@promptowl/contextnest-community 1.16.1 → 1.17.0

package/README.md

@@ -1,169 +1,164 @@
-# ContextNest Community Edition
-
-**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
-
-> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
-
----
-
-## What it is
-
-ContextNest Community Edition is a self-hosted server that lets you:
-
-- Store, version, and govern markdown-based context documents ("nests")
-- Import an existing folder or vault of markdown files in one step
-- Export a nest as a portable bundle and re-import it on another self-hosted host
-- Apply stewardship workflows — draft, pending review, approved
-- Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP, HTTP, or CLI
-- Sync with the PromptOwl hosted platform for multi-user collaboration
-
-The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
-
-## Quickstart
-
-```bash
-# 1. Run the community server
-npx @promptowl/contextnest-community
-
-# 2. Open the server in your browser
-#    http://localhost:3838
-#    On first boot with no license, it lands on the License Setup Page.
-
-# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
-```
-
-The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
-
-> **Optional:** scaffold a local nest with the open-source CLI before connecting:
-> ```bash
-> npx @promptowl/contextnest-cli init
-> ```
-
-## License setup
-
-ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
-
-### 1. Create the key (free)
-
-1. Sign up or log in at <https://app.promptowl.ai>
-2. Open the **Overview** menu → **Community License**
-3. Click **Create a Community License key**
-4. Copy the generated key — it starts with `pk_`
-
-### 2. Activate the server
-
-Pick **one** of two ways:
-
-**A. Browser setup page (recommended for first run)**
-
-1. Start the server: `npx @promptowl/contextnest-community`
-2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
-3. Paste your `pk_...` key and submit
-4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
-
-**B. Environment variable (recommended for Docker / CI / scripted deploys)**
-
-```bash
-PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
-```
-
-The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
-
-### 3. How licensing behaves at runtime
-
-- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
-- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
-- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
-
-For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
-
-## System requirements
-
-- **Node.js** 20.x or later
-- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
-- **OS:** Windows, macOS, or Linux
-- **Disk:** ~200 MB for the server, plus storage for your nests
-
-## What you get
-
-| Feature | Community Edition | Enterprise |
-|---|:---:|:---:|
-| Self-hosted context server | ✅ | ✅ |
-| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
-| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
-| Markdown + YAML frontmatter vaults | ✅ | ✅ |
-| Import existing folder / vault | ✅ | ✅ |
-| Export nest as portable bundle (.zip) | ✅ | ✅ |
-| Markdown rendering + wiki cross-linking | ✅ | ✅ |
-| External-edit detection + version diff | ✅ | ✅ |
-| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
-| Per-nest sharing + collaborators | ✅ | ✅ |
-| Public read-only nests | ✅ | ✅ |
-| Custom logo / branding | ✅ | ✅ |
-| Admin password reset + user removal (in-platform) | ✅ | ✅ |
-| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
-| Steward version revert | ✅ | ✅ |
-| MCP server for AI agents | ✅ | ✅ |
-| Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
-| SAML / SCIM provisioning | — | ✅ |
-| Audit log streaming | — | ✅ |
-| Policy transforms (redaction, summarization) | — | ✅ |
-| Priority support and SLA | — | ✅ |
-
-For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
-
-## What's new
-
-Release notes live in [CHANGELOG.md](./CHANGELOG.md).
-
-## Licensing
-
-ContextNest Community Edition is **commercial software**. It is **not open source**.
-
-**You may:**
-- Install and run the Software on devices You own or control
-- Use the Software for internal business purposes, tied to a valid PromptOwl account
-- Make backup and archival copies
-
-**You may not:**
-- Redistribute, resell, rent, lease, or sublicense the Software
-- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
-- Reverse engineer, decompile, or create derivative works
-- Use the Software to build a competing product or service
-- Remove copyright, trademark, or license notices
-
-Full license text: [LICENSE.md](./LICENSE.md)
-
-**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
-
-## Platform terms
-
-Because the Software requires a PromptOwl account, the following terms also apply to Your use:
-
-- **End User License Agreement** — <https://promptowl.ai/eula/>
-- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
-- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
-- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
-- **Disclaimer** — <https://promptowl.ai/disclaimer/>
-- **Cookie Policy** — <https://promptowl.ai/cookies/>
-
-## Support
-
-- **Documentation:** <https://promptowl.ai/contextnest/>
-- **Product questions:** <https://promptowl.ai/contact-us/>
-- **Support & bugs:** `hoot@promptowl.ai`
-- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
-
-## AI output disclaimer
-
-The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
-
----
-
-**Copyright © 2026 Promptowl LLC.** All rights reserved.
-"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
-
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+# ContextNest Community Edition
+
+**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
+
+> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
+
+---
+
+## What it is
+
+ContextNest Community Edition is a self-hosted server that lets you:
+
+- Store, version, and govern markdown-based context documents ("nests")
+- Import an existing folder or vault of markdown files in one step
+- Export a nest as a portable bundle and re-import it on another self-hosted host
+- Apply stewardship workflows — draft, pending review, approved
+- Share nests with collaborators or publish them read-only to the public
+- Serve approved context to AI agents via MCP or HTTP
+- Sync with the PromptOwl hosted platform for multi-user collaboration
+
+The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
+
+## Quickstart
+
+```bash
+# 1. Run the community server
+npx @promptowl/contextnest-community
+
+# 2. Open the server in your browser
+#    http://localhost:3838
+#    On first boot with no license, it lands on the License Setup Page.
+
+# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
+```
+
+The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+## License setup
+
+ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
+
+### 1. Create the key (free)
+
+1. Sign up or log in at <https://app.promptowl.ai>
+2. Open the **Overview** menu → **Community License**
+3. Click **Create a Community License key**
+4. Copy the generated key — it starts with `pk_`
+
+### 2. Activate the server
+
+Pick **one** of two ways:
+
+**A. Browser setup page (recommended for first run)**
+
+1. Start the server: `npx @promptowl/contextnest-community`
+2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
+3. Paste your `pk_...` key and submit
+4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
+
+**B. Environment variable (recommended for Docker / CI / scripted deploys)**
+
+```bash
+PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
+```
+
+The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
+
+### 3. How licensing behaves at runtime
+
+- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
+- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
+- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
+
+For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
+
+## System requirements
+
+- **Node.js** 20.x or later
+- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
+- **OS:** Windows, macOS, or Linux
+- **Disk:** ~200 MB for the server, plus storage for your nests
+
+## What you get
+
+| Feature | Community Edition | Enterprise |
+|---|:---:|:---:|
+| Self-hosted context server | ✅ | ✅ |
+| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
+| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
+| Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Import existing folder / vault | ✅ | ✅ |
+| Export nest as portable bundle (.zip) | ✅ | ✅ |
+| Markdown rendering + wiki cross-linking | ✅ | ✅ |
+| External-edit detection + version diff | ✅ | ✅ |
+| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| Per-nest sharing + collaborators | ✅ | ✅ |
+| Public read-only nests | ✅ | ✅ |
+| Custom logo / branding | ✅ | ✅ |
+| Admin password reset + user removal (in-platform) | ✅ | ✅ |
+| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Steward version revert | ✅ | ✅ |
+| MCP server for AI agents | ✅ | ✅ |
+| Centralized multi-tenant admin console | — | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| SAML / SCIM provisioning | — | ✅ |
+| Audit log streaming | — | ✅ |
+| Policy transforms (redaction, summarization) | — | ✅ |
+| Priority support and SLA | — | ✅ |
+
+For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
+
+## What's new
+
+Release notes live in [CHANGELOG.md](./CHANGELOG.md).
+
+## Licensing
+
+ContextNest Community Edition is **commercial software**. It is **not open source**.
+
+**You may:**
+- Install and run the Software on devices You own or control
+- Use the Software for internal business purposes, tied to a valid PromptOwl account
+- Make backup and archival copies
+
+**You may not:**
+- Redistribute, resell, rent, lease, or sublicense the Software
+- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
+- Reverse engineer, decompile, or create derivative works
+- Use the Software to build a competing product or service
+- Remove copyright, trademark, or license notices
+
+Full license text: [LICENSE.md](./LICENSE.md)
+
+**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
+
+## Platform terms
+
+Because the Software requires a PromptOwl account, the following terms also apply to Your use:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+## Support
+
+- **Documentation:** <https://promptowl.ai/contextnest/>
+- **Product questions:** <https://promptowl.ai/contact-us/>
+- **Support & bugs:** `hoot@promptowl.ai`
+- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
+
+## AI output disclaimer
+
+The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
+
+---
+
+**Copyright © 2026 Promptowl LLC.** All rights reserved.
+"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
+
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-QJVRZT6M.js → chunk-4YGJSUJC.js}

@@ -2,19 +2,19 @@ import {
   grantCoversNode,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-OTGZQZKK.js";
+} from "./chunk-HWDPCPYT.js";
 import {
   createVersion,
   getApprovedVersion,
   getApprovedVersions,
   getCurrentVersion,
   setApprovedVersion
-} from "./chunk-D6HICFVW.js";
+} from "./chunk-UXJSO54R.js";
 import {
   canUserAccess,
   canUserApprove,
   resolveStewardsForNode
-} from "./chunk-CLKZZZS2.js";
+} from "./chunk-YF4OFT2V.js";
 import {
   buildDocContext,
   buildTitleMap,
@@ -29,9 +29,10 @@ import {
   nowExpr,
   opContext,
   prettyFolderPath,
+  resolveNestPermission,
   sendEmailToRecipient,
   titleForNode
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-SNFGU5Q7.js";
 import {
   ConflictError,
   NotFoundError,
@@ -225,13 +226,31 @@ async function canReadNode(nestId, nodeId, userId, userEmail) {
   if ((await canUserAccess(nestId, nodeId, userEmail)).allowed) return true;
   return await resolveNodeGrant(nestId, userId, nodeId) !== null;
 }
+async function canRequestDeletion(params) {
+  const { nestId, userId, userEmail, nodeId } = params;
+  const permission = params.permission ?? await resolveNestPermission(nestId, userId);
+  if (permission === "owner" || permission === "admin" || permission === "write") {
+    return true;
+  }
+  const resolved = await resolveStewardsForNode(nestId, nodeId);
+  const isEditorSteward = resolved.some(
+    (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase() && r.steward.role === "editor" && (nodeId !== "" || r.steward.scope === "nest")
+  );
+  if (isEditorSteward) return true;
+  if (nodeId === "") return false;
+  return await resolveNodeGrant(nestId, userId, nodeId) === "write";
+}
 async function filterAccessible(nestId, userId, userEmail, nodes, approvedVersions) {
   if (await isPublicReader(nestId, userId)) {
     const approved = approvedVersions ?? await getApprovedVersions(nestId);
     return nodes.filter((n) => approved.has(n.id));
   }
-  if (!await isStewardshipEnabled(nestId)) return nodes;
   const grants = await listUserGrants(nestId, userId);
+  if (!await isStewardshipEnabled(nestId)) {
+    if (grants.length === 0) return nodes;
+    if (await resolveNestPermission(nestId, userId) !== "none") return nodes;
+    return nodes.filter((n) => grantCoversNode(grants, n.id));
+  }
   const accessible = [];
   for (const n of nodes) {
     if ((await canUserAccess(nestId, n.id, userEmail)).allowed || grantCoversNode(grants, n.id)) {
@@ -1477,6 +1496,15 @@ async function listDeletionRequests(params) {
 async function dropDeletionRequest(id) {
   await getDb().run("DELETE FROM deletion_requests WHERE id = ?", [id]);
 }
+async function withdrawDeletionRequest(params) {
+  const db = getDb();
+  const pending = await getDeletionRequest(params.id);
+  if (!pending || pending.nestId !== params.nestId || pending.status !== "pending" || pending.requestedBy.toLowerCase() !== params.withdrawnBy.toLowerCase()) {
+    return null;
+  }
+  await db.run("DELETE FROM deletion_requests WHERE id = ?", [params.id]);
+  return pending;
+}
 async function declineDeletion(params) {
   const db = getDb();
   const pending = await getDeletionRequest(params.id);
@@ -1556,6 +1584,7 @@ export {
   markNotificationsRead,
   resolveCallerEmail,
   canReadNode,
+  canRequestDeletion,
   filterAccessible,
   safeJson,
   requireWorkflowPlane,
@@ -1586,5 +1615,6 @@ export {
   getDeletionRequest,
   listDeletionRequests,
   dropDeletionRequest,
+  withdrawDeletionRequest,
   declineDeletion
 };

package/dist/{chunk-OTGZQZKK.js → chunk-HWDPCPYT.js}

@@ -22,14 +22,6 @@ async function resolveNodeGrant(nestId, userId, nodeId) {
   }
   return best;
 }
-async function hasAnyGrant(nestId, userId) {
-  if (!userId) return false;
-  const row = await getDb().get(
-    "SELECT 1 AS x FROM grants WHERE nest_id = ? AND user_id = ? LIMIT 1",
-    [nestId, userId]
-  );
-  return !!row;
-}
 async function listUserGrants(nestId, userId) {
   if (!userId) return [];
   return await getDb().all(
@@ -42,6 +34,15 @@ function grantCoversNode(grants, nodeId) {
     (g) => nodeId === g.target || nodeId.startsWith(g.target + "/")
   );
 }
+function grantRoleForNode(grants, nodeId) {
+  let best = null;
+  for (const g of grants) {
+    if (nodeId === g.target || nodeId.startsWith(g.target + "/")) {
+      if (!best || rank(g.role) > rank(best)) best = g.role;
+    }
+  }
+  return best;
+}
 async function createGrant(params) {
   const { nestId, targetType, target, userId, role, grantedBy } = params;
   if (!["document", "folder"].includes(targetType)) {
@@ -94,9 +95,9 @@ async function deleteGrant(nestId, id) {
 
 export {
   resolveNodeGrant,
-  hasAnyGrant,
   listUserGrants,
   grantCoversNode,
+  grantRoleForNode,
   createGrant,
   listGrants,
   deleteGrant