@promptowl/contextnest-community 1.12.0 → 1.13.0

package/CONFIGURATION.md

@@ -73,7 +73,8 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
 | `TRACE_RETENTION_DAYS` | `14` | Activity-trace retention window in days (the `api_events` rows behind `GET /admin/trace` and `GET /nests/:id/trace`). Rows older than this are pruned opportunistically (every ~500 inserts). `0` = keep forever (pruning is skipped entirely). Capped at `3650`; invalid/negative values fall back to `14`. Also editable from Settings → Advanced. |
 | `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
-| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. The asset-upload route (`POST /nests/:id/assets`) is exempt up to the video cap below. |
+| `VIDEO_MAX_MB` | `30` | Max size (in MB) of a video uploaded into a doc. Default `30` keeps it under Cloud Run's ~32 MiB HTTP/1 request-body limit, so an oversized video is rejected with a clear message instead of a bare `413` from the platform. Raise only where the deployment can actually accept larger request bodies (not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload). Images are fixed at 10 MB. |
 | `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
 | `PROMPTOWL_TEAMS_ENABLED` | _(unset — off)_ | Lets users who signed in with PromptOwl import their PromptOwl teams as local teams. Off by default; set `true` to enable, or toggle from Settings → Advanced. When off, `GET/POST /teams/promptowl` return `404` and the PromptOwl Teams panel is hidden. Independent of `PROMPTOWL_SIGN_IN_GATE`. |
 | `TYPE_ARTIFACT_ENABLED` | `true` | Set `false` to disable creation of **artifact** nodes server-wide (existing artifact nodes stay readable — never data loss). Runnable types (agent/skill/tool) are gated by `FEATURE_WORKFLOW_PLANE`, not here. Also editable from Settings (`/admin/settings`). |

package/README.md

@@ -101,7 +101,7 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Custom logo / branding | ✅ | ✅ |
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |

package/dist/{chunk-3M7677XW.js → chunk-5QQ7WKAI.js}

@@ -12,6 +12,7 @@ import { join, dirname } from "path";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
 import dotenv from "dotenv";
+import { z } from "zod";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname(__filename);
 var envCandidates = [
@@ -29,8 +30,9 @@ var slackUrlWarned = false;
 var emailFromWarned = false;
 var emailToWarned = false;
 var oidcIssuerWarned = false;
+var EMAIL_SCHEMA = z.email();
 function isEmailish(v) {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) && !/[\r\n]/.test(v);
+  return EMAIL_SCHEMA.safeParse(v.trim()).success && !/[\r\n]/.test(v);
 }
 function isEmailListish(v) {
   return v.split(",").every((e) => isEmailish(e.trim()));
@@ -494,6 +496,17 @@ var config = {
    */
   get MAX_BODY_BYTES() {
     return parseInt(process.env.MAX_BODY_BYTES || String(10 * 1024 * 1024), 10);
+  },
+  /**
+   * Max video upload size in bytes. Default 30 MB — kept under Cloud Run's
+   * 32 MiB HTTP/1 request-body limit so a too-big video is rejected cleanly by
+   * our own check (clear message) instead of a bare 413 from the platform.
+   * Raise via VIDEO_MAX_MB only when the deployment can actually accept it
+   * (e.g. not behind Cloud Run, or on HTTP/2 / direct-to-bucket upload).
+   */
+  get VIDEO_MAX_BYTES() {
+    const mb = parseInt(process.env.VIDEO_MAX_MB || "30", 10);
+    return (Number.isFinite(mb) && mb > 0 ? mb : 30) * 1024 * 1024;
   }
 };
 

package/dist/{chunk-JHIU6RZU.js → chunk-EG77SQHO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XQ46F76G.js";
 import {
   getDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -41,6 +41,38 @@ async function createVersion(params) {
     status: params.status
   };
 }
+async function upsertVersion(params) {
+  const db = getDb();
+  const contentHash = hashContent(params.content);
+  const sql = insertOrReplace(
+    db,
+    `INSERT INTO node_versions (nest_id, node_id, version, content_hash, author, status, change_note, tags_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    ["nest_id", "node_id", "version"],
+    // Reset created_at on conflict too: SQLite's INSERT OR REPLACE deletes+
+    // reinserts (created_at → now), so mirror that on Postgres — otherwise a
+    // draft edited in place would keep its original (import-time) "edited at".
+    `content_hash = excluded.content_hash, author = excluded.author, status = excluded.status, change_note = excluded.change_note, tags_json = excluded.tags_json, created_at = ${nowExpr(db)}`
+  );
+  await db.run(sql, [
+    params.nestId,
+    params.nodeId,
+    params.version,
+    contentHash,
+    params.author,
+    params.status,
+    params.changeNote || null,
+    params.tags ? JSON.stringify(params.tags) : null
+  ]);
+  return {
+    version: params.version,
+    content: params.content,
+    editedBy: params.author,
+    editedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    changeNote: params.changeNote,
+    status: params.status
+  };
+}
 async function getVersions(nestId, nodeId) {
   const db = getDb();
   const rows = await db.all(
@@ -172,6 +204,7 @@ export {
   SYSTEM_AUTHOR_PREFIX,
   systemAuthor,
   createVersion,
+  upsertVersion,
   getVersions,
   getVersion,
   getCurrentVersion,

package/dist/{chunk-XB7T3THE.js → chunk-PAIP5KHB.js}

@@ -2,12 +2,12 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-ZMSU7BCC.js";
+} from "./chunk-ZQS5W45U.js";
 import {
   createVersion,
   getApprovedVersion,
   setApprovedVersion
-} from "./chunk-JHIU6RZU.js";
+} from "./chunk-EG77SQHO.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -18,7 +18,7 @@ import {
   isPublicReader,
   isStewardshipEnabled,
   resolveStewardsForNode
-} from "./chunk-F7EKYNXG.js";
+} from "./chunk-Q5NRCDD4.js";
 import {
   ConflictError,
   NotFoundError,
@@ -31,7 +31,7 @@ import {
 import {
   config,
   getDb
-} from "./chunk-3M7677XW.js";
+} from "./chunk-5QQ7WKAI.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid3 } from "uuid";
@@ -1226,6 +1226,13 @@ async function getReviewQueue(params) {
     whereClauses.push("nest_id = ?");
     args.push(params.nestId);
   }
+  if (params.nestIds) {
+    if (params.nestIds.length === 0) return { requests: [], total: 0 };
+    whereClauses.push(
+      `nest_id IN (${params.nestIds.map(() => "?").join(",")})`
+    );
+    args.push(...params.nestIds);
+  }
   if (params.status) {
     const statuses = Array.isArray(params.status) ? params.status : [params.status];
     whereClauses.push(
@@ -1234,10 +1241,12 @@ async function getReviewQueue(params) {
     args.push(...statuses);
   }
   const where = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
-  const total = (await db.get(
-    `SELECT COUNT(*) as c FROM review_requests ${where}`,
-    args
-  )).c;
+  const total = Number(
+    (await db.get(
+      `SELECT COUNT(*) as c FROM review_requests ${where}`,
+      args
+    )).c
+  );
   const limit = params.limit || 50;
   const offset = params.offset || 0;
   const rows = await db.all(