@promptowl/contextnest-community 0.1.0-alpha.1

package/dist/chunk-P6NG56CO.js

@@ -0,0 +1,127 @@
+import {
+  getDb
+} from "./chunk-USIDOGVJ.js";
+
+// src/governance/version-service.ts
+import { createHash } from "crypto";
+function hashContent(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function createVersion(params) {
+  const db = getDb();
+  const contentHash = hashContent(params.content);
+  db.prepare(
+    `INSERT INTO node_versions (nest_id, node_id, version, content_hash, author, status, change_note, tags_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    params.nestId,
+    params.nodeId,
+    params.version,
+    contentHash,
+    params.author,
+    params.status,
+    params.changeNote || null,
+    params.tags ? JSON.stringify(params.tags) : null
+  );
+  return {
+    version: params.version,
+    content: params.content,
+    editedBy: params.author,
+    editedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changeNote: params.changeNote,
+    status: params.status
+  };
+}
+function getVersions(nestId, nodeId) {
+  const db = getDb();
+  const rows = db.prepare(
+    "SELECT * FROM node_versions WHERE nest_id = ? AND node_id = ? ORDER BY version DESC"
+  ).all(nestId, nodeId);
+  return rows.map(rowToVersion);
+}
+function getVersion(nestId, nodeId, version) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT * FROM node_versions WHERE nest_id = ? AND node_id = ? AND version = ?"
+  ).get(nestId, nodeId, version);
+  return row ? rowToVersion(row) : null;
+}
+function getCurrentVersion(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT MAX(version) as v FROM node_versions WHERE nest_id = ? AND node_id = ?"
+  ).get(nestId, nodeId);
+  return row?.v || 0;
+}
+function getApprovedVersion(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?"
+  ).get(nestId, nodeId);
+  return row?.approved_version ?? null;
+}
+function setApprovedVersion(nestId, nodeId, version, approvedBy) {
+  const db = getDb();
+  db.prepare(
+    `INSERT OR REPLACE INTO approved_versions (nest_id, node_id, approved_version, approved_by)
+     VALUES (?, ?, ?, ?)`
+  ).run(nestId, nodeId, version, approvedBy);
+}
+function checkConflict(nestId, nodeId, baseVersion) {
+  const db = getDb();
+  const current = db.prepare(
+    "SELECT version, content_hash, author, created_at FROM node_versions WHERE nest_id = ? AND node_id = ? ORDER BY version DESC LIMIT 1"
+  ).get(nestId, nodeId);
+  if (!current) {
+    return { conflict: false, currentVersion: 0, currentHash: "" };
+  }
+  if (current.version !== baseVersion) {
+    return {
+      conflict: true,
+      currentVersion: current.version,
+      currentHash: current.content_hash,
+      updatedBy: current.author,
+      updatedAt: current.created_at
+    };
+  }
+  return {
+    conflict: false,
+    currentVersion: current.version,
+    currentHash: current.content_hash
+  };
+}
+function getNodeTags(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    "SELECT tags_json FROM node_versions WHERE nest_id = ? AND node_id = ? ORDER BY version DESC LIMIT 1"
+  ).get(nestId, nodeId);
+  if (!row?.tags_json) return [];
+  try {
+    return JSON.parse(row.tags_json);
+  } catch {
+    return [];
+  }
+}
+function rowToVersion(row) {
+  return {
+    version: row.version,
+    content: "",
+    // Content lives on disk, not in the versions table
+    editedBy: row.author,
+    editedAt: row.created_at,
+    changeNote: row.change_note || void 0,
+    status: row.status
+  };
+}
+
+export {
+  hashContent,
+  createVersion,
+  getVersions,
+  getVersion,
+  getCurrentVersion,
+  getApprovedVersion,
+  setApprovedVersion,
+  checkConflict,
+  getNodeTags
+};

package/dist/chunk-Q2DCOS7V.js

@@ -0,0 +1,491 @@
+import {
+  config,
+  getDb
+} from "./chunk-USIDOGVJ.js";
+
+// src/governance/stewardship-service.ts
+import { v4 as uuid } from "uuid";
+
+// src/governance/access-service.ts
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+var accessConfig = null;
+function loadAccessConfig() {
+  const candidates = [
+    join(config.DATA_ROOT, "access.yaml"),
+    join(config.DATA_ROOT, "access.yml")
+  ];
+  for (const path of candidates) {
+    if (existsSync(path)) {
+      const content = readFileSync(path, "utf-8");
+      accessConfig = parseAccessYaml(content);
+      return accessConfig;
+    }
+  }
+  accessConfig = null;
+  return null;
+}
+function getAccessConfig() {
+  return accessConfig;
+}
+function isSuperAdmin(email) {
+  if (!accessConfig?.super_admins) return false;
+  return accessConfig.super_admins.map((e) => e.toLowerCase()).includes(email.toLowerCase());
+}
+function parseAccessYaml(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let currentSection = null;
+  let currentGroup = null;
+  let inMembers = false;
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    if (!line || line.startsWith("#")) continue;
+    if (!line.startsWith(" ") && !line.startsWith("	")) {
+      const match = line.match(/^(\w+):\s*(.*)?$/);
+      if (!match) continue;
+      const key = match[1];
+      const value = match[2]?.trim();
+      if (key === "mode") {
+        result.mode = value;
+        currentSection = null;
+      } else if (key === "allowed_users") {
+        currentSection = "allowed_users";
+        result.allowed_users = [];
+      } else if (key === "groups") {
+        currentSection = "groups";
+        result.groups = {};
+      } else if (key === "super_admins") {
+        currentSection = "super_admins";
+        result.super_admins = [];
+      }
+      currentGroup = null;
+      inMembers = false;
+      continue;
+    }
+    const listMatch = line.match(/^\s+-\s+["']?([^"'\n]+?)["']?\s*$/);
+    if (currentSection === "allowed_users" && listMatch) {
+      result.allowed_users.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "super_admins" && listMatch) {
+      result.super_admins.push(listMatch[1].trim());
+      continue;
+    }
+    if (currentSection === "groups") {
+      const groupMatch = line.match(/^  (\w+):$/);
+      if (groupMatch) {
+        currentGroup = groupMatch[1];
+        result.groups[currentGroup] = { members: [], default_permission: "read" };
+        inMembers = false;
+        continue;
+      }
+      if (currentGroup) {
+        const propMatch = line.match(/^\s{4}(\w+):\s*(.*)?$/);
+        if (propMatch) {
+          const prop = propMatch[1];
+          const val = propMatch[2]?.trim();
+          if (prop === "default_permission" && val) {
+            result.groups[currentGroup].default_permission = val;
+          }
+          if (prop === "members") {
+            inMembers = true;
+          }
+          continue;
+        }
+        if (inMembers && listMatch) {
+          result.groups[currentGroup].members.push(listMatch[1].trim());
+        }
+      }
+    }
+  }
+  return result;
+}
+
+// src/governance/stewardship-service.ts
+function assignSteward(data) {
+  const db = getDb();
+  const id = uuid();
+  db.prepare(
+    `INSERT INTO stewards
+     (id, nest_id, scope, node_pattern, tag_name, user_email, user_id, role, can_approve, can_reject, assigned_by, is_active)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    id,
+    data.nestId,
+    data.scope,
+    data.nodePattern || null,
+    data.tagName || null,
+    data.userEmail,
+    data.userId || null,
+    data.role,
+    data.canApprove ? 1 : 0,
+    data.canReject ? 1 : 0,
+    data.assignedBy,
+    data.isActive ? 1 : 0
+  );
+  return { ...data, id };
+}
+function removeSteward(id) {
+  const db = getDb();
+  db.prepare("UPDATE stewards SET is_active = 0 WHERE id = ?").run(id);
+}
+function getSteward(id) {
+  const db = getDb();
+  const row = db.prepare("SELECT * FROM stewards WHERE id = ?").get(id);
+  return row ? rowToSteward(row) : null;
+}
+function getStewardsForNest(nestId) {
+  const db = getDb();
+  const rows = db.prepare("SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1").all(nestId);
+  return rows.map(rowToSteward);
+}
+function getStewardsForScope(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.scopeTarget) {
+    sql += " AND (node_pattern = ? OR tag_name = ?)";
+    args.push(params.scopeTarget, params.scopeTarget);
+  }
+  return db.prepare(sql).all(...args).map(rowToSteward);
+}
+function listStewards(params) {
+  const db = getDb();
+  let sql = "SELECT * FROM stewards WHERE nest_id = ? AND is_active = 1";
+  const args = [params.nestId];
+  if (params.scope) {
+    sql += " AND scope = ?";
+    args.push(params.scope);
+  }
+  if (params.search) {
+    sql += " AND (user_email LIKE ? OR tag_name LIKE ? OR node_pattern LIKE ?)";
+    const like = `%${params.search.toLowerCase()}%`;
+    args.push(like, like, like);
+  }
+  sql += " ORDER BY scope, COALESCE(node_pattern, tag_name, ''), user_email";
+  return db.prepare(sql).all(...args).map(rowToSteward);
+}
+function createStewardRecord(params) {
+  if (params.users.length === 0) {
+    throw new Error("At least one user is required");
+  }
+  let nodePattern;
+  let tagName;
+  switch (params.scope) {
+    case "document":
+      if (!params.documentId) throw new Error("documentId required for document scope");
+      nodePattern = params.documentId;
+      break;
+    case "folder":
+      if (!params.folderPath) throw new Error("folderPath required for folder scope");
+      nodePattern = params.folderPath;
+      break;
+    case "tag":
+      if (!params.tagName) throw new Error("tagName required for tag scope");
+      tagName = params.tagName.trim().replace(/^#+/, "").toLowerCase();
+      break;
+    case "nest":
+      break;
+  }
+  const db = getDb();
+  const results = [];
+  for (const user of params.users) {
+    const email = user.email.trim().toLowerCase();
+    if (!email) continue;
+    const existing = db.prepare(
+      `SELECT * FROM stewards
+         WHERE nest_id = ? AND is_active = 1 AND scope = ? AND user_email = ?
+           AND COALESCE(node_pattern, '') = COALESCE(?, '')
+           AND COALESCE(tag_name, '') = COALESCE(?, '')`
+    ).get(
+      params.nestId,
+      params.scope,
+      email,
+      nodePattern ?? null,
+      tagName ?? null
+    );
+    if (existing) {
+      results.push(rowToSteward(existing));
+      continue;
+    }
+    const userRow = db.prepare("SELECT id FROM users WHERE email = ?").get(email);
+    const created = assignSteward({
+      nestId: params.nestId,
+      scope: params.scope,
+      nodePattern,
+      tagName,
+      userEmail: email,
+      userId: userRow?.id,
+      role: user.role ?? "reviewer",
+      canApprove: user.canApprove !== false,
+      canReject: user.canReject !== false,
+      assignedBy: params.assignedBy,
+      assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      isActive: true
+    });
+    results.push(created);
+  }
+  db.prepare(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ? AND stewardship_enabled = 0"
+  ).run(params.nestId);
+  return results;
+}
+function resolveStewardsForNode(nestId, nodeId) {
+  return resolve(nestId, nodeId).stewards;
+}
+function resolveStewardsWithFallback(nestId, nodeId) {
+  return resolve(nestId, nodeId);
+}
+function resolve(nestId, nodeId) {
+  const db = getDb();
+  const rows = db.prepare(
+    `
+      SELECT s.*, 1 AS priority, ('document: ' || s.node_pattern) AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'document'
+          AND s.node_pattern = ?
+      UNION ALL
+      SELECT s.*, 2 AS priority, ('folder: ' || s.node_pattern) AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'folder'
+          AND s.node_pattern IS NOT NULL
+          AND instr(s.node_pattern, '*') = 0
+          AND ? LIKE s.node_pattern || '/%'
+      UNION ALL
+      SELECT s.*, 3 AS priority, ('tag: ' || s.tag_name) AS match_source
+        FROM stewards s
+        JOIN node_tag_index nt
+          ON nt.nest_id = s.nest_id
+         AND nt.tag_name = s.tag_name
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'tag'
+          AND nt.node_id = ?
+      UNION ALL
+      SELECT s.*, 4 AS priority, 'nest-level steward' AS match_source
+        FROM stewards s
+        WHERE s.nest_id = ? AND s.is_active = 1 AND s.scope = 'nest'
+      ORDER BY priority ASC, user_email ASC
+      `
+  ).all(nestId, nodeId, nestId, nodeId, nestId, nodeId, nestId);
+  const resolved = rows.map((row) => ({
+    steward: rowToSteward(row),
+    priority: row.priority,
+    source: row.match_source
+  }));
+  const legacyFolderGlobs = db.prepare(
+    `SELECT * FROM stewards
+       WHERE nest_id = ? AND is_active = 1 AND scope = 'folder'
+         AND node_pattern IS NOT NULL AND instr(node_pattern, '*') > 0`
+  ).all(nestId);
+  for (const row of legacyFolderGlobs) {
+    if (globMatch(nodeId, row.node_pattern)) {
+      resolved.push({
+        steward: rowToSteward(row),
+        priority: 2,
+        source: `folder: ${row.node_pattern}`
+      });
+    }
+  }
+  if (legacyFolderGlobs.length > 0) {
+    resolved.sort((a, b) => a.priority - b.priority);
+  }
+  if (resolved.length > 0) {
+    return { stewards: resolved, fallbackToOwner: false };
+  }
+  const owner = db.prepare(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`
+  ).get(nestId);
+  return {
+    stewards: [],
+    fallbackToOwner: true,
+    ownerEmail: owner?.email
+  };
+}
+function isSuperAdmin2(userEmail) {
+  const cfg = getAccessConfig();
+  return !!cfg?.super_admins?.includes(userEmail);
+}
+function getNestOwnerEmail(nestId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT u.email FROM nests n
+       JOIN users u ON u.id = n.user_id
+       WHERE n.id = ?`
+  ).get(nestId);
+  return row?.email ?? null;
+}
+function canUserEdit(nestId, nodeId, userEmail) {
+  if (isSuperAdmin2(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  const owner = getNestOwnerEmail(nestId);
+  if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  const resolved = resolveStewardsForNode(nestId, nodeId);
+  const match = resolved.find(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && (r.steward.role === "editor" || r.steward.role === "reviewer")
+  );
+  if (match) {
+    return { allowed: true, reason: match.source, role: match.steward.role };
+  }
+  return { allowed: false, reason: "no editor/reviewer role on this node", role: null };
+}
+function getCurrentVersionAuthor(nestId, nodeId) {
+  const db = getDb();
+  const row = db.prepare(
+    `SELECT author FROM node_versions
+       WHERE nest_id = ? AND node_id = ?
+       ORDER BY version DESC LIMIT 1`
+  ).get(nestId, nodeId);
+  return row?.author ?? null;
+}
+function canUserApprove(nestId, nodeId, userEmail) {
+  if (isSuperAdmin2(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  const resolved = resolveStewardsForNode(nestId, nodeId);
+  if (resolved.length === 0) {
+    return {
+      allowed: false,
+      reason: "no stewards configured for this node",
+      role: null
+    };
+  }
+  const match = resolved.find(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "reviewer" && r.steward.canApprove
+  );
+  if (!match) {
+    return {
+      allowed: false,
+      reason: "not a reviewer steward for this node",
+      role: null
+    };
+  }
+  const author = getCurrentVersionAuthor(nestId, nodeId);
+  if (author && author.toLowerCase() === userEmail.toLowerCase()) {
+    return {
+      allowed: false,
+      reason: "cannot approve a version you authored (separation of duties)",
+      role: "reviewer"
+    };
+  }
+  return { allowed: true, reason: match.source, role: "reviewer" };
+}
+function canUserAccess(nestId, nodeId, userEmail) {
+  if (isSuperAdmin2(userEmail)) {
+    return { allowed: true, reason: "super admin", role: "super_admin" };
+  }
+  const owner = getNestOwnerEmail(nestId);
+  if (owner && owner.toLowerCase() === userEmail.toLowerCase()) {
+    return { allowed: true, reason: "nest owner", role: "owner" };
+  }
+  const resolved = resolveStewardsForNode(nestId, nodeId);
+  const match = resolved.find(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
+  );
+  if (match) {
+    return { allowed: true, reason: match.source, role: match.steward.role };
+  }
+  return { allowed: false, reason: "no steward assignment", role: null };
+}
+function globMatch(value, pattern) {
+  if (pattern === "*") return true;
+  if (!pattern.includes("*")) return value === pattern;
+  const regex = new RegExp(
+    "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$"
+  );
+  return regex.test(value);
+}
+function syncFromConfig(nestId, config2) {
+  const db = getDb();
+  let count = 0;
+  db.prepare(
+    "UPDATE stewards SET is_active = 0 WHERE nest_id = ?"
+  ).run(nestId);
+  db.prepare(
+    "UPDATE nests SET stewardship_enabled = 1 WHERE id = ?"
+  ).run(nestId);
+  const addEntries = (scope, entries, target) => {
+    for (const entry of entries) {
+      const user = db.prepare("SELECT id FROM users WHERE email = ?").get(entry.email);
+      const rawRole = entry.role || "reviewer";
+      const role = rawRole === "admin" ? "reviewer" : rawRole;
+      assignSteward({
+        nestId,
+        scope,
+        nodePattern: target?.nodePattern,
+        tagName: target?.tagName ? target.tagName.trim().replace(/^#+/, "").toLowerCase() : void 0,
+        userEmail: entry.email.toLowerCase(),
+        userId: user?.id,
+        role,
+        canApprove: entry.can_approve !== false,
+        canReject: entry.can_reject !== false,
+        assignedBy: "config",
+        assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        isActive: true
+      });
+      count++;
+    }
+  };
+  if (config2.nest) {
+    addEntries("nest", config2.nest);
+  }
+  if (config2.folders) {
+    for (const [pattern, entries] of Object.entries(config2.folders)) {
+      addEntries("folder", entries, { nodePattern: pattern });
+    }
+  }
+  if (config2.tags) {
+    for (const [tagName, entries] of Object.entries(config2.tags)) {
+      addEntries("tag", entries, { tagName });
+    }
+  }
+  if (config2.documents) {
+    for (const [docPattern, entries] of Object.entries(config2.documents)) {
+      addEntries("document", entries, { nodePattern: docPattern });
+    }
+  }
+  return count;
+}
+function rowToSteward(row) {
+  return {
+    id: row.id,
+    nestId: row.nest_id,
+    scope: row.scope,
+    nodePattern: row.node_pattern || void 0,
+    tagName: row.tag_name || void 0,
+    userEmail: row.user_email,
+    userId: row.user_id || void 0,
+    role: row.role,
+    canApprove: !!row.can_approve,
+    canReject: !!row.can_reject,
+    assignedBy: row.assigned_by,
+    assignedAt: row.assigned_at,
+    isActive: !!row.is_active
+  };
+}
+
+export {
+  loadAccessConfig,
+  isSuperAdmin,
+  assignSteward,
+  removeSteward,
+  getSteward,
+  getStewardsForNest,
+  getStewardsForScope,
+  listStewards,
+  createStewardRecord,
+  resolveStewardsForNode,
+  resolveStewardsWithFallback,
+  canUserEdit,
+  canUserApprove,
+  canUserAccess,
+  syncFromConfig
+};