@promptowl/contextnest-community 1.9.0 → 1.10.0

package/dist/index.js

@@ -1,15 +1,34 @@
 #!/usr/bin/env node
 import {
+  addWatcher,
   approve,
+  canReadNode,
   cancelReview,
+  dispatchEvent,
+  edgeTypeRoutes,
+  edgeTypeToResponse,
+  envRoutes,
+  envValues,
+  filterAccessible,
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
+  isSafeConnectorUrl,
+  listNotifications,
+  listWatchers,
+  markNotificationsRead,
   notifyNestEvent,
+  parseConditionSchema,
   reject,
+  removeWatcher,
+  requireWorkflowPlane,
+  resolveCallerEmail,
+  safeJson,
   safePublishDocument,
-  submitForReview
-} from "./chunk-VC3QNHHB.js";
+  seedDefaultEdgeTypes,
+  submitForReview,
+  verifySmtp
+} from "./chunk-ZM4F7MY7.js";
 import {
   createGrant,
   deleteGrant,
@@ -18,7 +37,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-TIO5XOFD.js";
+} from "./chunk-7PQREKSM.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -38,7 +57,7 @@ import {
   getDisplayStatus,
   getVersions,
   setApprovedVersion
-} from "./chunk-HRQWNRVI.js";
+} from "./chunk-UHUU3VAK.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -72,10 +91,12 @@ import {
   listSharedNests,
   listStewards,
   loadAccessConfig,
+  loadServerSettings,
   nestAllowsSelfApprove,
   nestName,
   nestStorageRoot,
   permissionLevel,
+  persistSetting,
   removeSteward,
   renameNest,
   resolveNestPath,
@@ -91,9 +112,8 @@ import {
   trackEvent,
   uniqueNestName,
   updateSteward,
-  upsertEnvVar,
   validateLicense
-} from "./chunk-BYS4HDME.js";
+} from "./chunk-KFGZIECB.js";
 import {
   AppError,
   ConflictError,
@@ -112,7 +132,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-DPHV6Q26.js";
+} from "./chunk-BC6KFUZH.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID
@@ -122,7 +142,7 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono18 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
@@ -280,6 +300,14 @@ function recordFailure(key, cfg) {
 function clear(key) {
   buckets.delete(key);
 }
+function sweepStale(maxAgeMs = 10 * 6e4) {
+  const cutoff = Date.now() - maxAgeMs;
+  for (const [key, bucket] of buckets.entries()) {
+    if (!bucket.hits.length || bucket.hits[bucket.hits.length - 1] < cutoff) {
+      buckets.delete(key);
+    }
+  }
+}
 
 // src/auth/sso-token.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -450,6 +478,14 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
 }
 var authRoutes = new Hono();
 authRoutes.post("/register", async (c) => {
+  if (config.MANUAL_SIGN_IN !== "open") {
+    return c.json(
+      {
+        error: "Self-registration is disabled on this server. If you were invited, use \u201CSet your password\u201D to activate your account. Otherwise ask your admin for an invite."
+      },
+      403
+    );
+  }
   const body = await c.req.json();
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
@@ -465,25 +501,24 @@ authRoutes.post("/register", async (c) => {
     "SELECT id, is_invited FROM users WHERE LOWER(email) = ?",
     [email]
   );
-  let userId;
-  const passwordHash = await hashPassword(body.password);
-  if (existing && existing.is_invited === 1) {
-    userId = existing.id;
-    await db.run(
-      "UPDATE users SET password_hash = ?, name = COALESCE(?, name), is_invited = 0 WHERE id = ?",
-      [passwordHash, body.name || null, userId]
-    );
-    trackEvent("user.register", { userId, email, claimed: true });
-  } else if (existing) {
+  if (existing) {
+    if (existing.is_invited === 1) {
+      return c.json(
+        {
+          error: "You've been invited to this server. Ask your admin for your temporary password, then sign in and change it \u2014 you can't set it here."
+        },
+        409
+      );
+    }
     throw new ValidationError("Email already registered");
-  } else {
-    userId = uuid();
-    await db.run(
-      "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
-      [userId, email, body.name || null, passwordHash]
-    );
-    trackEvent("user.register", { userId, email });
   }
+  const userId = uuid();
+  const passwordHash = await hashPassword(body.password);
+  await db.run(
+    "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
+    [userId, email, body.name || null, passwordHash]
+  );
+  trackEvent("user.register", { userId, email });
   const sessionId = await createSession(userId, c.req.header("User-Agent"));
   setSessionCookie(c, sessionId);
   return c.json(
@@ -499,6 +534,14 @@ authRoutes.post("/register", async (c) => {
   );
 });
 authRoutes.post("/login", async (c) => {
+  if (config.MANUAL_SIGN_IN === "disabled") {
+    return c.json(
+      {
+        error: "Email & password sign-in is disabled on this server. Sign in with PromptOwl, or contact your admin."
+      },
+      403
+    );
+  }
   const body = await c.req.json();
   if (!body.email || !body.password) {
     throw new ValidationError("email and password are required");
@@ -654,7 +697,7 @@ authRoutes.post("/device", async (c) => {
   const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
   const res = await fetch(`${promptowlUrl}/api/auth/device`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: config.PROMPTOWL_FETCH_HEADERS,
     body: JSON.stringify({
       deviceName: body.deviceName || "ContextNest Community",
       deviceType: body.deviceType || "webapp"
@@ -677,7 +720,8 @@ authRoutes.get("/device/poll", async (c) => {
   }
   const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
   const res = await fetch(
-    `${promptowlUrl}/api/auth/device/poll?code=${encodeURIComponent(code)}&client_secret=${encodeURIComponent(clientSecret)}`
+    `${promptowlUrl}/api/auth/device/poll?code=${encodeURIComponent(code)}&client_secret=${encodeURIComponent(clientSecret)}`,
+    { headers: config.PROMPTOWL_FETCH_HEADERS }
   );
   const data = await res.json();
   return c.json(data, res.status);
@@ -692,7 +736,7 @@ authRoutes.post("/promptowl", async (c) => {
   }
   const promptowlUrl = config.PROMPTOWL_API_URL.replace(/\/$/, "");
   const meRes = await fetch(`${promptowlUrl}/api/user/me`, {
-    headers: { Authorization: `Bearer ${body.token}` }
+    headers: { ...config.PROMPTOWL_FETCH_HEADERS, Authorization: `Bearer ${body.token}` }
   });
   if (!meRes.ok) {
     return c.json({ error: "Invalid or expired PromptOwl token" }, 401);
@@ -1051,7 +1095,12 @@ authRoutes.get("/teammates", async (c) => {
 import { Hono as Hono2 } from "hono";
 
 // src/nodes/service.ts
-import { serializeDocument, parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
+import {
+  serializeDocument,
+  parseDocument as parseDocument2
+} from "@promptowl/contextnest-engine";
+import { rename, mkdir } from "fs/promises";
+import { dirname, join as join2 } from "path";
 
 // src/governance/tag-index-service.ts
 function normalizeTag(raw) {
@@ -1086,45 +1135,6 @@ async function removeNodeFromTagIndex(nestId, nodeId) {
   );
 }
 
-// src/governance/access-guard.ts
-async function resolveCallerEmail(userId) {
-  if (!userId) return "admin@localhost";
-  const db = getDb();
-  const row = await db.get(
-    "SELECT email FROM users WHERE id = ?",
-    [userId]
-  );
-  return row?.email || "admin@localhost";
-}
-async function canReadNode(nestId, nodeId, userId, userEmail) {
-  if (await isPublicReader(nestId, userId)) {
-    return await getApprovedVersion(nestId, nodeId) !== null;
-  }
-  if (!await isStewardshipEnabled(nestId)) return true;
-  if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
-  return await resolveNodeGrant(nestId, userId, nodeId) !== null;
-}
-async function filterAccessible(nestId, userId, userEmail, nodes) {
-  if (await isPublicReader(nestId, userId)) {
-    const filtered = [];
-    for (const n of nodes) {
-      if (await getApprovedVersion(nestId, n.id) !== null) {
-        filtered.push(n);
-      }
-    }
-    return filtered;
-  }
-  if (!await isStewardshipEnabled(nestId)) return nodes;
-  const grants = await listUserGrants(nestId, userId);
-  const accessible = [];
-  for (const n of nodes) {
-    if ((await canUserAccess(nestId, n.id, userEmail)).allowed || grantCoversNode(grants, n.id)) {
-      accessible.push(n);
-    }
-  }
-  return accessible;
-}
-
 // src/governance/external-edit-service.ts
 import { readFile } from "fs/promises";
 import { join } from "path";
@@ -1308,7 +1318,7 @@ async function approveExternalEdit(input) {
     const node = await storage.readDocument(input.documentId);
     const versionNum = result.versionEntry.version;
     const tags = node.frontmatter.tags || [];
-    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-6J4OWQL6.js");
+    const { createVersion: createVersion2, setApprovedVersion: setApprovedVersion2 } = await import("./version-service-A2YAKYQW.js");
     await createVersion2({
       nestId: input.nestId,
       nodeId: input.documentId,
@@ -1382,11 +1392,44 @@ function startDriftScanner(intervalMs = 3e4) {
 // src/nodes/service.ts
 async function userIdFromEmail(email) {
   const db = getDb();
-  const row = await db.get("SELECT id FROM users WHERE LOWER(email) = LOWER(?)", [email]);
+  const row = await db.get(
+    "SELECT id FROM users WHERE LOWER(email) = LOWER(?)",
+    [email]
+  );
   return row?.id ?? ANON_USER_ID;
 }
 var normalizeTag2 = (t) => t.startsWith("#") ? t : `#${t}`;
+var slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+function folderToSegments(folder) {
+  const segments = folder.split("/").map(slugify).filter(Boolean);
+  if (segments.length > 8) {
+    throw new ValidationError("folder may nest at most 8 levels deep");
+  }
+  if (segments.some((seg) => seg.length > 100)) {
+    throw new ValidationError(
+      "each folder or title segment must be at most 100 characters"
+    );
+  }
+  return segments;
+}
 var stripUndefined = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+var nodeWriteChains = /* @__PURE__ */ new Map();
+function withNodeWriteLock(key, fn) {
+  const prev = (nodeWriteChains.get(key) ?? Promise.resolve()).catch(() => {
+  });
+  const run = prev.then(fn);
+  nodeWriteChains.set(key, run);
+  void run.catch(() => {
+  }).finally(() => {
+    if (nodeWriteChains.get(key) === run) nodeWriteChains.delete(key);
+  });
+  return run;
+}
+function toSafeError(err, context, message) {
+  if (err instanceof AppError) return err;
+  console.error(`${context}:`, err);
+  return new AppError(500, message);
+}
 function bodyOnly(nodeId, raw) {
   try {
     return parseDocument2(`${nodeId}.md`, raw, nodeId).body ?? "";
@@ -1449,10 +1492,18 @@ async function listNodesForCaller(nestId, userId, filters = {}) {
         const approved = await getApprovedVersion(nestId, doc.id);
         if (approved != null) {
           try {
-            const raw = await versionManager.reconstructVersion(doc.id, approved);
+            const raw = await versionManager.reconstructVersion(
+              doc.id,
+              approved
+            );
             r.content = bodyOnly(doc.id, raw);
           } catch (err) {
-            console.error("reconstructVersion failed (list)", doc.id, approved, err);
+            console.error(
+              "reconstructVersion failed (list)",
+              doc.id,
+              approved,
+              err
+            );
             r.content = "";
           }
           r.version = approved;
@@ -1482,16 +1533,14 @@ async function listNodesForCallerByEmail(nestId, userEmail, filters = {}) {
 }
 async function createNode(nestId, input, userEmail) {
   const { storage, versions: versionManager } = await engineCache.get(nestId);
-  const slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   const slug = slugify(input.title);
   let id = input.id;
   if (!id) {
-    const folderSegments = (input.folder ?? "").split("/").map(slugify).filter(Boolean);
-    if (folderSegments.length > 8) {
-      throw new ValidationError("folder may nest at most 8 levels deep");
-    }
+    const folderSegments = folderToSegments(input.folder ?? "");
     if ([...folderSegments, slug].some((seg) => seg.length > 100)) {
-      throw new ValidationError("each folder or title segment must be at most 100 characters");
+      throw new ValidationError(
+        "each folder or title segment must be at most 100 characters"
+      );
     }
     id = folderSegments.length > 0 ? `nodes/${folderSegments.join("/")}/${slug}` : `nodes/${slug}`;
   }
@@ -1499,7 +1548,9 @@ async function createNode(nestId, input, userEmail) {
   const tags = (input.tags || []).map(normalizeTag2);
   if (input.schedule !== void 0 && !isRunnableType(input.type)) {
     throw new ValidationError(
-      `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(", ")})`
+      `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
+        ", "
+      )})`
     );
   }
   const hasStewards = await isStewardshipEnabled(nestId);
@@ -1612,7 +1663,11 @@ async function registerImportedDocuments(nestId, userEmail) {
       version = result.node.frontmatter.version || version;
       content = result.node.body || content;
     } catch (err) {
-      console.error("safePublishDocument failed (import register)", nodeId, err);
+      console.error(
+        "safePublishDocument failed (import register)",
+        nodeId,
+        err
+      );
     }
     await createVersion({
       nestId,
@@ -1632,124 +1687,270 @@ async function registerImportedDocuments(nestId, userEmail) {
   return registered;
 }
 async function updateNode(nestId, nodeId, patch, userEmail) {
-  const { storage, versions: versionManager } = await engineCache.get(nestId);
+  return withNodeWriteLock(`${nestId}::${nodeId}`, async () => {
+    try {
+      const { storage, versions: versionManager } = await engineCache.get(
+        nestId
+      );
+      let node;
+      try {
+        node = await storage.readDocument(nodeId);
+      } catch {
+        throw new NotFoundError(`Node not found: ${nodeId}`);
+      }
+      if (patch.content !== void 0) {
+        node = { ...node, body: patch.content };
+      }
+      if (patch.append) {
+        node = { ...node, body: (node.body || "") + "\n\n" + patch.append };
+      }
+      if (patch.tags) {
+        const newTags = patch.tags.map(normalizeTag2);
+        const merged = [
+          .../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])
+        ];
+        node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
+      }
+      if (patch.status) {
+        node = {
+          ...node,
+          frontmatter: { ...node.frontmatter, status: patch.status }
+        };
+      }
+      if (patch.title) {
+        node = {
+          ...node,
+          frontmatter: { ...node.frontmatter, title: patch.title }
+        };
+      }
+      if (patch.schedule !== void 0) {
+        if (!isRunnableType(node.frontmatter.type)) {
+          throw new ValidationError(
+            `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(
+              ", "
+            )})`
+          );
+        }
+        const metadata = { ...node.frontmatter.metadata };
+        if (patch.schedule === "") delete metadata.schedule;
+        else metadata.schedule = patch.schedule;
+        node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
+      }
+      const hasStewards = await isStewardshipEnabled(nestId);
+      const currentTags = node.frontmatter.tags || [];
+      if (hasStewards && await getPendingReview(nestId, nodeId)) {
+        throw new LockedError(
+          "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
+        );
+      }
+      let responseVersion;
+      if (hasStewards) {
+        const currentVersion = await getCurrentVersion(nestId, nodeId);
+        const newVersion = currentVersion + 1;
+        node = {
+          ...node,
+          frontmatter: {
+            ...node.frontmatter,
+            version: newVersion,
+            updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+            // Drop stale published-state checksum so the next verified read
+            // doesn't flag this write as external drift.
+            checksum: void 0
+          }
+        };
+        node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+        await storage.writeDocument(nodeId, serializeDocument(node));
+        await syncNodeTags(nestId, nodeId, currentTags);
+        try {
+          await versionManager.createVersion(node, userEmail, {
+            note: patch.changeNote
+          });
+        } catch (err) {
+          console.error(
+            "VersionManager.createVersion failed (node patch)",
+            err
+          );
+          throw err;
+        }
+        await createVersion({
+          nestId,
+          nodeId,
+          version: newVersion,
+          content: node.body || "",
+          author: userEmail,
+          status: "draft",
+          tags: currentTags,
+          changeNote: patch.changeNote
+        });
+        responseVersion = newVersion;
+      } else {
+        node = {
+          ...node,
+          frontmatter: {
+            ...node.frontmatter,
+            updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+            checksum: void 0
+          }
+        };
+        node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
+        await storage.writeDocument(nodeId, serializeDocument(node));
+        await syncNodeTags(nestId, nodeId, currentTags);
+        let publishedVersion = (node.frontmatter.version || 0) + 1;
+        try {
+          const result = await safePublishDocument(storage, nodeId, {
+            editedBy: userEmail,
+            note: patch.changeNote || "Auto-published on edit (no stewards)"
+          });
+          publishedVersion = result.node.frontmatter.version || publishedVersion;
+          node = result.node;
+        } catch (err) {
+          console.error(
+            "publishDocument failed (node patch auto-publish)",
+            err
+          );
+          throw err;
+        }
+        await createVersion({
+          nestId,
+          nodeId,
+          version: publishedVersion,
+          content: node.body || "",
+          author: userEmail,
+          status: "published",
+          tags: currentTags,
+          changeNote: patch.changeNote
+        });
+        await setApprovedVersion(
+          nestId,
+          nodeId,
+          publishedVersion,
+          userEmail
+        );
+        responseVersion = publishedVersion;
+      }
+      return { node, version: responseVersion };
+    } catch (err) {
+      throw toSafeError(
+        err,
+        `updateNode failed (${nestId}/${nodeId})`,
+        "Couldn't save your changes. Please reload the document and try again."
+      );
+    }
+  });
+}
+function derivedIdOf(sourceNodeId) {
+  return `nodes/${sourceNodeId.replace(/^nodes\//, "")}--annotations`;
+}
+async function moveNode(nestId, nodeId, folder, userEmail) {
+  const { storage } = await engineCache.get(nestId);
   let node;
   try {
     node = await storage.readDocument(nodeId);
   } catch {
     throw new NotFoundError(`Node not found: ${nodeId}`);
   }
-  if (patch.content !== void 0) {
-    node = { ...node, body: patch.content };
-  }
-  if (patch.append) {
-    node = { ...node, body: (node.body || "") + "\n\n" + patch.append };
-  }
-  if (patch.tags) {
-    const newTags = patch.tags.map(normalizeTag2);
-    const merged = [.../* @__PURE__ */ new Set([...node.frontmatter.tags || [], ...newTags])];
-    node = { ...node, frontmatter: { ...node.frontmatter, tags: merged } };
+  if (await isStewardshipEnabled(nestId) && await getPendingReview(nestId, nodeId)) {
+    throw new LockedError(
+      "This document is awaiting steward review and is locked. Approve or reject the pending review before moving."
+    );
   }
-  if (patch.status) {
-    node = { ...node, frontmatter: { ...node.frontmatter, status: patch.status } };
+  const leaf = nodeId.split("/").pop();
+  const segments = folderToSegments(folder);
+  const newId = segments.length > 0 ? `nodes/${segments.join("/")}/${leaf}` : `nodes/${leaf}`;
+  if (newId === nodeId) return { node, previousId: nodeId };
+  try {
+    await storage.readDocument(newId);
+    throw new ConflictError(
+      `A document already exists at that location: ${newId}`
+    );
+  } catch (err) {
+    if (err instanceof ConflictError) throw err;
   }
-  if (patch.title) {
-    node = { ...node, frontmatter: { ...node.frontmatter, title: patch.title } };
+  const moved = {
+    ...node,
+    id: newId,
+    frontmatter: {
+      ...node.frontmatter,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  await storage.writeDocument(newId, serializeDocument(moved));
+  try {
+    const nestPath = resolveNestPath(nestId);
+    const oldChain = join2(nestPath, dirname(nodeId), ".versions", leaf);
+    const newChain = join2(nestPath, dirname(newId), ".versions", leaf);
+    if (oldChain !== newChain) {
+      await mkdir(dirname(newChain), { recursive: true });
+      await rename(oldChain, newChain);
+    }
+  } catch {
   }
-  if (patch.schedule !== void 0) {
-    if (!isRunnableType(node.frontmatter.type)) {
-      throw new ValidationError(
-        `schedule is only valid for runnable node types (${RUNNABLE_NODE_TYPES.join(", ")})`
+  await storage.deleteDocument(nodeId);
+  const oldDerived = derivedIdOf(nodeId);
+  const newDerived = derivedIdOf(newId);
+  const db = getDb();
+  await db.transaction(async (tx) => {
+    for (const [table, column] of [
+      ["node_versions", "node_id"],
+      ["review_requests", "node_id"],
+      ["approved_versions", "node_id"],
+      ["annotation_threads", "node_id"],
+      ["comments", "node_id"],
+      ["node_tag_index", "node_id"]
+    ]) {
+      await tx.run(
+        `UPDATE ${table} SET ${column} = ? WHERE nest_id = ? AND ${column} = ?`,
+        [newId, nestId, nodeId]
+      );
+      await tx.run(
+        `UPDATE ${table} SET ${column} = ? WHERE nest_id = ? AND ${column} = ?`,
+        [newDerived, nestId, oldDerived]
       );
     }
-    const metadata = { ...node.frontmatter.metadata };
-    if (patch.schedule === "") delete metadata.schedule;
-    else metadata.schedule = patch.schedule;
-    node = { ...node, frontmatter: { ...node.frontmatter, metadata } };
-  }
-  const hasStewards = await isStewardshipEnabled(nestId);
-  const currentTags = node.frontmatter.tags || [];
-  if (hasStewards && await getPendingReview(nestId, nodeId)) {
-    throw new LockedError(
-      "This document is awaiting steward review and is locked. Approve or reject the pending review before editing."
+    await tx.run(
+      `UPDATE stewards SET node_pattern = ?
+       WHERE nest_id = ? AND scope = 'document' AND node_pattern = ?`,
+      [newId, nestId, nodeId]
     );
+    await tx.run(
+      `UPDATE grants SET target = ?
+       WHERE nest_id = ? AND target_type = 'document' AND target = ?`,
+      [newId, nestId, nodeId]
+    );
+    await tx.run(
+      "UPDATE edges SET from_node = ? WHERE nest_id = ? AND from_node = ?",
+      [newId, nestId, nodeId]
+    );
+    await tx.run(
+      "UPDATE edges SET to_node = ? WHERE nest_id = ? AND to_node = ?",
+      [newId, nestId, nodeId]
+    );
+    await tx.run(
+      "UPDATE runs SET agent_node = ? WHERE nest_id = ? AND agent_node = ?",
+      [newId, nestId, nodeId]
+    );
+    await tx.run(
+      `UPDATE run_steps SET node_id = ?
+       WHERE node_id = ? AND run_id IN (SELECT id FROM runs WHERE nest_id = ?)`,
+      [newId, nodeId, nestId]
+    );
+  });
+  try {
+    const derivedDoc = await storage.readDocument(oldDerived);
+    await storage.writeDocument(
+      newDerived,
+      serializeDocument({ ...derivedDoc, id: newDerived })
+    );
+    await storage.deleteDocument(oldDerived);
+  } catch {
   }
-  let responseVersion;
-  if (hasStewards) {
-    const currentVersion = await getCurrentVersion(nestId, nodeId);
-    const newVersion = currentVersion + 1;
-    node = {
-      ...node,
-      frontmatter: {
-        ...node.frontmatter,
-        version: newVersion,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        // Drop stale published-state checksum so the next verified read
-        // doesn't flag this write as external drift.
-        checksum: void 0
-      }
-    };
-    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
-    await storage.writeDocument(nodeId, serializeDocument(node));
-    await syncNodeTags(nestId, nodeId, currentTags);
-    try {
-      await versionManager.createVersion(node, userEmail, { note: patch.changeNote });
-    } catch (err) {
-      console.error("VersionManager.createVersion failed (node patch)", err);
-    }
-    await createVersion({
-      nestId,
-      nodeId,
-      version: newVersion,
-      content: node.body || "",
-      author: userEmail,
-      status: "draft",
-      tags: currentTags,
-      changeNote: patch.changeNote
-    });
-    responseVersion = newVersion;
-  } else {
-    node = {
-      ...node,
-      frontmatter: {
-        ...node.frontmatter,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        checksum: void 0
-      }
-    };
-    node = { ...node, frontmatter: stripUndefined(node.frontmatter) };
-    await storage.writeDocument(nodeId, serializeDocument(node));
-    await syncNodeTags(nestId, nodeId, currentTags);
-    let publishedVersion = (node.frontmatter.version || 0) + 1;
-    try {
-      const result = await safePublishDocument(storage, nodeId, {
-        editedBy: userEmail,
-        note: patch.changeNote || "Auto-published on edit (no stewards)"
-      });
-      publishedVersion = result.node.frontmatter.version || publishedVersion;
-      node = result.node;
-    } catch (err) {
-      console.error("publishDocument failed (node patch auto-publish)", err);
-    }
-    await createVersion({
-      nestId,
-      nodeId,
-      version: publishedVersion,
-      content: node.body || "",
-      author: userEmail,
-      status: "published",
-      tags: currentTags,
-      changeNote: patch.changeNote
-    });
-    await setApprovedVersion(nestId, nodeId, publishedVersion, userEmail);
-    responseVersion = publishedVersion;
-  }
-  return { node, version: responseVersion };
+  await trackEvent("node.move", { nestId, nodeId, newId });
+  return { node: moved, previousId: nodeId };
 }
 
 // src/nests/unsynced-service.ts
 import { readdirSync, readFileSync, rmSync, statSync } from "fs";
-import { join as join2, relative, resolve } from "path";
+import { join as join3, relative, resolve } from "path";
 var RESERVED = /* @__PURE__ */ new Set(["nests"]);
 function isNestStorageRoot(absPath) {
   return resolve(absPath) === resolve(nestStorageRoot());
@@ -1765,7 +1966,7 @@ function scanMarkdown(dir) {
   }
   for (const e of entries) {
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
-    const full = join2(dir, e.name);
+    const full = join3(dir, e.name);
     if (e.isDirectory()) {
       const sub = scanMarkdown(full);
       count += sub.count;
@@ -1815,7 +2016,7 @@ function collectLeafFolders(rel, abs) {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
     out.push(
-      ...collectLeafFolders(`${rel}/${e.name}`, join2(abs, e.name))
+      ...collectLeafFolders(`${rel}/${e.name}`, join3(abs, e.name))
     );
   }
   return out;
@@ -1833,7 +2034,7 @@ function listUnsyncedFolders() {
     if (!e.isDirectory()) continue;
     if (e.name.startsWith(".")) continue;
     if (RESERVED.has(e.name)) continue;
-    const abs = join2(root, e.name);
+    const abs = join3(root, e.name);
     if (isNestStorageRoot(abs)) continue;
     out.push(...collectLeafFolders(e.name, abs));
   }
@@ -1870,7 +2071,7 @@ function collectMarkdownFiles(dir, root) {
   }
   for (const e of entries) {
     if (e.name.startsWith(".") || e.name === "node_modules") continue;
-    const full = join2(dir, e.name);
+    const full = join3(dir, e.name);
     if (e.isDirectory()) {
       out.push(...collectMarkdownFiles(full, root));
     } else if (e.isFile() && e.name.toLowerCase().endsWith(".md")) {
@@ -1888,7 +2089,7 @@ async function syncUnsyncedFolder(userId, folderName, callerEmail) {
     `[unsynced] sync requested folder="${folderName}" user="${callerEmail}"`
   );
   assertSafeFolderName(folderName);
-  const src = join2(config.DATA_ROOT, folderName);
+  const src = join3(config.DATA_ROOT, folderName);
   if (isNestStorageRoot(src)) {
     throw new ValidationError("Folder is not eligible for sync");
   }
@@ -2003,11 +2204,33 @@ nestRoutes.get("/", async (c) => {
     "SELECT nest_id, COUNT(DISTINCT user_email) AS c FROM stewards WHERE is_active = 1 GROUP BY nest_id"
   );
   const stewardByNest = new Map(stewardRows.map((r) => [r.nest_id, r.c]));
+  const stewardEmailRows = await db.all(
+    `SELECT nest_id, user_email FROM stewards WHERE is_active = 1
+      GROUP BY nest_id, user_email ORDER BY MIN(assigned_at)`
+  );
+  const stewardEmailsByNest = /* @__PURE__ */ new Map();
+  for (const r of stewardEmailRows) {
+    const arr = stewardEmailsByNest.get(r.nest_id) ?? [];
+    if (arr.length < 8) arr.push(r.user_email);
+    stewardEmailsByNest.set(r.nest_id, arr);
+  }
+  const collabEmailRows = await db.all(
+    `SELECT nc.nest_id, u.email FROM nest_collaborators nc
+       JOIN users u ON u.id = nc.user_id ORDER BY nc.granted_at`
+  );
+  const collabEmailsByNest = /* @__PURE__ */ new Map();
+  for (const r of collabEmailRows) {
+    const arr = collabEmailsByNest.get(r.nest_id) ?? [];
+    if (arr.length < 8) arr.push(r.email);
+    collabEmailsByNest.set(r.nest_id, arr);
+  }
   const withMeta = out.map((n) => ({
     ...n,
     document_count: docByNest.get(n.id) ?? 0,
     collaborator_count: collabByNest.get(n.id) ?? 0,
-    steward_count: stewardByNest.get(n.id) ?? 0
+    steward_count: stewardByNest.get(n.id) ?? 0,
+    steward_emails: stewardEmailsByNest.get(n.id) ?? [],
+    collaborator_emails: collabEmailsByNest.get(n.id) ?? []
   }));
   return c.json({ nests: withMeta });
 });
@@ -2019,7 +2242,10 @@ nestRoutes.post("/", async (c) => {
   const nest = await createNest(c.get("userId"), body.name, body.description);
   return c.json({ nest }, 201);
 });
-nestRoutes.post("/import", async (c) => {
+nestRoutes.post("/:nestId", async (c) => {
+  if (c.req.param("nestId") !== "import") {
+    throw new NotFoundError("Not found");
+  }
   const body = await c.req.json();
   if (!body.name) {
     throw new ValidationError("name is required");
@@ -2033,14 +2259,17 @@ nestRoutes.post("/import", async (c) => {
   );
   return c.json({ nest, documents }, 201);
 });
-nestRoutes.get("/unsynced", async (c) => {
+async function handleUnsyncedList(c) {
   const userId = c.get("userId");
   if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can list unsynced folders");
   }
   return c.json({ folders: listUnsyncedFolders() });
-});
-nestRoutes.post("/unsynced/sync", async (c) => {
+}
+nestRoutes.post("/:nestId/sync", async (c) => {
+  if (c.req.param("nestId") !== "unsynced") {
+    throw new NotFoundError("Not found");
+  }
   const userId = c.get("userId");
   if (config.AUTH_MODE !== "open" && !await isLicenseAdminUserId(userId)) {
     throw new ForbiddenError("Only the server admin can sync folders");
@@ -2058,6 +2287,7 @@ nestRoutes.post("/unsynced/sync", async (c) => {
 });
 nestRoutes.get("/:nestId", async (c) => {
   const nestId = c.req.param("nestId");
+  if (nestId === "unsynced") return handleUnsyncedList(c);
   const userId = c.get("userId");
   const permission = await effectivePermission(nestId, userId);
   if (permission === "none") {
@@ -2784,10 +3014,10 @@ nodeRoutes.post("/", async (c) => {
     })) : void 0
   }, 201);
 });
-nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
+nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-3KCVVXCW.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-D5PDWXBR.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -2805,10 +3035,10 @@ nodeRoutes.get("/:nodeId{.+?}/stewards", async (c) => {
     ownerEmail
   });
 });
-nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
+nodeRoutes.get("/:nodeId{.+}/versions", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-6J4OWQL6.js");
+  const { getVersions: getVersions2, getApprovedVersion: getApprovedVersion2 } = await import("./version-service-A2YAKYQW.js");
   const allVersions = await getVersions2(nestId, nodeId);
   const approved = await getApprovedVersion2(nestId, nodeId);
   const db = getDb();
@@ -2837,10 +3067,10 @@ nodeRoutes.get("/:nodeId{.+?}/versions", async (c) => {
     currentVersion: allVersions[0]?.version || 0
   });
 });
-nodeRoutes.get("/:nodeId{.+?}/reviews", async (c) => {
+nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-A3XFQTJH.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-VLSUT6KK.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -2879,6 +3109,50 @@ nodeRoutes.post("/:nodeId{.+}/revert", async (c) => {
   await trackEvent("node.revert", { nestId, nodeId, targetVersion });
   return c.json({ ok: true, version, node: toNodeResponse(node) });
 });
+nodeRoutes.post("/:nodeId{.+}/move", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const userId = c.get("userId");
+  const userEmail = await resolveCallerEmail(userId);
+  if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
+    return c.json(
+      { error: "Access denied \u2014 no steward assignment for this node" },
+      403
+    );
+  }
+  const body = await c.req.json().catch(() => ({}));
+  if (typeof body.folder !== "string") {
+    throw new ValidationError('folder (a string; "" for the nest root) is required');
+  }
+  const { node, previousId } = await moveNode(nestId, nodeId, body.folder, userEmail);
+  return c.json({ ok: true, node: toNodeResponse(node), previousId });
+});
+nodeRoutes.get("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  return c.json({ watchers: await listWatchers(nestId, nodeId) });
+});
+nodeRoutes.post("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const body = await c.req.json().catch(() => ({}));
+  const email = typeof body.email === "string" ? body.email.trim() : "";
+  if (!email || !email.includes("@")) {
+    throw new ValidationError("email is required");
+  }
+  await addWatcher(nestId, nodeId, email, await getUserEmail(c));
+  return c.json({ watchers: await listWatchers(nestId, nodeId) }, 201);
+});
+nodeRoutes.delete("/:nodeId{.+}/watchers", async (c) => {
+  const nestId = c.req.param("nestId");
+  const nodeId = c.req.param("nodeId");
+  const email = c.req.query("email")?.trim() ?? "";
+  if (!email) throw new ValidationError("email query param is required");
+  if (!await removeWatcher(nestId, nodeId, email)) {
+    throw new NotFoundError("Not watching");
+  }
+  return c.json({ watchers: await listWatchers(nestId, nodeId) });
+});
 nodeRoutes.get("/:nodeId{.+}", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -3123,10 +3397,8 @@ annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread }, 201);
 });
-annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) => {
+async function handleAnnotationReply(c, nodeId, threadId) {
   const nestId = c.req.param("nestId");
-  const nodeId = getNodeId(c);
-  const threadId = c.req.param("threadId");
   const userId = c.get("userId");
   const userEmail = await resolveCallerEmail(userId);
   if (!await canReadNode(nestId, nodeId, userId, userEmail)) {
@@ -3139,7 +3411,11 @@ annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/comments", async (c) =
   const thread = await addComment(nestId, nodeId, threadId, userEmail, input.body);
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
-});
+}
+annotationRoutes.post(
+  "/:nodeId{.+}/annotations/:threadId/comments",
+  async (c) => handleAnnotationReply(c, getNodeId(c), c.req.param("threadId"))
+);
 annotationRoutes.post("/:nodeId{.+}/annotations/:threadId/resolve", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = getNodeId(c);
@@ -3209,30 +3485,231 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 import { Hono as Hono7 } from "hono";
 import { serializeDocument as serializeDocument2 } from "@promptowl/contextnest-engine";
 
-// src/nodes/prompt-compiler.ts
-var STOPWORDS = /* @__PURE__ */ new Set([
-  "the",
-  "a",
-  "an",
-  "and",
-  "or",
-  "but",
-  "if",
-  "then",
-  "else",
-  "so",
-  "as",
-  "is",
-  "are",
-  "was",
-  "were",
-  "be",
-  "been",
-  "being",
-  "have",
-  "has",
-  "had",
-  "do",
+// src/tables/service.ts
+function splitCsvLine(line) {
+  const out = [];
+  let cur = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (line[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  out.push(cur);
+  return out.map((s) => s.trim());
+}
+var DIRECTIVES = /* @__PURE__ */ new Set(["key", "number", "date", "text"]);
+function parseTable(body) {
+  const lines = body.split(/\r?\n/).filter((l) => l.trim() !== "" && !l.trim().startsWith("#"));
+  if (!lines.length) {
+    throw new ValidationError("table body is empty \u2014 expected a CSV header row");
+  }
+  const columns = splitCsvLine(lines[0]).map((raw) => {
+    const parts = raw.split(":").map((p) => p.trim());
+    const name = parts[0];
+    if (!name) throw new ValidationError("empty column name in header");
+    let type = "text";
+    let key = false;
+    for (const d of parts.slice(1)) {
+      const dl = d.toLowerCase();
+      if (!DIRECTIVES.has(dl)) {
+        throw new ValidationError(
+          `unknown column directive ":${d}" on "${name}" \u2014 known: ${[...DIRECTIVES].join(", ")}`
+        );
+      }
+      if (dl === "key") key = true;
+      else type = dl;
+    }
+    return { name, type, key };
+  });
+  const rows = lines.slice(1).map((l) => {
+    const cells = splitCsvLine(l);
+    while (cells.length < columns.length) cells.push("");
+    return cells.slice(0, columns.length);
+  });
+  return { columns, rows };
+}
+var OPS = [">=", "<=", "!=", "=", ">", "<", "contains"];
+function parseQuery(q) {
+  let rest = q.trim();
+  const out = { where: [], select: null, limit: null };
+  if (!rest) return out;
+  const limitMatch = rest.match(/\blimit\s+(\d+)\s*$/i);
+  if (limitMatch) {
+    out.limit = parseInt(limitMatch[1], 10);
+    rest = rest.slice(0, limitMatch.index).trim();
+  }
+  const selectMatch = rest.match(/\bselect\s+(.+)$/i);
+  if (selectMatch) {
+    out.select = selectMatch[1].split(",").map((s) => s.trim()).filter(Boolean);
+    rest = rest.slice(0, selectMatch.index).trim();
+  }
+  if (!rest) return out;
+  if (!/^where\s/i.test(rest)) {
+    throw new ValidationError(
+      'query must start with "where" (or be empty for all rows)'
+    );
+  }
+  rest = rest.replace(/^where\s+/i, "");
+  for (const clause of rest.split(/\s+and\s+/i)) {
+    const m = clause.match(
+      /^\s*([\w .\-]+?)\s*(>=|<=|!=|=|>|<|contains)\s*(.+)\s*$/i
+    );
+    if (!m) {
+      throw new ValidationError(
+        `can't parse condition "${clause}" \u2014 expected <column> <op> <value> with op in ${OPS.join(" ")}`
+      );
+    }
+    let value = m[3].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out.where.push({ column: m[1].trim(), op: m[2].toLowerCase(), value });
+  }
+  return out;
+}
+function compare(cell, cond, type) {
+  if (cond.op === "contains") {
+    return cell.toLowerCase().includes(cond.value.toLowerCase());
+  }
+  let a = cell;
+  let b = cond.value;
+  if (type === "number") {
+    a = Number(cell);
+    b = Number(cond.value);
+    if (Number.isNaN(a) || Number.isNaN(b)) return false;
+  } else if (type === "date") {
+    a = Date.parse(cell);
+    b = Date.parse(cond.value);
+    if (Number.isNaN(a) || Number.isNaN(b)) return false;
+  } else {
+    a = cell.toLowerCase();
+    b = cond.value.toLowerCase();
+  }
+  switch (cond.op) {
+    case "=":
+      return a === b;
+    case "!=":
+      return a !== b;
+    case ">":
+      return a > b;
+    case ">=":
+      return a >= b;
+    case "<":
+      return a < b;
+    case "<=":
+      return a <= b;
+  }
+}
+function runQuery(table, query) {
+  const colIndex = new Map(table.columns.map((c, i) => [c.name.toLowerCase(), i]));
+  const resolve2 = (name) => {
+    const i = colIndex.get(name.toLowerCase());
+    if (i === void 0) {
+      throw new ValidationError(
+        `unknown column "${name}" \u2014 table has: ${table.columns.map((c) => c.name).join(", ")}`
+      );
+    }
+    return i;
+  };
+  const conds = query.where.map((c) => ({
+    ...c,
+    idx: resolve2(c.column),
+    type: table.columns[resolve2(c.column)].type
+  }));
+  let rows = table.rows.filter(
+    (r) => conds.every((c) => compare(r[c.idx], c, c.type))
+  );
+  const matched = rows.length;
+  if (query.limit !== null) rows = rows.slice(0, query.limit);
+  let columns = table.columns.map((c) => c.name);
+  if (query.select) {
+    const idxs = query.select.map(resolve2);
+    columns = query.select.map((s, i) => table.columns[idxs[i]].name);
+    rows = rows.map((r) => idxs.map((i) => r[i]));
+  }
+  return { columns, rows, matched, total: table.rows.length };
+}
+
+// src/tables/query.ts
+async function queryTableNode(nestId, ref, q, includeDrafts = false) {
+  const { storage } = await engineCache.get(nestId);
+  const isVisible = (d) => includeDrafts || d.frontmatter.status === "published";
+  let doc;
+  const m = /^\[\[(.+)\]\]$/.exec(ref.trim());
+  if (m) {
+    const wanted = m[1].trim().toLowerCase();
+    const all = await storage.discoverDocuments();
+    doc = all.find(
+      (d) => String(d.frontmatter.title || "").toLowerCase() === wanted && isVisible(d)
+    );
+  } else {
+    try {
+      doc = await storage.readDocument(ref.trim());
+    } catch {
+    }
+    if (doc && !isVisible(doc)) doc = void 0;
+  }
+  if (!doc) throw new NotFoundError(`Table not found: ${ref}`);
+  if (doc.frontmatter.type !== "table") {
+    throw new ValidationError(
+      `"${doc.id}" is type "${doc.frontmatter.type || "document"}" \u2014 table-query only reads table nodes`
+    );
+  }
+  const parsed = parseTable(doc.body || "");
+  const result = runQuery(parsed, parseQuery(q));
+  return {
+    table: doc.id,
+    version: doc.frontmatter.version ?? null,
+    columns: result.columns,
+    rows: result.rows,
+    matched: result.matched,
+    returned: result.rows.length,
+    total: result.total
+  };
+}
+
+// src/nodes/prompt-compiler.ts
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "and",
+  "or",
+  "but",
+  "if",
+  "then",
+  "else",
+  "so",
+  "as",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "have",
+  "has",
+  "had",
+  "do",
   "does",
   "did",
   "done",
@@ -3872,6 +4349,19 @@ queryRoutes.post("/context", async (c) => {
     }
   });
 });
+queryRoutes.post("/table-query", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const ref = typeof body.table === "string" ? body.table.trim() : "";
+  if (!ref) throw new ValidationError("table is required \u2014 [[Title]] or node id");
+  const result = await queryTableNode(
+    nestId,
+    ref,
+    typeof body.query === "string" ? body.query : "",
+    body.include_drafts === true
+  );
+  return c.json(result);
+});
 queryRoutes.post("/query", async (c) => {
   const body = await c.req.json();
   if (!body.query) {
@@ -4075,12 +4565,11 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono9 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 // src/telemetry/trace-log.ts
-var RETENTION_DAYS = 14;
 var PRUNE_EVERY = 500;
 var insertsSincePrune = 0;
 async function logTraceEvent(e) {
@@ -4105,10 +4594,13 @@ async function logTraceEvent(e) {
     );
     if (++insertsSincePrune >= PRUNE_EVERY) {
       insertsSincePrune = 0;
-      const cutoff = new Date(
-        Date.now() - RETENTION_DAYS * 864e5
-      ).toISOString();
-      await db.run("DELETE FROM api_events WHERE ts < ?", [cutoff]);
+      const retentionDays = config.TRACE_RETENTION_DAYS;
+      if (retentionDays > 0) {
+        const cutoff = new Date(
+          Date.now() - retentionDays * 864e5
+        ).toISOString();
+        await db.run("DELETE FROM api_events WHERE ts < ?", [cutoff]);
+      }
     }
   } catch {
   }
@@ -4153,7 +4645,7 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 
 // src/shared/node-id.ts
 function assertSafeNodeId(rawId) {
@@ -4181,18 +4673,6 @@ function assertSafeNodeId(rawId) {
 
 // src/workflow/run-service.ts
 import { v4 as uuid5 } from "uuid";
-
-// src/shared/json.ts
-var safeJson = (s) => {
-  if (!s) return null;
-  try {
-    return JSON.parse(s);
-  } catch {
-    return null;
-  }
-};
-
-// src/workflow/run-service.ts
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -4483,168 +4963,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono9 } from "hono";
-import { v4 as uuid7 } from "uuid";
-
-// src/workflow/edge-type-routes.ts
 import { Hono as Hono8 } from "hono";
 import { v4 as uuid6 } from "uuid";
-var requireWorkflowPlane = async (c, next) => {
-  if (!config.FEATURE_WORKFLOW_PLANE) {
-    return c.json(
-      {
-        error: "The workflow plane is not enabled on this server. An admin can turn it on with FEATURE_WORKFLOW_PLANE=true."
-      },
-      404
-    );
-  }
-  return next();
-};
-async function seedDefaultEdgeTypes(nestId) {
-  const db = getDb();
-  const existing = await db.get(
-    "SELECT COUNT(*) as c FROM edge_types WHERE nest_id = ?",
-    [nestId]
-  );
-  if (existing.c > 0) return;
-  const owner = await db.get(
-    "SELECT u.email FROM nests n JOIN users u ON u.id = n.user_id WHERE n.id = ?",
-    [nestId]
-  );
-  const createdBy = owner?.email ?? "admin@localhost";
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const defaults = [
-    ["next", "Unconditional flow: after the source completes, run the target.", 1, "#16a34a"],
-    ["on-success", "Follow only when the source step succeeded.", 1, "#16a34a"],
-    ["on-failure", "Follow only when the source step failed.", 1, "#ef4444"],
-    ["depends-on", "The source requires the target (ordering/lineage; not conditional flow).", 0, "#3b82f6"],
-    ["owned-by", "Ownership: the target person/team is accountable for the source node.", 0, "#64748b"]
-  ];
-  for (const [name, description, isFlow, color] of defaults) {
-    await db.run(
-      `INSERT INTO edge_types
-         (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
-       VALUES (?, ?, ?, ?, 'directed', ?, NULL, ?, ?, ?, ?)
-       ON CONFLICT DO NOTHING`,
-      [uuid6(), nestId, name, description, isFlow, color, createdBy, now, now]
-    );
-  }
-}
-function parseConditionSchema(raw) {
-  if (raw === void 0 || raw === null || raw === "") return null;
-  const obj = typeof raw === "string" ? safeJson(raw) : raw;
-  if (!obj || typeof obj !== "object" || !Array.isArray(obj.params) || !obj.params.every((p) => typeof p === "string")) {
-    throw new ValidationError(
-      'condition_schema must be {"params": [string\u2026], "mode_default"?: "structured"|"nl"|"open"}'
-    );
-  }
-  const mode = obj.mode_default;
-  if (mode !== void 0 && !["structured", "nl", "open"].includes(mode)) {
-    throw new ValidationError(
-      "condition_schema.mode_default must be structured | nl | open"
-    );
-  }
-  return JSON.stringify({ params: obj.params, mode_default: mode ?? "structured" });
-}
-var edgeTypeToResponse = (r) => ({
-  ...r,
-  is_flow: !!r.is_flow,
-  condition_schema: r.condition_schema ? safeJson(r.condition_schema) : null
-});
-var edgeTypeRoutes = new Hono8();
-edgeTypeRoutes.get("/", requireWorkflowPlane, async (c) => {
-  const nestId = c.req.param("nestId");
-  await seedDefaultEdgeTypes(nestId);
-  const rows = await getDb().all(
-    "SELECT * FROM edge_types WHERE nest_id = ? ORDER BY LOWER(name)",
-    [nestId]
-  );
-  return c.json({ count: rows.length, edge_types: rows.map(edgeTypeToResponse) });
-});
-edgeTypeRoutes.post("/", requireWorkflowPlane, async (c) => {
-  const nestId = c.req.param("nestId");
-  const body = await c.req.json();
-  if (typeof body.name !== "string" || !body.name.trim()) {
-    throw new ValidationError("name is required");
-  }
-  if (typeof body.description !== "string" || !body.description.trim()) {
-    throw new ValidationError("description (the articulation) is required");
-  }
-  const name = body.name.trim();
-  if (name.length > 100 || !/^[a-z0-9][a-z0-9-]*$/i.test(name)) {
-    throw new ValidationError(
-      "name must be alphanumeric-with-dashes, 100 chars max (e.g. escalates-when)"
-    );
-  }
-  const direction = String(body.direction ?? "directed");
-  if (!["directed", "undirected"].includes(direction)) {
-    throw new ValidationError("direction must be directed | undirected");
-  }
-  const conditionSchema = parseConditionSchema(body.condition_schema);
-  const isFlow = body.is_flow === true ? 1 : 0;
-  let color = null;
-  if (body.color !== void 0 && body.color !== null && body.color !== "") {
-    if (typeof body.color !== "string" || !/^#[0-9a-f]{6}$/i.test(body.color)) {
-      throw new ValidationError("color must be a 6-digit hex, e.g. #16a34a");
-    }
-    color = body.color;
-  }
-  const db = getDb();
-  const definedBy = await resolveCallerEmail(c.get("userId"));
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  await seedDefaultEdgeTypes(nestId);
-  let created = false;
-  await db.transaction(async (tx) => {
-    const existing = await tx.get(
-      "SELECT id FROM edge_types WHERE nest_id = ? AND LOWER(name) = LOWER(?)",
-      [nestId, name]
-    );
-    if (existing) {
-      await tx.run(
-        `UPDATE edge_types SET name = ?, description = ?, direction = ?, is_flow = ?,
-           condition_schema = ?, color = ?, updated_at = ? WHERE id = ?`,
-        [name, body.description.trim(), direction, isFlow, conditionSchema, color, now, existing.id]
-      );
-    } else {
-      created = true;
-      await tx.run(
-        `INSERT INTO edge_types
-           (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid6(), nestId, name, body.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
-      );
-    }
-  });
-  const row = await db.get(
-    "SELECT * FROM edge_types WHERE nest_id = ? AND LOWER(name) = LOWER(?)",
-    [nestId, name]
-  );
-  return c.json({ edge_type: edgeTypeToResponse(row) }, created ? 201 : 200);
-});
-edgeTypeRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
-  const nestId = c.req.param("nestId");
-  const id = c.req.param("id");
-  await getDb().transaction(async (tx) => {
-    const row = await tx.get(
-      "SELECT id FROM edge_types WHERE id = ? AND nest_id = ?",
-      [id, nestId]
-    );
-    if (!row) throw new NotFoundError("Edge type not found");
-    const inUse = await tx.get(
-      "SELECT COUNT(*) as c FROM edges WHERE type_id = ?",
-      [id]
-    );
-    if (inUse.c > 0) {
-      throw new ValidationError(
-        `Edge type is in use by ${inUse.c} edge${inUse.c === 1 ? "" : "s"} \u2014 delete those first.`
-      );
-    }
-    await tx.run("DELETE FROM edge_types WHERE id = ?", [id]);
-  });
-  return c.json({ deleted: true });
-});
-
-// src/workflow/edge-routes.ts
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -4746,7 +5066,7 @@ async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
     }
   }
 }
-var edgeRoutes = new Hono9();
+var edgeRoutes = new Hono8();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -4814,7 +5134,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid7();
+  const id = uuid6();
   await db.transaction(async (tx) => {
     if (type.is_flow) {
       await assertNoFlowCycle(tx, nestId, fromNode, toNode);
@@ -4829,6 +5149,54 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   const row = await db.get("SELECT * FROM edges WHERE id = ?", [id]);
   return c.json({ edge: toResponse(row, type) }, 201);
 });
+edgeRoutes.patch("/:id", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const body = await c.req.json();
+  const db = getDb();
+  const row = await db.get(
+    "SELECT * FROM edges WHERE id = ? AND nest_id = ?",
+    [id, nestId]
+  );
+  if (!row) throw new NotFoundError("Edge not found");
+  let type = await db.get(
+    "SELECT * FROM edge_types WHERE id = ?",
+    [row.type_id]
+  );
+  if (typeof body.type === "string" && body.type.trim()) {
+    const next = await db.get(
+      "SELECT * FROM edge_types WHERE nest_id = ? AND (id = ? OR LOWER(name) = LOWER(?))",
+      [nestId, body.type.trim(), body.type.trim()]
+    );
+    if (!next) {
+      throw new ValidationError(
+        `unknown edge type "${body.type}" \u2014 define it in the registry first`
+      );
+    }
+    if (next.is_flow && !type.is_flow) {
+      await assertNoFlowCycle(db, nestId, row.from_node, row.to_node);
+    }
+    type = next;
+  }
+  let mode = row.condition_mode;
+  let stored = row.condition;
+  if (body.condition_mode !== void 0 || body.condition !== void 0) {
+    const v = await validateCondition(
+      nestId,
+      body.condition_mode ?? row.condition_mode,
+      body.condition !== void 0 ? body.condition : row.condition
+    );
+    mode = v.mode;
+    stored = v.stored;
+  }
+  await db.run(
+    `UPDATE edges SET type_id = ?, condition_mode = ?, condition = ?, updated_at = ?
+      WHERE id = ?`,
+    [type.id, mode, stored, (/* @__PURE__ */ new Date()).toISOString(), id]
+  );
+  const updated = await db.get("SELECT * FROM edges WHERE id = ?", [id]);
+  return c.json({ edge: toResponse(updated, type) });
+});
 edgeRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const id = c.req.param("id");
@@ -5158,7 +5526,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid8();
+  const id = uuid7();
   await db.transaction(async (tx) => {
     if (type.is_flow) {
       await assertNoFlowCycle(tx, ctx.nestId, fromNode, toNode);
@@ -5221,7 +5589,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid8(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid7(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -5297,6 +5665,24 @@ var TOOL_DEFINITIONS = [
       required: ["query"]
     }
   },
+  {
+    name: "context_table_query",
+    description: "Deterministic lookup against a TABLE node (CSV fact store). Fetch exact rows instead of reading the whole table: where <col> <op> <value> [and \u2026] [select cols] [limit N]. Ops: = != > >= < <= contains. Same query + same version = same rows, always.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        table: {
+          type: "string",
+          description: 'The table node \u2014 "[[Title]]" or a node id like nodes/price-list'
+        },
+        query: {
+          type: "string",
+          description: 'e.g. where region = "EU" and price > 100 select sku, price limit 5. Empty = all rows.'
+        }
+      },
+      required: ["table"]
+    }
+  },
   {
     name: "context_get",
     description: "Get the FULL content of a specific node by title or ID.",
@@ -5566,6 +5952,9 @@ var TOOL_DEFINITIONS = [
   }
 ];
 async function resolveLlmBody(ctx, node) {
+  if (!await canReadNode(ctx.nestId, node.id, ctx.userId, ctx.userEmail)) {
+    return null;
+  }
   if (!await isStewardshipEnabled(ctx.nestId)) return node.body || "";
   const approved = await getApprovedVersion(ctx.nestId, node.id);
   if (approved == null) return null;
@@ -5659,6 +6048,20 @@ ${nodeList}`;
       return `Found ${matches.length} node(s) matching "${args.query}":
 
 ${results}`;
+    }
+    case "context_table_query": {
+      const result = await queryTableNode(
+        nestId,
+        String(args.table ?? ""),
+        String(args.query ?? ""),
+        false
+      );
+      const lines = [
+        result.columns.join(","),
+        ...result.rows.map((r) => r.join(","))
+      ];
+      return `${result.returned} of ${result.matched} matching rows (table ${result.table} v${result.version}, ${result.total} total):
+${lines.join("\n")}`;
     }
     case "context_query": {
       const result = await queryEngine.query(args.query, {
@@ -6063,19 +6466,19 @@ ${list}`;
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-MDLRPMZR.js");
-        const db = (await import("./client-GI74NPIW.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-6H4WUA2F.js");
+        const db = (await import("./client-VZLX4THW.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
           const { hashPassword: hashPassword2 } = await import("./keys-73STFJJB.js");
-          const { v4: uuid12 } = await import("uuid");
-          const id = uuid12();
+          const { v4: uuid15 } = await import("uuid");
+          const id = uuid15();
           await db.run(
             "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid12())]
+            [id, e, null, await hashPassword2(uuid15())]
           );
           row = { id };
         }
@@ -6130,7 +6533,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono10();
+var mcpRoutes = new Hono9();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -6196,87 +6599,851 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono11 } from "hono";
-var runTriggerRoutes = new Hono11();
-runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
-  const nestId = c.req.param("nestId");
-  const agentNode = assertSafeNodeId(c.req.param("agentNode"));
-  const body = await c.req.json().catch(() => ({}));
-  const { storage } = await engineCache.get(nestId);
-  const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const bundle = await triggerRun({
-    nestId,
-    agentNode,
-    inputs: body.inputs,
-    triggeredBy,
-    storage,
-    parentRunId: body.parent_run_id
-  });
-  return c.json(bundle, 201);
-});
-var runListRoutes = new Hono11();
-runListRoutes.get("/", requireWorkflowPlane, async (c) => {
-  const nestId = c.req.param("nestId");
-  const canSeeDetail = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
-  const result = await listRuns(nestId, {
-    agent: c.req.query("agent") || void 0,
-    status: c.req.query("status") || void 0,
-    limit: Number(c.req.query("limit")) || void 0,
-    canSeeDetail
-  });
-  return c.json(result);
-});
-var runDetailRoutes = new Hono11();
-async function loadRunWithPermission(c, runId, required) {
-  const run = await loadRun(runId);
-  if (!run) throw new NotFoundError("Run not found");
+import { Hono as Hono10 } from "hono";
+import { v4 as uuid8 } from "uuid";
+var RUNNABLE_TYPES2 = ["agent", "skill"];
+var safeJson2 = (s) => {
+  if (!s) return null;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+};
+async function flowSubgraph2(nestId, agentNode) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT e.id, e.from_node, e.to_node, e.condition_mode, e.condition, e.metadata,
+            t.name as type_name, t.color as type_color
+       FROM edges e JOIN edge_types t ON t.id = e.type_id
+      WHERE e.nest_id = ? AND t.is_flow = 1`,
+    [nestId]
+  );
+  const byFrom = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    if (!byFrom.has(r.from_node)) byFrom.set(r.from_node, []);
+    byFrom.get(r.from_node).push(r);
+  }
+  const seen = /* @__PURE__ */ new Set([agentNode]);
+  const queue = [agentNode];
+  const edges = [];
+  while (queue.length) {
+    const cur = queue.shift();
+    for (const e of byFrom.get(cur) ?? []) {
+      edges.push(e);
+      if (!seen.has(e.to_node)) {
+        seen.add(e.to_node);
+        queue.push(e.to_node);
+      }
+    }
+  }
+  return edges.map((e) => ({
+    id: e.id,
+    from_node: e.from_node,
+    to_node: e.to_node,
+    type: { name: e.type_name, color: e.type_color },
+    condition_mode: e.condition_mode,
+    condition: e.condition_mode === "structured" ? safeJson2(e.condition) : e.condition,
+    metadata: safeJson2(e.metadata)
+  }));
+}
+async function referencedDefinitions2(nestId, edges) {
+  const terms = /* @__PURE__ */ new Set();
+  for (const e of edges) {
+    if (e.condition_mode === "structured" && e.condition && typeof e.condition === "object") {
+      const t = e.condition.term;
+      if (typeof t === "string" && t.trim()) terms.add(t.trim());
+    }
+  }
+  if (!terms.size) return [];
+  const out = [];
+  try {
+    const db = getDb();
+    for (const term of terms) {
+      const row = await db.get(
+        "SELECT term, definition, linked_tag FROM definitions WHERE nest_id = ? AND LOWER(term) = LOWER(?)",
+        [nestId, term]
+      );
+      if (row) out.push(row);
+    }
+  } catch {
+  }
+  return out;
+}
+async function buildRunBundle(nestId, agentNode) {
+  const { storage } = await engineCache.get(nestId);
+  let doc;
+  try {
+    doc = await storage.readDocument(agentNode);
+  } catch {
+    throw new NotFoundError(`Agent node not found: ${agentNode}`);
+  }
+  const nodeType = doc.frontmatter.type || "document";
+  if (!RUNNABLE_TYPES2.includes(nodeType)) {
+    throw new ValidationError(
+      `"${agentNode}" is type "${nodeType}" \u2014 only agent/skill nodes are runnable`
+    );
+  }
+  const edges = await flowSubgraph2(nestId, agentNode);
+  const definitions = await referencedDefinitions2(nestId, edges);
+  const reachable = /* @__PURE__ */ new Set([agentNode]);
+  for (const e of edges) {
+    reachable.add(e.from_node);
+    reachable.add(e.to_node);
+  }
+  const node_types = {};
+  const tools = {};
+  for (const nid of reachable) {
+    try {
+      const d = await storage.readDocument(nid);
+      const t = d.frontmatter.type || "document";
+      node_types[nid] = t;
+      if (t === "tool") tools[nid] = d.body || "";
+    } catch {
+    }
+  }
+  const env = await envValues(nestId);
+  return {
+    agent: {
+      id: agentNode,
+      title: String(doc.frontmatter.title ?? agentNode),
+      type: nodeType,
+      schedule: doc.frontmatter.metadata?.schedule ?? null,
+      content: doc.body || ""
+    },
+    edges,
+    node_types,
+    tools,
+    env,
+    definitions
+  };
+}
+var runTriggerRoutes = new Hono10();
+async function resolveParentRun2(nestId, parentRunId, childAgent) {
+  if (!config.FEATURE_SUBAGENT_RUNS) {
+    throw new ValidationError(
+      "Sub-agent runs are not enabled on this server (FEATURE_SUBAGENT_RUNS)."
+    );
+  }
+  const db = getDb();
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = parentRunId;
+  let parentDepth = -1;
+  for (let i = 0; i <= config.SUBAGENT_MAX_DEPTH + 1; i++) {
+    if (!cursor) break;
+    const row = await db.get(
+      "SELECT id, nest_id, agent_node, status, depth, parent_run_id FROM runs WHERE id = ?",
+      [cursor]
+    );
+    if (!row) throw new NotFoundError(`Parent run not found: ${cursor}`);
+    if (row.nest_id !== nestId) {
+      throw new NotFoundError(`Parent run not found: ${cursor}`);
+    }
+    if (cursor === parentRunId && row.status !== "running") {
+      throw new ConflictError(
+        `Parent run is ${row.status} \u2014 cannot spawn a sub-agent under a closed run`
+      );
+    }
+    if (row.agent_node === childAgent || seen.has(childAgent)) {
+      throw new ConflictError(
+        `re-entrancy: "${childAgent}" is already running in this call chain \u2014 sub-agent recursion must be acyclic`
+      );
+    }
+    seen.add(row.agent_node);
+    if (cursor === parentRunId) parentDepth = row.depth;
+    cursor = row.parent_run_id;
+  }
+  const depth = parentDepth + 1;
+  if (depth > config.SUBAGENT_MAX_DEPTH) {
+    throw new ForbiddenError(
+      `sub-agent depth ${depth} exceeds the limit of ${config.SUBAGENT_MAX_DEPTH}`
+    );
+  }
+  const kids = await db.get(
+    "SELECT COUNT(*) as c FROM runs WHERE parent_run_id = ?",
+    [parentRunId]
+  );
+  if (kids.c >= config.SUBAGENT_MAX_CHILDREN) {
+    throw new ForbiddenError(
+      `parent run already has ${kids.c} children (limit ${config.SUBAGENT_MAX_CHILDREN})`
+    );
+  }
+  return { depth };
+}
+runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const agentNode = assertSafeNodeId(c.req.param("agentNode"));
+  const body = await c.req.json().catch(() => ({}));
+  let parentRunId = null;
+  let depth = 0;
+  if (body.parent_run_id !== void 0 && body.parent_run_id !== null) {
+    if (typeof body.parent_run_id !== "string") {
+      throw new ValidationError("parent_run_id must be a string");
+    }
+    ({ depth } = await resolveParentRun2(nestId, body.parent_run_id, agentNode));
+    parentRunId = body.parent_run_id;
+  }
+  if (parentRunId === null) {
+    const { n } = await getDb().get(
+      `SELECT COUNT(*) AS n FROM runs
+        WHERE nest_id = ? AND parent_run_id IS NULL AND status = 'running'`,
+      [nestId]
+    );
+    if (n >= config.RUN_MAX_CONCURRENT_ROOTS) {
+      throw new ConflictError(
+        `too many concurrent runs: ${n} already running (cap ${config.RUN_MAX_CONCURRENT_ROOTS}). Let some finish, or raise RUN_MAX_CONCURRENT_ROOTS.`
+      );
+    }
+  }
+  const bundle = await buildRunBundle(nestId, agentNode);
+  const triggeredBy = await resolveCallerEmail(c.get("userId"));
+  const id = `run_${uuid8()}`;
+  await getDb().run(
+    `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
+     VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
+    [
+      id,
+      nestId,
+      agentNode,
+      triggeredBy,
+      body.inputs === void 0 ? null : JSON.stringify(body.inputs),
+      (/* @__PURE__ */ new Date()).toISOString(),
+      parentRunId,
+      depth
+    ]
+  );
+  return c.json(
+    {
+      run_id: id,
+      parent_run_id: parentRunId,
+      depth,
+      ...bundle,
+      trace_hint: {
+        retrieval: "POST /context is deterministic \u2014 record selector+hops per read so the run replays to the identical read-set",
+        steps: "POST /runs/{run_id}/steps per action; PATCH /runs/{run_id} to close"
+      }
+    },
+    201
+  );
+});
+var runListRoutes = new Hono10();
+runListRoutes.get("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const db = getDb();
+  let sql = "SELECT * FROM runs WHERE nest_id = ?";
+  const args = [nestId];
+  const agent = c.req.query("agent");
+  const status = c.req.query("status");
+  if (agent) {
+    sql += " AND agent_node = ?";
+    args.push(agent);
+  }
+  if (status) {
+    sql += " AND status = ?";
+    args.push(status);
+  }
+  if (c.req.query("unclaimed") === "true") {
+    sql += " AND status = 'running' AND claimed_by IS NULL";
+  }
+  sql += " ORDER BY started_at DESC LIMIT ?";
+  args.push(Math.min(Math.max(Number(c.req.query("limit")) || 50, 1), 500));
+  const rows = await db.all(sql, args);
+  const canSeeDetail = permissionLevel(c.get("nestPermission")) >= permissionLevel("write");
+  return c.json({
+    count: rows.length,
+    runs: rows.map((r) => ({
+      ...r,
+      inputs: canSeeDetail ? safeJson2(r.inputs) : null,
+      trace: canSeeDetail ? safeJson2(r.trace) : null
+    }))
+  });
+});
+var runDetailRoutes = new Hono10();
+async function loadRunWithPermission(c, runId, required) {
+  const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
+    runId
+  ]);
+  if (!run) throw new NotFoundError("Run not found");
   const nestScope = c.get("nestScope");
   if (nestScope && nestScope !== run.nest_id) {
     throw new ForbiddenError("API key not authorized for this nest");
   }
   if (required === "write") {
     if (isSuspended()) {
-      throw new AppError(503, `Server suspended by PromptOwl: ${getSuspensionReason()}`);
+      throw new ForbiddenError(
+        `Server suspended by PromptOwl: ${getSuspensionReason()}`
+      );
     }
     if (!getCurrentLicense()?.valid) {
-      throw new AppError(503, "A valid PromptOwl license is required to write runs.");
+      throw new ForbiddenError(
+        "A valid PromptOwl license is required to write runs."
+      );
     }
   }
   const perm = config.AUTH_MODE === "open" ? "owner" : await resolveNestPermission(run.nest_id, c.get("userId"));
-  if (perm === "none") {
-    throw new NotFoundError("Run not found");
-  }
   if (permissionLevel(perm) < permissionLevel(required)) {
-    throw new ForbiddenError(
-      `This run belongs to a nest where you lack ${required} access.`
-    );
+    throw new NotFoundError("Run not found");
   }
   c.set("runPermission", perm);
   return run;
 }
 runDetailRoutes.post("/:id/steps", requireWorkflowPlane, async (c) => {
   const run = await loadRunWithPermission(c, c.req.param("id"), "write");
+  if (run.status !== "running") {
+    throw new ConflictError(`Run is ${run.status} \u2014 steps can't be appended`);
+  }
   const body = await c.req.json();
-  const { seq } = await appendRunStep(run.id, body);
+  if (typeof body.action !== "string" || !body.action.trim()) {
+    throw new ValidationError("action is required (read|write|branch|notify|external)");
+  }
+  const action = body.action.trim();
+  const nodeId = typeof body.node_id === "string" ? body.node_id : null;
+  const edgeId = typeof body.edge_id === "string" ? body.edge_id : null;
+  const detail = body.detail === void 0 ? null : JSON.stringify(body.detail);
+  const stepCount = await getDb().get(
+    "SELECT COUNT(*) as c FROM run_steps WHERE run_id = ?",
+    [run.id]
+  );
+  if (stepCount.c >= config.RUN_MAX_STEPS) {
+    throw new ConflictError(
+      `run has reached the step limit (${config.RUN_MAX_STEPS})`
+    );
+  }
+  const db = getDb();
+  let seq = 0;
+  await db.transaction(async (tx) => {
+    const last = await tx.get(
+      "SELECT MAX(seq) as m FROM run_steps WHERE run_id = ?",
+      [run.id]
+    );
+    seq = (last.m ?? 0) + 1;
+    await tx.run(
+      `INSERT INTO run_steps (run_id, seq, node_id, edge_id, action, detail, at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [run.id, seq, nodeId, edgeId, action, detail, (/* @__PURE__ */ new Date()).toISOString()]
+    );
+  });
   return c.json({ ok: true, seq }, 201);
 });
 runDetailRoutes.patch("/:id", requireWorkflowPlane, async (c) => {
   const run = await loadRunWithPermission(c, c.req.param("id"), "write");
+  if (run.status !== "running") {
+    throw new ConflictError(`Run already terminal (${run.status})`);
+  }
   const body = await c.req.json();
-  const { status } = await closeRun(run.id, body);
+  const status = body.status;
+  if (typeof status !== "string" || !["running", "succeeded", "failed", "cancelled"].includes(status)) {
+    throw new ValidationError("status must be running | succeeded | failed | cancelled");
+  }
+  const terminal = status !== "running";
+  await getDb().run(
+    `UPDATE runs SET status = ?, trace = COALESCE(?, trace), finished_at = ? WHERE id = ?`,
+    [
+      status,
+      body.trace === void 0 ? null : JSON.stringify(body.trace),
+      terminal ? (/* @__PURE__ */ new Date()).toISOString() : null,
+      run.id
+    ]
+  );
+  if (status === "failed") {
+    const err = body.trace && typeof body.trace === "object" ? String(body.trace.error ?? "").slice(0, 200) : "";
+    void dispatchEvent({
+      kind: "run_failed",
+      nestId: run.nest_id,
+      subjectId: run.id,
+      actor: run.triggered_by,
+      message: `Run of *${run.agent_node}* failed${err ? ` \u2014 ${err}` : ""}`
+    });
+  }
   return c.json({ ok: true, status });
 });
+runDetailRoutes.get("/:id/bundle", requireWorkflowPlane, async (c) => {
+  const run = await loadRunWithPermission(c, c.req.param("id"), "write");
+  if (run.status !== "running") {
+    throw new ConflictError(`Run is ${run.status} \u2014 nothing to execute`);
+  }
+  const claimer = await resolveCallerEmail(c.get("userId"));
+  const res = await getDb().run(
+    `UPDATE runs SET claimed_by = ?, claimed_at = ?
+      WHERE id = ? AND claimed_by IS NULL`,
+    [claimer, (/* @__PURE__ */ new Date()).toISOString(), run.id]
+  );
+  if (!res.changes) {
+    throw new ConflictError("Run already claimed by another runner");
+  }
+  const bundle = await buildRunBundle(run.nest_id, run.agent_node);
+  return c.json({
+    run_id: run.id,
+    parent_run_id: run.parent_run_id,
+    depth: run.depth,
+    inputs: safeJson2(run.inputs),
+    ...bundle
+  });
+});
 runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
   const run = await loadRunWithPermission(c, c.req.param("id"), "read");
   const canSeeDetail = permissionLevel(c.get("runPermission")) >= permissionLevel("write");
-  const result = await getRunTrace(run, { canSeeDetail });
-  return c.json(result);
+  const steps = await getDb().all(
+    "SELECT seq, node_id, edge_id, action, detail, at FROM run_steps WHERE run_id = ? ORDER BY seq",
+    [run.id]
+  );
+  return c.json({
+    run: {
+      ...run,
+      inputs: canSeeDetail ? safeJson2(run.inputs) : null,
+      trace: canSeeDetail ? safeJson2(run.trace) : null
+    },
+    steps: steps.map((s) => ({
+      ...s,
+      detail: canSeeDetail ? safeJson2(s.detail) : null
+    }))
+  });
 });
 
-// src/definitions/routes.ts
-import { Hono as Hono12 } from "hono";
+// src/workflow/schedule-routes.ts
+import { Hono as Hono11 } from "hono";
 import { v4 as uuid9 } from "uuid";
-var definitionRoutes = new Hono12();
+var RUNNABLE_TYPES3 = ["agent", "skill"];
+var MIN_EVERY = 5;
+var MAX_EVERY = 7 * 24 * 60;
+function toResponse2(s) {
+  const last = s.last_run_at ? Date.parse(s.last_run_at) : NaN;
+  return {
+    id: s.id,
+    agent_node: s.agent_node,
+    every_minutes: s.every_minutes,
+    enabled: !!s.enabled,
+    last_run_at: s.last_run_at,
+    // Derived, not stored: when the loop will next fire this schedule.
+    next_due_at: s.enabled ? Number.isNaN(last) ? (/* @__PURE__ */ new Date()).toISOString() : new Date(last + s.every_minutes * 6e4).toISOString() : null,
+    max_runs: s.max_runs,
+    runs_created: s.runs_created,
+    created_by: s.created_by,
+    created_at: s.created_at
+  };
+}
+function parseMaxRuns(v) {
+  if (v === void 0 || v === null || v === "") return null;
+  const n = Number(v);
+  if (!Number.isInteger(n) || n < 1 || n > 1e4) {
+    throw new ValidationError("max_runs must be a positive integer (or null for no bound)");
+  }
+  return n;
+}
+function parseEvery(v) {
+  const n = Number(v);
+  if (!Number.isInteger(n) || n < MIN_EVERY || n > MAX_EVERY) {
+    throw new ValidationError(
+      `every_minutes must be an integer between ${MIN_EVERY} and ${MAX_EVERY}`
+    );
+  }
+  return n;
+}
+var scheduleRoutes = new Hono11();
+scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const rows = await getDb().all(
+    "SELECT * FROM schedules WHERE nest_id = ? ORDER BY created_at",
+    [nestId]
+  );
+  return c.json({ count: rows.length, schedules: rows.map(toResponse2) });
+});
+scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const agentRaw = typeof body.agent_node === "string" ? body.agent_node.trim() : "";
+  if (!agentRaw) throw new ValidationError("agent_node is required");
+  const agentNode = assertSafeNodeId(agentRaw);
+  const every = parseEvery(body.every_minutes);
+  const maxRuns = parseMaxRuns(body.max_runs);
+  const { storage } = await engineCache.get(nestId);
+  let doc;
+  try {
+    doc = await storage.readDocument(agentNode);
+  } catch {
+    throw new NotFoundError(`Agent node not found: ${agentNode}`);
+  }
+  const nodeType = doc.frontmatter.type || "document";
+  if (!RUNNABLE_TYPES3.includes(nodeType)) {
+    throw new ValidationError(
+      `"${agentNode}" is type "${nodeType}" \u2014 only agent/skill nodes are schedulable`
+    );
+  }
+  const db = getDb();
+  const existing = await db.get(
+    "SELECT id FROM schedules WHERE nest_id = ? AND agent_node = ?",
+    [nestId, agentNode]
+  );
+  if (existing) {
+    throw new ConflictError(
+      "This agent already has a schedule \u2014 edit or delete it instead"
+    );
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = `sch_${uuid9()}`;
+  await db.run(
+    `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
+    [
+      id,
+      nestId,
+      agentNode,
+      every,
+      body.enabled === false ? 0 : 1,
+      maxRuns,
+      await resolveCallerEmail(c.get("userId")),
+      now,
+      now
+    ]
+  );
+  const row = await db.get("SELECT * FROM schedules WHERE id = ?", [id]);
+  return c.json({ schedule: toResponse2(row) }, 201);
+});
+scheduleRoutes.patch("/:id", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const body = await c.req.json();
+  const db = getDb();
+  const row = await db.get(
+    "SELECT * FROM schedules WHERE id = ? AND nest_id = ?",
+    [id, nestId]
+  );
+  if (!row) throw new NotFoundError("Schedule not found");
+  const every = body.every_minutes === void 0 ? row.every_minutes : parseEvery(body.every_minutes);
+  const enabled = body.enabled === void 0 ? row.enabled : body.enabled ? 1 : 0;
+  const maxRuns = body.max_runs === void 0 ? row.max_runs : parseMaxRuns(body.max_runs);
+  const runsCreated = body.max_runs !== void 0 || body.enabled && !row.enabled ? 0 : row.runs_created;
+  await db.run(
+    `UPDATE schedules SET every_minutes = ?, enabled = ?, max_runs = ?, runs_created = ?, updated_at = ?
+      WHERE id = ?`,
+    [every, enabled, maxRuns, runsCreated, (/* @__PURE__ */ new Date()).toISOString(), id]
+  );
+  const updated = await db.get("SELECT * FROM schedules WHERE id = ?", [id]);
+  return c.json({ schedule: toResponse2(updated) });
+});
+scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const db = getDb();
+  const row = await db.get(
+    "SELECT id FROM schedules WHERE id = ? AND nest_id = ?",
+    [id, nestId]
+  );
+  if (!row) throw new NotFoundError("Schedule not found");
+  await db.run("DELETE FROM schedules WHERE id = ?", [id]);
+  return c.json({ deleted: true });
+});
+
+// src/notify/connector-routes.ts
+import { Hono as Hono12 } from "hono";
+import { v4 as uuid10 } from "uuid";
+var KNOWN_EVENTS = [
+  "review_requested",
+  "review_approved",
+  "review_rejected",
+  "run_failed"
+];
+var CHANNELS = ["slack", "teams", "webhook"];
+function toResponse3(r) {
+  let events = [];
+  try {
+    events = JSON.parse(r.events);
+  } catch {
+  }
+  const url = r.url.startsWith("env:") ? r.url : r.url.replace(/^(https:\/\/[^/]+\/).+(.{4})$/, "$1\u2022\u2022\u2022\u2022$2");
+  return {
+    id: r.id,
+    channel: r.channel,
+    url,
+    events,
+    enabled: !!r.enabled,
+    created_by: r.created_by,
+    created_at: r.created_at
+  };
+}
+function parseEvents(v) {
+  if (!Array.isArray(v) || v.length === 0) {
+    throw new ValidationError(
+      `events must be a non-empty array \u2014 any of ${KNOWN_EVENTS.join(", ")}, or ["*"]`
+    );
+  }
+  for (const e of v) {
+    if (e !== "*" && !KNOWN_EVENTS.includes(e)) {
+      throw new ValidationError(`unknown event "${e}"`);
+    }
+  }
+  return JSON.stringify(v);
+}
+function parseUrl(v) {
+  const raw = typeof v === "string" ? v.trim() : "";
+  if (raw.startsWith("env:") && raw.length > 4) return raw;
+  if (isSafeConnectorUrl(raw)) return raw;
+  throw new ValidationError(
+    'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
+  );
+}
+var connectorRoutes = new Hono12();
+connectorRoutes.get("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const rows = await getDb().all(
+    "SELECT * FROM connectors WHERE nest_id = ? ORDER BY created_at",
+    [nestId]
+  );
+  return c.json({ count: rows.length, connectors: rows.map(toResponse3) });
+});
+connectorRoutes.post("/", async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const channel = String(body.channel ?? "");
+  if (!CHANNELS.includes(channel)) {
+    throw new ValidationError(`channel must be ${CHANNELS.join(" | ")}`);
+  }
+  const url = parseUrl(body.url);
+  const events = parseEvents(body.events);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = `con_${uuid10()}`;
+  await getDb().run(
+    `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
+    [id, nestId, channel, url, events, await resolveCallerEmail(c.get("userId")), now, now]
+  );
+  const row = await getDb().get("SELECT * FROM connectors WHERE id = ?", [id]);
+  return c.json({ connector: toResponse3(row) }, 201);
+});
+connectorRoutes.patch("/:id", async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const db = getDb();
+  const row = await db.get(
+    "SELECT * FROM connectors WHERE id = ? AND nest_id = ?",
+    [id, nestId]
+  );
+  if (!row) throw new NotFoundError("Connector not found");
+  const body = await c.req.json();
+  const enabled = body.enabled === void 0 ? row.enabled : body.enabled ? 1 : 0;
+  const events = body.events === void 0 ? row.events : parseEvents(body.events);
+  const url = body.url === void 0 ? row.url : parseUrl(body.url);
+  await db.run(
+    "UPDATE connectors SET enabled = ?, events = ?, url = ?, updated_at = ? WHERE id = ?",
+    [enabled, events, url, (/* @__PURE__ */ new Date()).toISOString(), id]
+  );
+  const updated = await db.get("SELECT * FROM connectors WHERE id = ?", [id]);
+  return c.json({ connector: toResponse3(updated) });
+});
+connectorRoutes.delete("/:id", async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const db = getDb();
+  const row = await db.get(
+    "SELECT id FROM connectors WHERE id = ? AND nest_id = ?",
+    [id, nestId]
+  );
+  if (!row) throw new NotFoundError("Connector not found");
+  await db.run("DELETE FROM connectors WHERE id = ?", [id]);
+  return c.json({ deleted: true });
+});
+
+// src/workflow/hook-routes.ts
+import { Hono as Hono13 } from "hono";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
+var PRESETS = ["slack", "teams", "webhook"];
+var RUNNABLE_TYPES4 = ["agent", "skill"];
+function hookUrl(c, id) {
+  const base = config.PUBLIC_BASE_URL || new URL(c.req.url).origin;
+  return `${base}/hooks/${id}`;
+}
+function toResponse4(c, r, opts = {}) {
+  return {
+    // The id doubles as the capability token, so the LIST view masks it —
+    // the full URL is shown exactly once, at creation (API-key semantics).
+    id: opts.reveal ? r.id : `${r.id.slice(0, 7)}\u2026${r.id.slice(-4)}`,
+    url: opts.reveal ? hookUrl(c, r.id) : null,
+    agent_node: r.agent_node,
+    preset: r.preset,
+    enabled: !!r.enabled,
+    fire_count: r.fire_count,
+    last_fired_at: r.last_fired_at,
+    created_by: r.created_by,
+    created_at: r.created_at
+  };
+}
+var hookNestRoutes = new Hono13();
+hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const agent = c.req.query("agent");
+  const rows = await getDb().all(
+    `SELECT * FROM trigger_hooks WHERE nest_id = ?${agent ? " AND agent_node = ?" : ""} ORDER BY created_at`,
+    agent ? [nestId, agent] : [nestId]
+  );
+  return c.json({ count: rows.length, hooks: rows.map((r) => toResponse4(c, r)) });
+});
+hookNestRoutes.post("/", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const body = await c.req.json();
+  const agentRaw = typeof body.agent_node === "string" ? body.agent_node.trim() : "";
+  if (!agentRaw) throw new ValidationError("agent_node is required");
+  const agentNode = assertSafeNodeId(agentRaw);
+  const preset = String(body.preset ?? "webhook");
+  if (!PRESETS.includes(preset)) {
+    throw new ValidationError(`preset must be ${PRESETS.join(" | ")}`);
+  }
+  const { storage } = await engineCache.get(nestId);
+  let doc;
+  try {
+    doc = await storage.readDocument(agentNode);
+  } catch {
+    throw new NotFoundError(`Agent node not found: ${agentNode}`);
+  }
+  const t = doc.frontmatter.type || "document";
+  if (!RUNNABLE_TYPES4.includes(t)) {
+    throw new ValidationError(`"${agentNode}" is type "${t}" \u2014 only agent/skill nodes are triggerable`);
+  }
+  const id = `hk_${randomUUID().replace(/-/g, "")}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await getDb().run(
+    `INSERT INTO trigger_hooks (id, nest_id, agent_node, preset, enabled, fire_count, last_fired_at, created_by, created_at)
+     VALUES (?, ?, ?, ?, 1, 0, NULL, ?, ?)`,
+    [id, nestId, agentNode, preset, await resolveCallerEmail(c.get("userId")), now]
+  );
+  const row = await getDb().get("SELECT * FROM trigger_hooks WHERE id = ?", [id]);
+  return c.json({ hook: toResponse4(c, row, { reveal: true }) }, 201);
+});
+hookNestRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
+  const nestId = c.req.param("nestId");
+  const id = c.req.param("id");
+  const db = getDb();
+  const masked = id.match(/^(.{7})…(.{4})$/);
+  const row = await db.get(
+    masked ? "SELECT id FROM trigger_hooks WHERE nest_id = ? AND id LIKE ? AND id LIKE ?" : "SELECT id FROM trigger_hooks WHERE nest_id = ? AND id = ?",
+    masked ? [nestId, `${masked[1]}%`, `%${masked[2]}`] : [nestId, id]
+  );
+  if (!row) throw new NotFoundError("Hook not found");
+  await db.run("DELETE FROM trigger_hooks WHERE id = ?", [row.id]);
+  return c.json({ deleted: true });
+});
+function safeEqual(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ab.length === bb.length && timingSafeEqual2(ab, bb);
+}
+function slackSignatureValid(secret, ts, sig, rawBody) {
+  if (!ts || !sig) return false;
+  const age = Math.abs(Date.now() / 1e3 - Number(ts));
+  if (!Number.isFinite(age) || age > 300) return false;
+  const mine = `v0=${createHmac2("sha256", secret).update(`v0:${ts}:${rawBody}`).digest("hex")}`;
+  return safeEqual(mine, sig);
+}
+function teamsSignatureValid(secret, authHeader, rawBody) {
+  if (!authHeader?.startsWith("HMAC ")) return false;
+  const mine = createHmac2("sha256", Buffer.from(secret, "base64")).update(rawBody, "utf8").digest("base64");
+  return safeEqual(mine, authHeader.slice(5).trim());
+}
+function stripMentions(text) {
+  return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
+}
+var hookFireRoutes = new Hono13();
+hookFireRoutes.post("/:token", async (c) => {
+  const token = c.req.param("token");
+  if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
+    return c.json({ error: "rate limited" }, 429);
+  }
+  const db = getDb();
+  const hook = await db.get(
+    "SELECT * FROM trigger_hooks WHERE id = ? AND enabled = 1",
+    [token]
+  );
+  if (!hook) throw new NotFoundError("Not found");
+  if (!tryConsume(`hook:${hook.id}`, { max: 30, windowMs: 6e4 })) {
+    return c.json({ error: "rate limited" }, 429);
+  }
+  const raw = await c.req.text();
+  const ct = c.req.header("content-type") || "";
+  let payload = {};
+  if (ct.includes("form")) {
+    payload = Object.fromEntries(new URLSearchParams(raw));
+  } else if (raw) {
+    try {
+      payload = JSON.parse(raw);
+    } catch {
+    }
+  }
+  const env = await envValues(hook.nest_id);
+  let inputs = null;
+  let ack;
+  if (hook.preset === "slack") {
+    if (payload.type === "url_verification") {
+      return c.json({ challenge: payload.challenge });
+    }
+    const secret = env.SLACK_SIGNING_SECRET;
+    if (secret) {
+      const ok = slackSignatureValid(
+        secret,
+        c.req.header("x-slack-request-timestamp"),
+        c.req.header("x-slack-signature"),
+        raw
+      );
+      if (!ok) return c.json({ error: "bad signature" }, 401);
+    }
+    if (payload.type === "event_callback") {
+      const ev = payload.event ?? {};
+      if (ev.type !== "app_mention") return c.json({ ok: true });
+      inputs = { input: stripMentions(String(ev.text ?? "")), from: ev.user, channel: ev.channel };
+      ack = () => c.json({ ok: true });
+    } else {
+      inputs = {
+        input: String(payload.text ?? "").trim(),
+        from: payload.user_name,
+        channel: payload.channel_name
+      };
+      ack = (runId2) => c.json({
+        response_type: "ephemeral",
+        text: `\u23F3 Queued *${hook.agent_node}* (run ${runId2.slice(0, 12)}\u2026) \u2014 output lands for review in the nest.`
+      });
+    }
+  } else if (hook.preset === "teams") {
+    const secret = env.TEAMS_WEBHOOK_SECRET;
+    if (secret && !teamsSignatureValid(secret, c.req.header("authorization"), raw)) {
+      return c.json({ error: "bad signature" }, 401);
+    }
+    inputs = { input: stripMentions(String(payload.text ?? "")), from: payload.from?.name };
+    ack = (runId2) => c.json({ type: "message", text: `\u23F3 Queued ${hook.agent_node} (run ${runId2.slice(0, 12)}\u2026)` });
+  } else {
+    inputs = Object.keys(payload).length ? payload : null;
+    ack = (runId2) => c.json({ ok: true, run_id: runId2 }, 201);
+  }
+  const { n } = await db.get(
+    `SELECT COUNT(*) AS n FROM runs
+      WHERE nest_id = ? AND parent_run_id IS NULL AND status = 'running'`,
+    [hook.nest_id]
+  );
+  if (n >= config.RUN_MAX_CONCURRENT_ROOTS) {
+    throw new ConflictError("too many concurrent runs \u2014 try again shortly");
+  }
+  const runId = `run_${randomUUID()}`;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await db.run(
+    `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
+     VALUES (?, ?, ?, ?, 'running', ?, ?, NULL, 0)`,
+    [
+      runId,
+      hook.nest_id,
+      hook.agent_node,
+      `hook:${hook.preset}:${hook.created_by}`,
+      inputs === null ? null : JSON.stringify(inputs),
+      now
+    ]
+  );
+  await db.run(
+    "UPDATE trigger_hooks SET fire_count = fire_count + 1, last_fired_at = ? WHERE id = ?",
+    [now, hook.id]
+  );
+  return ack(runId);
+});
+
+// src/definitions/routes.ts
+import { Hono as Hono14 } from "hono";
+import { v4 as uuid11 } from "uuid";
+var definitionRoutes = new Hono14();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -6355,7 +7522,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid9();
+      targetId = uuid11();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -6384,11 +7551,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono13 } from "hono";
-import { v4 as uuid10 } from "uuid";
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { join as join3 } from "path";
-var assetRoutes = new Hono13();
+import { Hono as Hono15 } from "hono";
+import { v4 as uuid12 } from "uuid";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+var assetRoutes = new Hono15();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -6410,10 +7577,10 @@ assetRoutes.post("/", async (c) => {
       `unsupported image type ".${ext}" \u2014 allowed: ${Object.keys(CONTENT_TYPES).join(", ")}`
     );
   }
-  const name = `${uuid10()}.${ext === "jpeg" ? "jpg" : ext}`;
-  const dir = join3(resolveNestPath(nestId), "assets");
-  await mkdir(dir, { recursive: true });
-  await writeFile(join3(dir, name), Buffer.from(await file.arrayBuffer()));
+  const name = `${uuid12()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const dir = join4(resolveNestPath(nestId), "assets");
+  await mkdir2(dir, { recursive: true });
+  await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
   return c.json(
     {
       file: name,
@@ -6431,7 +7598,7 @@ assetRoutes.get("/:file", async (c) => {
   }
   let bytes;
   try {
-    bytes = await readFile2(join3(resolveNestPath(nestId), "assets", name));
+    bytes = await readFile2(join4(resolveNestPath(nestId), "assets", name));
   } catch {
     throw new NotFoundError("Asset not found");
   }
@@ -6444,7 +7611,7 @@ assetRoutes.get("/:file", async (c) => {
 });
 
 // src/mcp/server-routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono16 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
@@ -6685,7 +7852,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono14();
+var serverMcpRoutes = new Hono16();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -6707,7 +7874,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono14();
+var nestIndexRoutes = new Hono16();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -6829,17 +7996,17 @@ npx -y mcp-remote ${B}/mcp --header "Authorization: Bearer <api-key>"
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono14();
+var llmsTxtRoutes = new Hono16();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono17 } from "hono";
 
 // src/governance/comment-service.ts
-import { v4 as uuid11 } from "uuid";
+import { v4 as uuid13 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -6855,7 +8022,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid11();
+  const id = uuid13();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -7055,7 +8222,7 @@ function rowToComment(row) {
 
 // src/governance/stewards-parser.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function parseStewardsYaml(content) {
   const result = { version: 1 };
   const lines = content.split("\n");
@@ -7121,9 +8288,9 @@ function parseEntry(str) {
 function loadStewardsConfig(nestId) {
   const nestPath = resolveNestPath(nestId);
   const candidates = [
-    join4(nestPath, "stewards.yaml"),
-    join4(nestPath, "stewards.yml"),
-    join4(nestPath, ".context", "stewards.yaml")
+    join5(nestPath, "stewards.yaml"),
+    join5(nestPath, "stewards.yml"),
+    join5(nestPath, ".context", "stewards.yaml")
   ];
   for (const candidatePath of candidates) {
     if (existsSync(candidatePath)) {
@@ -7140,7 +8307,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono15();
+var governanceRoutes = new Hono17();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -7278,7 +8445,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono15();
+var governanceNodeRoutes = new Hono17();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -7336,6 +8503,10 @@ governanceNodeRoutes.get("/:nodeId{.+}/comments", async (c) => {
 governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
+  const annotationReply = nodeId.match(/^(.+)\/annotations\/([^/]+)$/);
+  if (annotationReply) {
+    return handleAnnotationReply(c, annotationReply[1], annotationReply[2]);
+  }
   const body = await c.req.json();
   const author = await getUserEmail4(c);
   try {
@@ -7356,7 +8527,7 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   }
 });
 governanceNodeRoutes.post(
-  "/:nodeId{.+?}/comments/:commentId/resolve",
+  "/:nodeId{.+}/comments/:commentId/resolve",
   async (c) => {
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
@@ -7487,14 +8658,14 @@ governanceNodeRoutes.get("/:nodeId{.+}/can-edit", async (c) => {
   const userEmail = await getUserEmail4(c);
   return c.json(await canUserEdit(nestId, nodeId, userEmail));
 });
-governanceNodeRoutes.get("/:nodeId{.+?}/external-edits", async (c) => {
+governanceNodeRoutes.get("/:nodeId{.+}/external-edits", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
   const pending = await getPendingChange(nestId, nodeId);
   return c.json({ pending });
 });
 governanceNodeRoutes.get(
-  "/:nodeId{.+?}/external-edits/:suggestionId",
+  "/:nodeId{.+}/external-edits/:suggestionId",
   async (c) => {
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
@@ -7511,7 +8682,7 @@ governanceNodeRoutes.get(
   }
 );
 governanceNodeRoutes.post(
-  "/:nodeId{.+?}/external-edits/:suggestionId/approve",
+  "/:nodeId{.+}/external-edits/:suggestionId/approve",
   async (c) => {
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
@@ -7544,7 +8715,7 @@ governanceNodeRoutes.post(
   }
 );
 governanceNodeRoutes.post(
-  "/:nodeId{.+?}/external-edits/:suggestionId/reject",
+  "/:nodeId{.+}/external-edits/:suggestionId/reject",
   async (c) => {
     const nestId = c.req.param("nestId");
     const nodeId = c.req.param("nodeId");
@@ -7613,12 +8784,19 @@ async function ensureAnonymousUser() {
 // src/app.ts
 import { serveStatic } from "@hono/node-server/serve-static";
 import { fileURLToPath } from "url";
-import { dirname, join as join5, relative as relative2 } from "path";
-import { existsSync as existsSync2 } from "fs";
-var HERE = dirname(fileURLToPath(import.meta.url));
+import { dirname as dirname2, join as join6, relative as relative2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+var HERE = dirname2(fileURLToPath(import.meta.url));
+var SERVICE_VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync3(join6(HERE, "..", "package.json"), "utf8")).version;
+  } catch {
+    return "unknown";
+  }
+})();
 var UI_DIR_CANDIDATES = [
-  join5(HERE, "web3"),
-  join5(process.cwd(), "dist", "web3")
+  join6(HERE, "web3"),
+  join6(process.cwd(), "dist", "web3")
 ];
 var UI_DIR_ABS = UI_DIR_CANDIDATES.find((p) => existsSync2(p)) || UI_DIR_CANDIDATES[0];
 var UI_DIR_REL = relative2(process.cwd(), UI_DIR_ABS) || ".";
@@ -7655,7 +8833,7 @@ var flexAuthMiddleware = createMiddleware2(async (c, next) => {
   return c.json({ error: "Missing or invalid credentials" }, 401);
 });
 function createApp() {
-  const app = new Hono16({ router: new LinearRouter() });
+  const app = new Hono18({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -7697,10 +8875,17 @@ function createApp() {
     (c) => c.json({
       status: isSuspended() ? "suspended" : "ok",
       service: "contextnest-community",
-      version: "0.1.0",
+      version: SERVICE_VERSION,
       auth_mode: config.AUTH_MODE,
       logo_url: config.LOGO_URL,
+      // Presence only, never the value: lets the UI stop prompting for a
+      // runner key once the server-wide one exists.
+      runner_key_configured: !!process.env.ANTHROPIC_API_KEY,
       promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
+      // Manual (email/password) sign-in mode (open | invite-only | disabled).
+      // The login page reads this to show/hide the credential form, and to
+      // switch the Register link to an "activate invite" affordance.
+      manual_sign_in: config.MANUAL_SIGN_IN,
       // Public feature flags the SPA needs before auth to decide what to
       // render. Mirrors the server-side route gate so UI and API agree:
       // flag off → the plane's routes 404 AND its UI stays hidden.
@@ -7709,6 +8894,12 @@ function createApp() {
       // must clear a security review — NOT a UI toggle). Exposed read-only so
       // the Runs page shows the "spawn sub-agent" option only when it's live.
       subagent_runs_enabled: config.FEATURE_SUBAGENT_RUNS,
+      // Recursion bounds (env-overridable in config.ts). Exposed so the Runs
+      // page validates a spawn against the SERVER's real caps instead of
+      // duplicating the defaults — an operator raising/lowering these stays
+      // in sync with the picker's grey-outs.
+      subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
+      subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
       ...isSuspended() && { suspended_reason: getSuspensionReason() }
     })
   );
@@ -7779,12 +8970,12 @@ function createApp() {
         tier: info.tier,
         org: info.org,
         limits: info.limits,
-        // The key validated and is live now, but if it couldn't be written to
-        // disk it'll be lost on restart — surface that instead of pretending
+        // The key validated and is live now, but if it couldn't be saved to the
+        // database it'll be lost on restart — surface that instead of pretending
         // the setup is durable (the old behavior silently swallowed this).
         persisted: info.persisted,
         ...info.persisted ? {} : {
-          warning: `License validated, but it could not be saved to disk (${info.persistError || "unknown error"}). It will be LOST on the next restart. Set ENV_FILE_PATH to a writable, persisted path (e.g. under DATA_ROOT) or provide PROMPTOWL_KEY via the container environment.`
+          warning: `License validated, but it could not be saved to the database (${info.persistError || "unknown error"}). It will be LOST on the next restart. Check the database connection, or provide PROMPTOWL_KEY via the container environment.`
         }
       });
     } catch (err) {
@@ -7796,12 +8987,18 @@ function createApp() {
   const adminSettingsAllowed = async (c) => config.AUTH_MODE === "open" || await isLicenseAdminUserId(c.get("userId"));
   const currentServerSettings = () => ({
     promptowl_sign_in_gate: config.PROMPTOWL_SIGN_IN_GATE,
+    manual_sign_in: config.MANUAL_SIGN_IN,
     logo_url: config.LOGO_URL,
     telemetry_enabled: config.TELEMETRY_ENABLED,
     public_base_url: config.PUBLIC_BASE_URL,
     max_body_bytes: config.MAX_BODY_BYTES,
     workflow_plane_enabled: config.FEATURE_WORKFLOW_PLANE,
     subagent_runs_enabled: config.FEATURE_SUBAGENT_RUNS,
+    subagent_max_depth: config.SUBAGENT_MAX_DEPTH,
+    subagent_max_children: config.SUBAGENT_MAX_CHILDREN,
+    trace_retention_days: config.TRACE_RETENTION_DAYS,
+    // Server-wide runner default. NEVER the value — masked tail only.
+    anthropic_api_key_masked: process.env.ANTHROPIC_API_KEY ? `\u2022\u2022\u2022\u2022${process.env.ANTHROPIC_API_KEY.slice(-4)}` : null,
     slack_webhook_url: config.SLACK_WEBHOOK_URL ?? "",
     smtp_url: config.SMTP_URL ?? "",
     notify_email_from: config.NOTIFY_EMAIL_FROM ?? "",
@@ -7821,14 +9018,23 @@ function createApp() {
     } catch {
       return c.json({ error: "Invalid JSON body" }, 400);
     }
-    const errors = [];
+    const fieldErrors = {};
+    const addError = (field, message) => {
+      fieldErrors[field] = message;
+    };
     const pending = [];
     if ("promptowl_sign_in_gate" in body) {
       const v = String(body.promptowl_sign_in_gate ?? "").trim().toLowerCase();
       if (!["open", "admin-only", "disabled"].includes(v))
-        errors.push("promptowl_sign_in_gate must be open | admin-only | disabled");
+        addError("promptowl_sign_in_gate", "PromptOwl sign-in must be set to Everyone, Admins only, or Off.");
       else pending.push({ name: "PROMPTOWL_SIGN_IN_GATE", value: v });
     }
+    if ("manual_sign_in" in body) {
+      const v = String(body.manual_sign_in ?? "").trim().toLowerCase();
+      if (!["open", "invite-only", "disabled"].includes(v))
+        addError("manual_sign_in", "Manual sign-in must be set to Everyone, Invite only, or Off.");
+      else pending.push({ name: "MANUAL_SIGN_IN", value: v });
+    }
     if ("logo_url" in body) {
       const v = String(body.logo_url ?? "").trim();
       pending.push({ name: "LOGO_URL", value: v || null });
@@ -7846,11 +9052,22 @@ function createApp() {
         value: body.workflow_plane_enabled ? "true" : null
       });
     }
+    if ("anthropic_api_key" in body) {
+      const v = body.anthropic_api_key;
+      if (v === null || v === "") {
+        pending.push({ name: "ANTHROPIC_API_KEY", value: null });
+      } else if (typeof v !== "string" || !v.trim().startsWith("sk-")) {
+        addError("anthropic_api_key", 'Anthropic API key must start with "sk-" (or be empty to clear it).');
+      } else {
+        pending.push({ name: "ANTHROPIC_API_KEY", value: v.trim() });
+      }
+    }
     if ("subagent_runs_enabled" in body) {
       const planeOn = "workflow_plane_enabled" in body ? !!body.workflow_plane_enabled : config.FEATURE_WORKFLOW_PLANE;
       if (body.subagent_runs_enabled && !planeOn) {
-        errors.push(
-          "subagent_runs_enabled requires workflow_plane_enabled to be on"
+        addError(
+          "subagent_runs_enabled",
+          "Sub-agent runs require the Workflow plane to be turned on."
         );
       } else {
         pending.push({
@@ -7859,41 +9076,103 @@ function createApp() {
         });
       }
     }
+    if ("subagent_max_depth" in body) {
+      const v = body.subagent_max_depth;
+      if (v === null || v === "") {
+        pending.push({ name: "SUBAGENT_MAX_DEPTH", value: null });
+      } else {
+        const n = Number(v);
+        if (!Number.isInteger(n) || n < 1 || n > 32)
+          addError("subagent_max_depth", "Max sub-agent depth must be a whole number between 1 and 32.");
+        else pending.push({ name: "SUBAGENT_MAX_DEPTH", value: String(n) });
+      }
+    }
+    if ("subagent_max_children" in body) {
+      const v = body.subagent_max_children;
+      if (v === null || v === "") {
+        pending.push({ name: "SUBAGENT_MAX_CHILDREN", value: null });
+      } else {
+        const n = Number(v);
+        if (!Number.isInteger(n) || n < 1 || n > 128)
+          addError("subagent_max_children", "Max sub-agents per run must be a whole number between 1 and 128.");
+        else pending.push({ name: "SUBAGENT_MAX_CHILDREN", value: String(n) });
+      }
+    }
+    if ("trace_retention_days" in body) {
+      const v = body.trace_retention_days;
+      if (v === null || v === "") {
+        pending.push({ name: "TRACE_RETENTION_DAYS", value: null });
+      } else {
+        const n = Number(v);
+        if (!Number.isInteger(n) || n < 0 || n > 3650)
+          addError("trace_retention_days", "Trace retention must be a whole number of days between 0 and 3650 (0 keeps activity forever).");
+        else pending.push({ name: "TRACE_RETENTION_DAYS", value: String(n) });
+      }
+    }
     if ("slack_webhook_url" in body) {
       const v = String(body.slack_webhook_url ?? "").trim();
       if (v && !/^https:\/\//i.test(v))
-        errors.push("slack_webhook_url must be an https:// URL (or empty to disable)");
+        addError("slack_webhook_url", "Slack webhook must be an https:// URL (or leave it empty to turn Slack notifications off).");
       else pending.push({ name: "SLACK_WEBHOOK_URL", value: v || null });
     }
     if ("smtp_url" in body) {
       const v = String(body.smtp_url ?? "").trim();
       if (v && !/^smtps?:\/\//i.test(v))
-        errors.push("smtp_url must be an smtp:// or smtps:// URL (or empty to disable)");
+        addError("smtp_url", "SMTP connection URL must start with smtp:// or smtps:// (or leave it empty to turn email notifications off).");
       else pending.push({ name: "SMTP_URL", value: v || null });
     }
     if ("notify_email_from" in body) {
       const v = String(body.notify_email_from ?? "").trim();
-      if (v && !isEmailish(v))
-        errors.push("notify_email_from must be a plain email address");
+      if (v && v.includes(","))
+        addError("notify_email_from", "From address must be a single email address \u2014 put multiple addresses in Recipients (To) instead.");
+      else if (v && !isEmailish(v))
+        addError("notify_email_from", "From address must be a valid email like nest@company.com.");
       else pending.push({ name: "NOTIFY_EMAIL_FROM", value: v || null });
     }
     if ("notify_email_to" in body) {
       const v = String(body.notify_email_to ?? "").trim();
       if (v && !isEmailListish(v))
-        errors.push("notify_email_to must be a comma-separated list of email addresses");
+        addError("notify_email_to", "Recipients must be valid emails, comma-separated (e.g. team@company.com, ops@company.com).");
       else pending.push({ name: "NOTIFY_EMAIL_TO", value: v || null });
     }
     if ("max_body_bytes" in body) {
       const n = Number(body.max_body_bytes);
       if (!Number.isFinite(n) || n < 1024 * 1024 || n > 500 * 1024 * 1024)
-        errors.push("max_body_bytes must be between 1MB and 500MB");
+        addError("max_body_bytes", "Max upload size must be between 1 MB and 500 MB.");
       else pending.push({ name: "MAX_BODY_BYTES", value: String(Math.floor(n)) });
     }
-    if (errors.length)
-      return c.json({ error: errors.join("; "), settings: currentServerSettings() }, 400);
+    const effManual = "manual_sign_in" in body ? String(body.manual_sign_in ?? "").trim().toLowerCase() : config.MANUAL_SIGN_IN;
+    const effGate = "promptowl_sign_in_gate" in body ? String(body.promptowl_sign_in_gate ?? "").trim().toLowerCase() : config.PROMPTOWL_SIGN_IN_GATE;
+    if (effManual === "disabled" && effGate === "disabled") {
+      addError(
+        "manual_sign_in",
+        "Cannot disable both manual and PromptOwl sign-in \u2014 no one would be able to log in."
+      );
+    }
+    const errorMessages = Object.values(fieldErrors);
+    if (errorMessages.length)
+      return c.json(
+        { error: errorMessages.join("; "), fieldErrors, settings: currentServerSettings() },
+        400
+      );
+    const smtpChange = pending.find((p) => p.name === "SMTP_URL");
+    if (smtpChange && smtpChange.value) {
+      const result = await verifySmtp(smtpChange.value);
+      if (!result.ok) {
+        const message = `SMTP connection failed: ${result.error}`;
+        return c.json(
+          {
+            error: message,
+            fieldErrors: { smtp_url: message },
+            settings: currentServerSettings()
+          },
+          400
+        );
+      }
+    }
     for (const { name, value } of pending) {
       try {
-        upsertEnvVar(config.ENV_FILE_PATH, name, value);
+        await persistSetting(name, value);
       } catch (e) {
         return c.json(
           {
@@ -7931,6 +9210,45 @@ function createApp() {
     });
     return c.json({ count: events.length, total, limit, offset, events });
   });
+  app.use("/me/*", flexAuthMiddleware);
+  app.get("/me/work", async (c) => {
+    const userId = c.get("userId");
+    const me = await resolveCallerEmail(userId);
+    const nestName2 = /* @__PURE__ */ new Map();
+    for (const n of [
+      ...await listNests(userId),
+      ...await listSharedNests(userId)
+    ])
+      nestName2.set(n.id, n.name ?? n.id);
+    const { requests } = await getReviewQueue({ status: "pending", limit: 200 });
+    const toItem = (r) => ({
+      type: "review",
+      nest_id: r.nestId,
+      nest_name: nestName2.get(r.nestId),
+      node_id: r.nodeId,
+      title: r.title || r.nodeId,
+      requested_by: r.requestedBy,
+      requested_at: r.requestedAt,
+      priority: r.priority
+    });
+    const mine = requests.filter((r) => nestName2.has(r.nestId));
+    const byNewest = (a, b) => a.requested_at < b.requested_at ? 1 : -1;
+    const items = mine.filter((r) => r.requestedBy !== me).map(toItem).sort(byNewest);
+    const waiting = mine.filter((r) => r.requestedBy === me).map(toItem).sort(byNewest);
+    const notifications = await listNotifications(me, { unreadOnly: true, limit: 50 });
+    return c.json({ items, waiting, notifications });
+  });
+  app.get("/me/notifications", async (c) => {
+    const me = await resolveCallerEmail(c.get("userId"));
+    const unreadOnly = c.req.query("unread") === "true";
+    return c.json({ notifications: await listNotifications(me, { unreadOnly }) });
+  });
+  app.post("/me/notifications/read", async (c) => {
+    const me = await resolveCallerEmail(c.get("userId"));
+    const body = await c.req.json().catch(() => ({}));
+    await markNotificationsRead(me, body.ids === "all" ? "all" : body.ids ?? []);
+    return c.json({ ok: true });
+  });
   app.use("/stats", flexAuthMiddleware);
   app.get("/stats", async (c) => {
     const db = getDb();
@@ -7959,12 +9277,13 @@ function createApp() {
   });
   app.use("/runs/*", flexAuthMiddleware);
   app.route("/runs", runDetailRoutes);
+  app.route("/hooks", hookFireRoutes);
   app.route("/llms.txt", llmsTxtRoutes);
   app.use("/index", flexAuthMiddleware);
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthMiddleware);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono16();
+  const nestsApp = new Hono18();
   nestsApp.use("*", flexAuthMiddleware);
   nestsApp.use("*", async (c, next) => {
     const localPath = c.req.path.replace(/^\/nests\//, "");
@@ -8053,15 +9372,17 @@ function createApp() {
       required = "admin";
     } else if (resource === "collaborators") {
       required = c.req.method === "GET" || c.req.method === "POST" ? "write" : "admin";
+    } else if (parts[1] === "hooks") {
+      required = "write";
     } else if (c.req.method !== "GET" && !isStewardActionPath && !isCommentAction && !isAnnotationAction && !isReadQuery) {
       required = "write";
     }
-    const isNodeRevert = c.req.method === "POST" && parts.length >= 4 && parts[parts.length - 1] === "revert";
+    const isNodeAction = c.req.method === "POST" && parts.length >= 4 && (parts[parts.length - 1] === "revert" || parts[parts.length - 1] === "move");
     let stewardEditorBypass = false;
     if (required === "write" && permission === "read" && parts[1] === "nodes") {
       const userEmail = await resolveCallerEmail(userId);
-      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeRevert)) {
-        const idParts = isNodeRevert ? parts.slice(2, -1) : parts.slice(2);
+      if (parts.length >= 3 && (c.req.method === "PATCH" || c.req.method === "DELETE" || isNodeAction)) {
+        const idParts = isNodeAction ? parts.slice(2, -1) : parts.slice(2);
         const rawNodeId = idParts.join("/");
         let nodeId = rawNodeId;
         try {
@@ -8101,6 +9422,30 @@ function createApp() {
     assertSafeNodeId(c.req.param("nodeId"));
     return next();
   });
+  nestsApp.get("/:nestId/trace", async (c) => {
+    const nestId = c.req.param("nestId");
+    if (!await canManageStewards(nestId, c.get("userId"))) {
+      return c.json(
+        {
+          error: "Only the nest owner, a nest admin, or the server admin can view this nest's activity."
+        },
+        403
+      );
+    }
+    const limitRaw = Number(c.req.query("limit"));
+    const offsetRaw = Number(c.req.query("offset"));
+    const limit = Number.isFinite(limitRaw) ? limitRaw : 25;
+    const offset = Number.isFinite(offsetRaw) ? offsetRaw : 0;
+    const { events, total } = await listTraceEvents({
+      limit,
+      offset,
+      kind: c.req.query("kind"),
+      nestId,
+      // pinned — the caller cannot query outside their nest
+      user: c.req.query("user") || void 0
+    });
+    return c.json({ count: events.length, total, limit, offset, events });
+  });
   nestsApp.route("/", nestRoutes);
   nestsApp.route("/:nestId", governanceRoutes);
   nestsApp.route("/:nestId/nodes", annotationRoutes);
@@ -8113,12 +9458,29 @@ function createApp() {
   nestsApp.route("/:nestId/edges", edgeRoutes);
   nestsApp.route("/:nestId/run", runTriggerRoutes);
   nestsApp.route("/:nestId/runs", runListRoutes);
+  nestsApp.route("/:nestId/schedules", scheduleRoutes);
+  nestsApp.route("/:nestId/env", envRoutes);
+  nestsApp.route("/:nestId/connectors", connectorRoutes);
+  nestsApp.route("/:nestId/hooks", hookNestRoutes);
   nestsApp.route("/:nestId/definitions", definitionRoutes);
   nestsApp.route("/:nestId/assets", assetRoutes);
   nestsApp.route("/:nestId/mcp", mcpRoutes);
   app.route("/nests", nestsApp);
-  app.use("/assets/*", serveStatic({ root: UI_DIR_REL }));
-  app.get("*", serveStatic({ root: UI_DIR_REL, path: "index.html" }));
+  app.use(
+    "/assets/*",
+    serveStatic({
+      root: UI_DIR_REL,
+      onFound: (_p, c) => c.header("Cache-Control", "public, max-age=31536000, immutable")
+    })
+  );
+  app.get(
+    "*",
+    serveStatic({
+      root: UI_DIR_REL,
+      path: "index.html",
+      onFound: (_p, c) => c.header("Cache-Control", "no-cache")
+    })
+  );
   app.onError((err, c) => {
     if (err instanceof AppError) {
       return c.json({ error: err.message }, err.statusCode);
@@ -8292,9 +9654,77 @@ async function backfillNodeVersionsFromHistory(db) {
   );
 }
 
+// src/workflow/scheduler.ts
+import { v4 as uuid14 } from "uuid";
+function isDue(s, now) {
+  if (!s.last_run_at) return true;
+  const last = Date.parse(s.last_run_at);
+  if (Number.isNaN(last)) return true;
+  return now - last >= s.every_minutes * 6e4;
+}
+async function schedulerTick(now = Date.now()) {
+  const db = getDb();
+  const due = (await db.all("SELECT * FROM schedules WHERE enabled = 1")).filter((s) => isDue(s, now));
+  const created = [];
+  for (const s of due) {
+    try {
+      const { n } = await db.get(
+        `SELECT COUNT(*) AS n FROM runs
+          WHERE nest_id = ? AND parent_run_id IS NULL AND status = 'running'`,
+        [s.nest_id]
+      );
+      if (n >= config.RUN_MAX_CONCURRENT_ROOTS) {
+        console.warn(
+          `[scheduler] skip ${s.agent_node} in ${s.nest_id}: ${n} runs already running`
+        );
+        continue;
+      }
+      const id = `run_${uuid14()}`;
+      const nowIso = new Date(now).toISOString();
+      await db.run(
+        `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
+         VALUES (?, ?, ?, ?, 'running', NULL, ?, NULL, 0)`,
+        // triggered_by names the schedule's creator with a schedule: prefix —
+        // honest provenance ("this fired on X's schedule, not X clicking").
+        [id, s.nest_id, s.agent_node, `schedule:${s.created_by}`, nowIso]
+      );
+      const fired = s.runs_created + 1;
+      const done = s.max_runs !== null && fired >= s.max_runs;
+      await db.run(
+        `UPDATE schedules SET last_run_at = ?, runs_created = ?, enabled = ?, updated_at = ?
+          WHERE id = ?`,
+        [nowIso, fired, done ? 0 : s.enabled, nowIso, s.id]
+      );
+      created.push(id);
+    } catch (err) {
+      console.error(`[scheduler] failed to fire schedule ${s.id}`, err);
+    }
+  }
+  return created;
+}
+var timer = null;
+function startScheduler() {
+  if (!config.FEATURE_WORKFLOW_PLANE || timer) return;
+  timer = setInterval(() => {
+    void schedulerTick().catch(
+      (err) => console.error("[scheduler] tick failed", err)
+    );
+  }, 6e4);
+  timer.unref?.();
+  console.log("[scheduler] workflow schedules active (60s tick)");
+}
+
 // src/index.ts
 async function main() {
   const db = await initDb();
+  try {
+    const loaded = await loadServerSettings();
+    if (loaded > 0) {
+      console.log(`  Loaded ${loaded} persisted server setting(s) from the database`);
+    }
+  } catch (err) {
+    console.error("[settings] failed to load persisted server settings:", err);
+  }
   try {
     await backfillNodeVersionsFromHistory(db);
   } catch (err) {
@@ -8384,6 +9814,8 @@ ${config.AUTH_MODE === "key" ? `
 `);
   }
   serve({ fetch: app.fetch, port: config.PORT });
+  startScheduler();
+  setInterval(() => sweepStale(), 10 * 6e4).unref?.();
 }
 main().catch((err) => {
   console.error("Fatal:", err);