@promptowl/contextnest-community 1.0.1 → 1.1.0

package/CONFIGURATION.md

@@ -48,11 +48,13 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `DATABASE_PATH` | `$DATA_ROOT/community.db` | Override the SQLite file location explicitly. |
 | `AUTH_MODE` | `key` | `key` or `open`. See above. |
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
-| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community Server license key (`pk_...`). Unlicensed instances still run but some features may be limited. |
+| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
+| `ENV_FILE_PATH` | `$cwd/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars). Override when your `.env` lives outside the working directory. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
 | `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+| `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 
 ---
 
@@ -61,10 +63,10 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 ### Local dev / single user
 
 ```bash
-AUTH_MODE=open DATA_ROOT=./my-data pnpm dev
+AUTH_MODE=open DATA_ROOT=./my-data npm run dev
 ```
 
-Or the default dev mode if `pnpm dev` already sets `AUTH_MODE=open` in your scripts.
+Or the default dev mode if `npm run dev` already sets `AUTH_MODE=open` in your scripts.
 
 ### Team / multi-user behind a reverse proxy
 
@@ -73,7 +75,7 @@ AUTH_MODE=key \
 CORS_ORIGINS="https://team.example.com,https://admin.example.com" \
 DATA_ROOT=/var/lib/contextnest \
 PROMPTOWL_KEY=pk_... \
-pnpm start
+npm start
 ```
 
 Terminate TLS at the proxy, forward `X-Forwarded-For` and `X-Real-IP` headers (the rate limiter reads them), and bind the server to `127.0.0.1` so only the proxy can reach it.

package/README.md

@@ -11,7 +11,9 @@
 ContextNest Community Edition is a self-hosted server that lets you:
 
 - Store, version, and govern markdown-based context documents ("nests")
+- Import an existing folder or vault of markdown files in one step
 - Apply stewardship workflows — draft, pending review, approved
+- Share nests with collaborators or publish them read-only to the public
 - Serve approved context to AI agents via MCP, HTTP, or CLI
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
@@ -20,17 +22,60 @@ The server runs locally or on your own infrastructure. Your PromptOwl account ha
 ## Quickstart
 
 ```bash
-# 1. Get a license key — sign up free at https://app.promptowl.ai
-#    Settings → License Keys → Create a Community Server key
+# 1. Run the community server
+npx @promptowl/contextnest-community
 
-# 2. (Optional) Scaffold a local nest with the open-source CLI
-npx @promptowl/contextnest-cli init
+# 2. Open the server in your browser
+#    http://localhost:3838
+#    On first boot with no license, it lands on the License Setup Page.
 
-# 3. Run the community server
+# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
+```
+
+The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+> **Optional:** scaffold a local nest with the open-source CLI before connecting:
+> ```bash
+> npx @promptowl/contextnest-cli init
+> ```
+
+## License setup
+
+ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
+
+### 1. Create the key (free)
+
+1. Sign up or log in at <https://app.promptowl.ai>
+2. Open the **Overview** menu → **Community License**
+3. Click **Create a Community License key**
+4. Copy the generated key — it starts with `pk_`
+
+### 2. Activate the server
+
+Pick **one** of two ways:
+
+**A. Browser setup page (recommended for first run)**
+
+1. Start the server: `npx @promptowl/contextnest-community`
+2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
+3. Paste your `pk_...` key and submit
+4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
+
+**B. Environment variable (recommended for Docker / CI / scripted deploys)**
+
+```bash
 PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
 ```
 
-The server listens on `http://localhost:3000` by default. Without a valid `PROMPTOWL_KEY` the server still runs but some features are limited. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
+
+### 3. How licensing behaves at runtime
+
+- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
+- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
+- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
+
+For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
 
 ## System requirements
 
@@ -45,9 +90,15 @@ The server listens on `http://localhost:3000` by default. Without a valid `PROMP
 |---|:---:|:---:|
 | Self-hosted context server | ✅ | ✅ |
 | Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Import existing folder / vault | ✅ | ✅ |
+| Markdown rendering + wiki cross-linking | ✅ | ✅ |
+| External-edit detection + version diff | ✅ | ✅ |
 | Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| Per-nest sharing + collaborators | ✅ | ✅ |
+| Public read-only nests | ✅ | ✅ |
+| Custom logo / branding | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
-| Multi-user governance UI | — | ✅ |
+| Centralized multi-tenant admin console | — | ✅ |
 | SSO / SAML / SCIM | — | ✅ |
 | Audit log streaming | — | ✅ |
 | Policy transforms (redaction, summarization) | — | ✅ |
@@ -55,6 +106,28 @@ The server listens on `http://localhost:3000` by default. Without a valid `PROMP
 
 For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
 
+## What's new in 1.1.0
+
+- **Vault import** — import an existing folder of markdown files into a new nest in one step, from the dashboard ("Import folder") or via the API. Frontmatter, wiki links, and folder structure are preserved.
+- **Nest sharing + collaborators** — set per-nest visibility and add collaborators with read or write access. A Share affordance is now inline in the document view.
+- **Public read-only nests** — flip a nest to `visibility=public` to serve it to unauthenticated readers (bypasses auth for GETs only); writes still require a key.
+- **Custom logo / branding** — set `LOGO_URL` to show your own logo in the UI header and login screen. See [CONFIGURATION.md](./CONFIGURATION.md).
+- **Governance** — nest owners can self-approve their own changes; new per-nest auto-approve toggle; role-based action gating (buttons reflect the viewer's role); stewards can edit scope during a role change.
+- **Editor** — `[[wikilink]]` autocomplete, broken-link click creates a new doc with the title pre-filled, tag chips filter the nest list, Notion-style H1 title, click-to-edit, and an unsaved-changes warning.
+- **Stability** — added an error boundary so a render error in one view no longer blanks the whole app; bumped `uuid` to 14.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
+## What's new in 1.0.1
+
+- **Document hashing pipeline** — external-edit detection, conflict-aware safe-publish, and inline version diffs powered by `@promptowl/contextnest-engine`. When a file is edited outside the UI, the editor shows an "External edit detected" banner with a side-by-side diff and an adopt / keep choice.
+- **Markdown rendering** — new `DocumentViewer` (react-markdown + remark-gfm + wikilink support) renders CLI/MCP-authored markdown correctly, with a view/edit toggle.
+- **License revocation now blocks writes synchronously** — revoke flips an in-process "writes blocked" flag immediately; the next write returns `503`.
+- **Dashboard stats** — new `GET /stats` endpoint surfaces nest / document / user counts.
+- **Docker fix** — Dockerfile now installs via npm against the shipped `package-lock.json`; base image bumped to `node:22-slim`.
+
+Full history in [CHANGELOG.md](./CHANGELOG.md).
+
 ## Licensing
 
 ContextNest Community Edition is **commercial software**. It is **not open source**.

package/dist/{chunk-JMZ75ZCD.js → chunk-7UTMBL6Z.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-KQCWNHDM.js";
+} from "./chunk-TDAX3JOT.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-5VHKEIAW.js → chunk-S2EWN2VA.js}

@@ -1,46 +1,20 @@
-import {
-  canUserApprove,
-  resolveStewardsForNode
-} from "./chunk-K22GWPT4.js";
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-JMZ75ZCD.js";
+} from "./chunk-7UTMBL6Z.js";
+import {
+  buildTitleMap,
+  canUserApprove,
+  engineCache,
+  resolveStewardsForNode
+} from "./chunk-WCOUCBDJ.js";
 import {
-  config,
   getDb
-} from "./chunk-KQCWNHDM.js";
+} from "./chunk-TDAX3JOT.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";
 
-// src/nodes/engine.ts
-import { join } from "path";
-import {
-  NestStorage,
-  GraphQueryEngine,
-  VersionManager
-} from "@promptowl/contextnest-engine";
-var NestEngineCache = class {
-  cache = /* @__PURE__ */ new Map();
-  get(nestId) {
-    let engine = this.cache.get(nestId);
-    if (!engine) {
-      const nestPath = join(config.DATA_ROOT, "nests", nestId);
-      const storage = new NestStorage(nestPath);
-      const query = new GraphQueryEngine(storage);
-      const versions = new VersionManager(storage);
-      engine = { storage, query, versions };
-      this.cache.set(nestId, engine);
-    }
-    return engine;
-  }
-  evict(nestId) {
-    this.cache.delete(nestId);
-  }
-};
-var engineCache = new NestEngineCache();
-
 // src/governance/safe-publish.ts
 import {
   publishDocument,
@@ -209,7 +183,7 @@ function cancelReview(params) {
   ).run(params.nestId, params.nodeId, pending.version);
   return getReviewRequest(pending.id);
 }
-function getReviewQueue(params) {
+async function getReviewQueue(params) {
   const db = getDb();
   let whereClauses = [];
   const args = [];
@@ -244,6 +218,15 @@ function getReviewQueue(params) {
       );
     });
   }
+  const titleMapsByNest = /* @__PURE__ */ new Map();
+  const nestIds = new Set(requests.map((r) => r.nestId));
+  for (const nid of nestIds) {
+    titleMapsByNest.set(nid, await buildTitleMap(nid));
+  }
+  requests = requests.map((r) => ({
+    ...r,
+    title: titleMapsByNest.get(r.nestId)?.get(r.nodeId)
+  }));
   return { requests, total };
 }
 function getReviewHistory(nestId, nodeId) {
@@ -283,7 +266,6 @@ function rowToReviewRequest(row) {
 }
 
 export {
-  engineCache,
   safePublishDocument,
   submitForReview,
   approve,

package/dist/{chunk-KQCWNHDM.js → chunk-TDAX3JOT.js}

@@ -52,6 +52,25 @@ var config = {
   get TELEMETRY_INTERVAL_MS() {
     return parseInt(process.env.TELEMETRY_INTERVAL_MS || "3600000", 10);
   },
+  /**
+   * Optional custom logo URL shown in UI header + login screen.
+   * Must be an absolute https://, http://, or data:image/… URL. Other
+   * schemes (file://, javascript:, relative paths) are rejected with a
+   * warning so an operator typo doesn't silently break the favicon.
+   * When unset or invalid, the UI falls back to the bundled icon.
+   */
+  get LOGO_URL() {
+    const raw = process.env.LOGO_URL?.trim();
+    if (!raw) return null;
+    const ok = /^(https?:\/\/|data:image\/)/i.test(raw);
+    if (!ok) {
+      console.warn(
+        `[config] LOGO_URL rejected: must start with https://, http://, or data:image/ (got "${raw}"). Falling back to default logo.`
+      );
+      return null;
+    }
+    return raw;
+  },
   get AUTH_MODE() {
     return process.env.AUTH_MODE || "key";
   },
@@ -229,6 +248,12 @@ function runMigrations(db2) {
   if (!nestCols.includes("stewardship_enabled")) {
     db2.exec("ALTER TABLE nests ADD COLUMN stewardship_enabled INTEGER NOT NULL DEFAULT 0");
   }
+  if (!nestCols.includes("is_imported")) {
+    db2.exec("ALTER TABLE nests ADD COLUMN is_imported INTEGER NOT NULL DEFAULT 0");
+  }
+  if (!nestCols.includes("allow_self_approve")) {
+    db2.exec("ALTER TABLE nests ADD COLUMN allow_self_approve INTEGER NOT NULL DEFAULT 0");
+  }
   const userCols = db2.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db2.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");