4021,7 +4541,8 @@ ${n.body || ""}`;
           content: args.content,
           type: args.type,
           tags: args.tags,
-          scope: args.scope
+          scope: args.scope,
+          folder: args.folder
         },
         userEmail
       );
@@ -4068,8 +4589,8 @@ ${n.body || ""}`;
 
 ${list}`;
       }
-      if (!canManageStewards(ctx.userEmail)) {
-        return "You don't have permission to list stewards. Only the super admin can do this.";
+      if (!await canManageStewards(ctx.nestId, ctx.userId)) {
+        return "You don't have permission to list stewards. Only a nest admin, the nest owner, or the server admin can do this.";
       }
       const allStewards = await getStewardsForNest(ctx.nestId);
       if (allStewards.length === 0) {
@@ -4207,8 +4728,8 @@ ${list}`;
       if (!["nest", "tag", "document"].includes(scope)) {
         return `Invalid scope "${args.scope}". Use: nest, tag, or document.`;
       }
-      if (!canManageStewards(ctx.userEmail)) {
-        return "You don't have permission to manage stewards. Only the super admin can do this.";
+      if (!await canManageStewards(ctx.nestId, ctx.userId)) {
+        return "You don't have permission to manage stewards. Only a nest admin, the nest owner, or the server admin can do this.";
       }
       try {
         await createStewardRecord({
@@ -4226,9 +4747,9 @@ ${list}`;
       }
     }
     case "context_share_nest": {
-      const roles = await resolveUserRoles(ctx.nestId, ctx.userEmail);
-      if (!canManageWith(roles)) {
-        return "You don't have permission to share this nest via this tool (admin only). You can still invite from the UI with write access, or ask a nest admin.";
+      const callerPermission = config.AUTH_MODE === "open" ? "owner" : await resolveNestPermission(ctx.nestId, ctx.userId);
+      if (permissionLevel(callerPermission) < permissionLevel("write")) {
+        return "You don't have permission to share this nest. Sharing needs write access \u2014 ask a nest admin or the owner.";
       }
       const permission = args.permission || "read";
       try {
@@ -4236,7 +4757,8 @@ ${list}`;
           nestId: ctx.nestId,
           email: args.email,
           permission,
-          grantedByEmail: ctx.userEmail
+          grantedByEmail: ctx.userEmail,
+          callerPermission
         });
         const label = permission === "admin" ? "admin" : permission === "write" ? "editor" : "viewer";
         return `Shared this nest with **${args.email}** as ${label}.`;
@@ -4337,8 +4859,407 @@ mcpRoutes.all("/", async (c) => {
   }
 });
 
-// src/governance/routes.ts
+// src/mcp/server-routes.ts
 import { Hono as Hono8 } from "hono";
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { z as z2 } from "zod";
+async function getUserEmail3(userId) {
+  const db = getDb();
+  const user = await db.get("SELECT email FROM users WHERE id = ?", [
+    userId
+  ]);
+  return user?.email || "anonymous@localhost";
+}
+async function canRead(nestId, userId) {
+  if (config.AUTH_MODE === "open") return true;
+  const perm = await resolveNestPermission(nestId, userId);
+  return permissionLevel(perm) >= permissionLevel("read");
+}
+async function resolveNestRef(ref, userId) {
+  const db = getDb();
+  const byId = await db.get("SELECT * FROM nests WHERE id = ?", [ref]);
+  if (byId) return byId;
+  const byName = await db.all(
+    "SELECT * FROM nests WHERE LOWER(name) = LOWER(?) OR LOWER(slug) = LOWER(?)",
+    [ref, ref]
+  );
+  if (byName.length <= 1) return byName[0] ?? null;
+  const readable = (await Promise.all(
+    byName.map(async (n) => await canRead(n.id, userId) ? n : null)
+  )).filter((n) => n !== null);
+  return readable.length === 1 ? readable[0] : null;
+}
+async function buildNestIndex(userId, nestScope) {
+  const [owned, shared, publicExtras] = await Promise.all([
+    listNests(userId),
+    listSharedNests(userId),
+    listPublicNests(userId)
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  const rows = [];
+  for (const n of [...owned, ...shared, ...publicExtras]) {
+    if (seen.has(n.id)) continue;
+    if (nestScope && n.id !== nestScope) continue;
+    seen.add(n.id);
+    rows.push(n);
+  }
+  return Promise.all(
+    rows.map(async (n) => {
+      let permission = "read";
+      try {
+        permission = config.AUTH_MODE === "open" ? "owner" : await resolveNestPermission(n.id, userId);
+      } catch {
+      }
+      let document_count = null;
+      try {
+        const { storage } = await engineCache.get(n.id);
+        document_count = (await storage.discoverDocuments()).length;
+      } catch {
+      }
+      return {
+        id: n.id,
+        name: n.name,
+        description: n.description,
+        visibility: n.visibility,
+        permission,
+        document_count
+      };
+    })
+  );
+}
+function renderNestIndexMarkdown(nests, baseUrl) {
+  const lines = [
+    "# Nest index",
+    "",
+    `${nests.length} nest${nests.length === 1 ? "" : "s"} accessible with these credentials. Full interaction manual: ${baseUrl}/llms.txt`,
+    ""
+  ];
+  for (const n of nests) {
+    lines.push(`## ${n.name}`);
+    lines.push("");
+    lines.push(`- id: \`${n.id}\``);
+    if (n.description) lines.push(`- description: ${n.description}`);
+    lines.push(`- permission: ${n.permission} \xB7 visibility: ${n.visibility}`);
+    if (n.document_count !== null)
+      lines.push(`- documents: ${n.document_count}`);
+    lines.push(
+      `- retrieve: \`POST ${baseUrl}/nests/${n.id}/context\` \xB7 mcp: \`${baseUrl}/nests/${n.id}/mcp\` \xB7 export: \`${baseUrl}/nests/${n.id}/export?format=markdown\``
+    );
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+var NEST_ARG = {
+  nest: {
+    type: "string",
+    description: "Target nest \u2014 id, or exact name/slug (case-insensitive)"
+  }
+};
+var SERVER_TOOL_DEFINITIONS = [
+  {
+    name: "nest_index",
+    description: "Grounded index of every nest these credentials can read: name, id, permission, document count. Call this FIRST, then target a nest with the other tools.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "context_query",
+    description: "Run a structured selector query against one nest. Selector grammar: #tag, type:X, [[Title]], scope:X, combined with +AND, |OR, -NOT.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        query: { type: "string", description: "Selector query" },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matches (default: 2)"
+        }
+      },
+      required: ["nest", "query"]
+    }
+  },
+  {
+    name: "context_search",
+    description: "Full-text keyword search across one nest.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        query: { type: "string", description: "Search terms" }
+      },
+      required: ["nest", "query"]
+    }
+  },
+  {
+    name: "context_get",
+    description: "Get the FULL content of a node in a nest by title or id.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      },
+      required: ["nest"]
+    }
+  },
+  {
+    name: "context_list",
+    description: "Browse one nest's contents with optional type, tag, or limit filters.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        type: { type: "string", description: "Filter by node type" },
+        tag: { type: "string", description: "Filter by tag" },
+        limit: { type: "number", description: "Max nodes to return" }
+      },
+      required: ["nest"]
+    }
+  },
+  {
+    name: "context_overview",
+    description: "Map of one nest: node count, types, tags, title+snippet per node.",
+    inputSchema: {
+      type: "object",
+      properties: { ...NEST_ARG },
+      required: ["nest"]
+    }
+  },
+  {
+    name: "context_resolve",
+    description: "Full deterministic context resolution against one nest \u2014 selector + hops + token budget, complete node bodies.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ...NEST_ARG,
+        selector: { type: "string", description: "Selector query string" },
+        max_tokens: {
+          type: "number",
+          description: "Approximate token budget (default: 8000)"
+        },
+        hops: {
+          type: "number",
+          description: "Graph traversal depth from the matches (default: 2)"
+        }
+      },
+      required: ["nest", "selector"]
+    }
+  }
+];
+async function handleServerToolCall(toolName, args, userId, userEmail, nestScope, baseUrl) {
+  if (toolName === "nest_index") {
+    const nests = await buildNestIndex(userId, nestScope);
+    if (!nests.length) return "No nests accessible with these credentials.";
+    return renderNestIndexMarkdown(nests, baseUrl);
+  }
+  const inaccessible = `Nest not found or not accessible: "${args.nest}". Use nest_index to see what these credentials can read.`;
+  const nest = await resolveNestRef(String(args.nest ?? ""), userId);
+  if (!nest) return inaccessible;
+  if (nestScope && nest.id !== nestScope) return inaccessible;
+  if (!await canRead(nest.id, userId)) return inaccessible;
+  const engine = await engineCache.get(nest.id);
+  return handleToolCall(toolName, args, {
+    storage: engine.storage,
+    queryEngine: engine.query,
+    versionManager: engine.versions,
+    nestId: nest.id,
+    userId,
+    userEmail
+  });
+}
+function createServerMcp(userId, userEmail, nestScope, baseUrl) {
+  const server = new McpServer2(
+    { name: "contextnest-server", version: "1.0.0" },
+    { capabilities: { tools: {} } }
+  );
+  for (const tool of SERVER_TOOL_DEFINITIONS) {
+    const props = tool.inputSchema.properties || {};
+    const required = tool.inputSchema.required || [];
+    const shape = {};
+    for (const [key, def] of Object.entries(props)) {
+      let field;
+      if (def.type === "string") field = z2.string();
+      else if (def.type === "number") field = z2.number();
+      else if (def.type === "array") field = z2.array(z2.string());
+      else field = z2.any();
+      if (!required.includes(key)) field = field.optional();
+      shape[key] = field;
+    }
+    server.tool(tool.name, tool.description, shape, async (args) => {
+      const text = await handleServerToolCall(
+        tool.name,
+        args,
+        userId,
+        userEmail,
+        nestScope,
+        baseUrl
+      );
+      return { content: [{ type: "text", text }] };
+    });
+  }
+  return server;
+}
+function requestBaseUrl(reqUrl) {
+  if (config.PUBLIC_BASE_URL) return config.PUBLIC_BASE_URL;
+  try {
+    return new URL(reqUrl).origin;
+  } catch {
+    return "";
+  }
+}
+var serverMcpRoutes = new Hono8();
+serverMcpRoutes.all("/", async (c) => {
+  const userId = c.get("userId");
+  const userEmail = await getUserEmail3(userId);
+  const server = createServerMcp(
+    userId,
+    userEmail,
+    c.get("nestScope"),
+    requestBaseUrl(c.req.url)
+  );
+  const transport = new WebStandardStreamableHTTPServerTransport2({
+    sessionIdGenerator: void 0,
+    enableJsonResponse: true
+  });
+  await server.server.connect(transport);
+  try {
+    return await transport.handleRequest(c.req.raw);
+  } finally {
+    await transport.close();
+    await server.server.close();
+  }
+});
+var nestIndexRoutes = new Hono8();
+nestIndexRoutes.get("/", async (c) => {
+  const userId = c.get("userId");
+  const nests = await buildNestIndex(userId, c.get("nestScope"));
+  if (c.req.query("format") === "json") {
+    return c.json({ count: nests.length, nests });
+  }
+  const md = renderNestIndexMarkdown(nests, requestBaseUrl(c.req.url));
+  return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
+});
+function renderLlmsTxt(baseUrl) {
+  const B = baseUrl || "<server-url>";
+  return `# ContextNest Community Server
+
+Self-hosted context governance server. Nests are versioned knowledge vaults
+of markdown documents with tags, wiki-links ([[Title]]), and steward
+governance. This file is the complete interaction manual for agents.
+
+## Authentication
+
+Every request (except this file and /health): \`Authorization: Bearer cnst_<api-key>\`.
+Keys are minted in the web UI (Connect dialog \u2192 Generate Key). A key is
+either user-level (sees every nest the user can read) or scoped to one nest.
+Servers in "open" auth mode need no key.
+
+## Start here
+
+1. \`GET ${B}/index\` \u2014 your grounded nest index (markdown; \`?format=json\` for JSON).
+   One entry per accessible nest: name, id, permission, document count, and
+   the per-nest URLs below.
+2. Pick a nest id, then retrieve with the API or MCP.
+
+## Deterministic retrieval API
+
+Same inputs \u2192 same context, every time. The primary call:
+
+\`\`\`
+POST ${B}/nests/<nest-id>/context
+Content-Type: application/json
+{ "selector": "#gtm", "hops": 2, "max_tokens": 4000, "include_drafts": false }
+\`\`\`
+
+Returns \`{ context, nodes[], trace }\` \u2014 assembled markdown plus a trace with
+\`hops_used\` and \`nodes_traversed\` so you can audit exactly what was pulled.
+
+Selector grammar:
+- \`#tag\` \u2014 nodes carrying a tag
+- \`type:document\` \u2014 nodes of a type
+- \`[[Title]]\` \u2014 a node by exact title
+- \`scope:team\` \u2014 nodes by visibility scope
+- Combine: \`+AND\`, \`|OR\`, \`-NOT\` (e.g. \`#gtm+type:document-#draft\`)
+
+Graph-hop logic: \`hops\` is the traversal depth over wiki-links from the
+selector matches. \`hops: 0\` = exactly the matches; \`hops: 1\` = matches plus
+directly linked nodes; \`hops: 2\` (default) and up walk the link graph
+further out. For an exact set with no expansion, OR the selectors together
+(\`[[A]]|[[B]]\`) and pass \`hops: 0\`.
+
+Skip logic \u2014 what retrieval excludes and why:
+- Draft/unapproved documents are skipped unless \`include_drafts: true\`
+  (and public/read-only callers always get approved content only).
+- \`max_tokens\` is a budget: documents that don't fit are skipped, and the
+  trace reports \`truncated_by_budget\` so silence never means "complete".
+- Documents are deduped by id when a title match and a selector match overlap.
+
+Other read endpoints (all under \`${B}/nests/<nest-id>\`):
+- \`POST /query\` \u2014 \`{ "query": "<selector>", "hops": N }\`; matches + snippets, no bodies
+- \`GET /search?q=<terms>\` \u2014 full-text search
+- \`GET /overview\` \u2014 node count, types, tags
+- \`GET /nodes\` \u2014 list; \`GET /nodes/<node-id>?format=markdown\` \u2014 one document
+- \`GET /export?format=markdown\` \u2014 whole nest as one markdown file (optional \`selector\`, \`max_tokens\`)
+- \`GET /graph\` \u2014 ontology graph (nodes, links, tags, stewards)
+
+Write endpoints (need write permission):
+- \`POST /nodes\` \u2014 \`{ "title", "content", "tags"?, "type"?, "folder"? }\`
+- \`PATCH /nodes/<node-id>\` \u2014 \`{ "content"? , "append"?, "tags"?, "title"? }\`
+- \`DELETE /nodes/<node-id>\`
+- Governance: \`POST /nodes/<id>/submit-review\`, \`/approve\`, \`/reject\`
+
+## MCP (Model Context Protocol)
+
+Streamable HTTP, stateless. Two endpoints:
+
+- \`${B}/mcp\` \u2014 server-level, one connection for everything readable.
+  Tools: \`nest_index\` (call first), then \`context_query\`, \`context_search\`,
+  \`context_get\`, \`context_list\`, \`context_overview\`, \`context_resolve\` \u2014
+  each takes a \`nest\` argument (id or exact name) plus the same
+  selector/hops/max_tokens parameters as the REST API. Read-only.
+- \`${B}/nests/<nest-id>/mcp\` \u2014 per-nest, full toolset including writes and
+  governance (create/update, submit/approve/reject, stewards, sharing).
+
+Claude Code / Cursor / VS Code connect natively via HTTP with the
+\`Authorization: Bearer\` header. Claude Desktop needs the mcp-remote bridge:
+
+\`\`\`
+npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
+\`\`\`
+
+## ctx CLI (npm: @promptowl/contextnest-cli)
+
+\`npm i -g @promptowl/contextnest-cli\`
+
+- \`ctx push --server ${B} --nest <nest-id> --key <api-key>\` \u2014 upload a local
+  vault into a nest (add \`--include-drafts\` for unpublished nodes).
+- All other ctx commands (\`query\`, \`add\`, \`search\`, \`checkpoint\`) operate on
+  a LOCAL vault directory only. For remote reads use the API or MCP above \u2014
+  there is currently no remote \`ctx query\`.
+
+## npm packages
+
+- \`@promptowl/contextnest-community\` \u2014 this server
+- \`@promptowl/contextnest-cli\` \u2014 the ctx CLI
+- \`@promptowl/contextnest-engine\` \u2014 vault storage + selector/graph engine
+
+## Conventions
+
+- Node ids are paths: \`nodes/<slug>\` or nested \`nodes/<folder>/<slug>\`.
+- Tags are \`#lowercase\`. Wiki-links are \`[[Exact Title]]\`.
+- Every write is versioned and hash-chained; governed nests route writes
+  through steward review before they become AI-visible.
+`;
+}
+var llmsTxtRoutes = new Hono8();
+llmsTxtRoutes.get("/", (c) => {
+  const md = renderLlmsTxt(requestBaseUrl(c.req.url));
+  return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
+});
+
+// src/governance/routes.ts
+import { Hono as Hono9 } from "hono";
 
 // src/governance/comment-service.ts
 import { v4 as uuid4 } from "uuid";
@@ -4642,7 +5563,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono8();
+var governanceRoutes = new Hono9();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -4671,7 +5592,7 @@ governanceRoutes.get("/stewards", async (c) => {
 governanceRoutes.post("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const body = await c.req.json();
-  const assignedBy = await getUserEmail3(c);
+  const assignedBy = await getUserEmail4(c);
   if (!body.scope) throw new ValidationError("scope is required");
   if (body.scope === "folder") {
     throw new ValidationError(
@@ -4746,7 +5667,7 @@ governanceRoutes.get("/review-queue", async (c) => {
     limit,
     offset
   });
-  const email = await getUserEmail3(c);
+  const email = await getUserEmail4(c);
   const canReviewCache = /* @__PURE__ */ new Map();
   const requests = [];
   for (const r of result.requests) {
@@ -4770,7 +5691,7 @@ governanceRoutes.get("/external-edits", async (c) => {
 });
 governanceRoutes.post("/external-edits/scan", async (c) => {
   const nestId = c.req.param("nestId");
-  const actor = await getUserEmail3(c);
+  const actor = await getUserEmail4(c);
   const result = await scanNestForDrift(nestId, actor);
   return c.json(result);
 });
@@ -4780,7 +5701,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono8();
+var governanceNodeRoutes = new Hono9();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -4839,7 +5760,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const author = await getUserEmail3(c);
+  const author = await getUserEmail4(c);
   try {
     const comment = await createComment({
       nestId,
@@ -4863,7 +5784,7 @@ governanceNodeRoutes.post(
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
     const commentId = c.req.param("commentId");
-    const resolvedBy = await getUserEmail3(c);
+    const resolvedBy = await getUserEmail4(c);
     try {
       const comment = await resolveComment({
         nestId,
@@ -4896,7 +5817,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/submit-review", async (c) => {
   if (currentVersion === 0) {
     throw new ValidationError("Node has no versions to review");
   }
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   let request;
   try {
     request = await submitForReview({
@@ -4931,7 +5852,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const body = await c.req.json();
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   const isAdmin = isSuperAdmin(userEmail);
   try {
     const request = await approve({
@@ -4954,7 +5875,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
   if (!body.note) {
     throw new ValidationError("Rejection note is required");
   }
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   try {
     const request = await reject({
       nestId,
@@ -4971,19 +5892,19 @@ governanceNodeRoutes.post("/:nodeId{.+}/reject", async (c) => {
 governanceNodeRoutes.get("/:nodeId{.+}/can-access", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   return c.json(await canUserAccess(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-approve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   return c.json(await canUserApprove(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   return c.json(await canUserEdit(nestId, nodeId, userEmail));
 });
 governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
@@ -5016,7 +5937,7 @@ governanceNodeRoutes.post(
     const nodeId = c.req.param("nodeId");
     const suggestionId = c.req.param("suggestionId");
     const body = await c.req.json().catch(() => ({}));
-    const actor = await getUserEmail3(c);
+    const actor = await getUserEmail4(c);
     try {
       const result = await approveExternalEdit({
         nestId,
@@ -5052,7 +5973,7 @@ governanceNodeRoutes.post(
     if (!body.reason) {
       throw new ValidationError("Rejection reason is required");
     }
-    const actor = await getUserEmail3(c);
+    const actor = await getUserEmail4(c);
     try {
       const result = await rejectExternalEdit({
         nestId,
@@ -5073,7 +5994,7 @@ governanceNodeRoutes.post(
 governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const userEmail = await getUserEmail3(c);
+  const userEmail = await getUserEmail4(c);
   const request = await cancelReview({
     nestId,
     nodeId,
@@ -5081,7 +6002,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/cancel-review", async (c) => {
   });
   return c.json({ review: request });
 });
-async function getUserEmail3(c) {
+async function getUserEmail4(c) {
   const userId = c.get("userId");
   const db = getDb();
   const user = await db.get(
@@ -5091,6 +6012,30 @@ async function getUserEmail3(c) {
   return user?.email || "anonymous@localhost";
 }
 
+// src/shared/node-id.ts
+function assertSafeNodeId(rawId) {
+  let id = rawId;
+  try {
+    id = decodeURIComponent(rawId);
+  } catch {
+  }
+  if (!id || id.length > 512) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.includes("\0") || id.includes("\\")) {
+    throw new ValidationError("invalid node id");
+  }
+  if (id.startsWith("/")) {
+    throw new ValidationError("invalid node id (absolute path)");
+  }
+  for (const seg of id.split("/")) {
+    if (seg === "" || seg === "." || seg === "..") {
+      throw new ValidationError("invalid node id (path traversal)");
+    }
+  }
+  return id;
+}
+
 // src/auth/anonymous.ts
 import bcrypt from "bcryptjs";
 async function ensureAnonymousUser() {
@@ -5130,6 +6075,7 @@ var openModeMiddleware = createMiddleware2(async (c, next) => {
 function isPublicReadEligiblePath(method, path) {
   if (method !== "GET") return false;
   if (!/^\/nests\/[^/]+(\/.*)?$/.test(path)) return false;
+  if (/^\/nests\/[^/]+\/stewards/.test(path)) return false;
   return !/\/(collaborators|visibility|settings|mcp)/.test(path);
 }
 var flexAuthMiddleware = createMiddleware2(async (c, next) => {
@@ -5153,7 +6099,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
-  const app = new Hono9();
+  const app = new Hono10({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -5174,6 +6120,22 @@ function createApp() {
     }
     return next();
   });
+  app.use("*", async (c, next) => {
+    const path = c.req.path;
+    const traced = /^\/(nests|auth|admin|stats|license|index|mcp)(\/|$)/.test(path) && !path.endsWith("/mcp");
+    const started = Date.now();
+    await next();
+    if (!traced) return;
+    void logTraceEvent({
+      kind: "api",
+      method: c.req.method,
+      path,
+      nestId: /^\/nests\/([^/]+)/.exec(path)?.[1] ?? null,
+      userId: c.get("userId") ?? null,
+      status: c.res.status,
+      durationMs: Date.now() - started
+    });
+  });
   app.get(
     "/health",
     (c) => c.json({
@@ -5273,7 +6235,8 @@ function createApp() {
     logo_url: config.LOGO_URL,
     telemetry_enabled: config.TELEMETRY_ENABLED,
     public_base_url: config.PUBLIC_BASE_URL,
-    max_body_bytes: config.MAX_BODY_BYTES
+    max_body_bytes: config.MAX_BODY_BYTES,
+    slack_webhook_url: config.SLACK_WEBHOOK_URL ?? ""
   });
   app.get("/admin/settings", async (c) => {
     if (!await adminSettingsAllowed(c))
@@ -5308,6 +6271,12 @@ function createApp() {
     if ("telemetry_enabled" in body) {
       pending.push({ name: "TELEMETRY_ENABLED", value: body.telemetry_enabled ? "true" : "false" });
     }
+    if ("slack_webhook_url" in body) {
+      const v = String(body.slack_webhook_url ?? "").trim();
+      if (v && !/^https:\/\//i.test(v))
+        errors.push("slack_webhook_url must be an https:// URL (or empty to disable)");
+      else pending.push({ name: "SLACK_WEBHOOK_URL", value: v || null });
+    }
     if ("max_body_bytes" in body) {
       const n = Number(body.max_body_bytes);
       if (!Number.isFinite(n) || n < 1024 * 1024 || n > 500 * 1024 * 1024)
@@ -5333,6 +6302,29 @@ function createApp() {
     }
     return c.json({ settings: currentServerSettings() });
   });
+  app.use("/admin/trace", flexAuthMiddleware);
+  const traceAllowed = async (c) => {
+    if (config.AUTH_MODE === "open") return true;
+    const userId = c.get("userId");
+    if (await isLicenseAdminUserId(userId)) return true;
+    return isSuperAdmin(await resolveCallerEmail(userId));
+  };
+  app.get("/admin/trace", async (c) => {
+    if (!await traceAllowed(c))
+      return c.json({ error: "Only the server admin can view this." }, 403);
+    const limitRaw = Number(c.req.query("limit"));
+    const offsetRaw = Number(c.req.query("offset"));
+    const limit = Number.isFinite(limitRaw) ? limitRaw : 25;
+    const offset = Number.isFinite(offsetRaw) ? offsetRaw : 0;
+    const { events, total } = await listTraceEvents({
+      limit,
+      offset,
+      kind: c.req.query("kind"),
+      nestId: c.req.query("nest") || void 0,
+      user: c.req.query("user") || void 0
+    });
+    return c.json({ count: events.length, total, limit, offset, events });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
@@ -5359,7 +6351,12 @@ function createApp() {
       users: usersRow.c
     });
   });
-  const nestsApp = new Hono9();
+  app.route("/llms.txt", llmsTxtRoutes);
+  app.use("/index", flexAuthMiddleware);
+  app.route("/index", nestIndexRoutes);
+  app.use("/mcp", flexAuthMiddleware);
+  app.route("/mcp", serverMcpRoutes);
+  const nestsApp = new Hono10();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
     const localPath = c.req.path.replace(/^\/nests\//, "");
@@ -5416,10 +6413,10 @@ function createApp() {
     const isAnnotationAction = /\/annotations$/.test(path) || /\/annotations\/[^/]+\/(comments|resolve|reopen)$/.test(path);
     const isCommentAction = /\/comments$/.test(path) || /\/comments\/[^/]+\/resolve$/.test(path);
     const isStewardRoster = path.includes("/stewards") && !path.includes("/nodes/");
-    if (isStewardRoster && !canManageStewards(await resolveCallerEmail(userId))) {
+    if (isStewardRoster && permission !== "owner" && permission !== "admin") {
       return c.json(
         {
-          error: "You don't have permission to manage stewards. Only the super admin can do this."
+          error: "You don't have permission to manage stewards. Only a nest admin, the nest owner, or the server admin can do this."
         },
         403
       );
@@ -5468,10 +6465,14 @@ function createApp() {
     c.set("nestPermission", permission);
     return next();
   });
+  nestsApp.use("/:nestId/nodes/:nodeId{.+}", async (c, next) => {
+    assertSafeNodeId(c.req.param("nodeId"));
+    return next();
+  });
   nestsApp.route("/", nestRoutes);
   nestsApp.route("/:nestId", governanceRoutes);
-  nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
   nestsApp.route("/:nestId/nodes", annotationRoutes);
+  nestsApp.route("/:nestId/nodes", governanceNodeRoutes);
   nestsApp.route("/:nestId/nodes", nodeRoutes);
   nestsApp.route("/:nestId", queryRoutes);
   nestsApp.route("/:nestId", sharingRoutes);