@promptowl/contextnest-community 1.16.1 → 1.18.0

package/README.md

@@ -1,169 +1,168 @@
-# ContextNest Community Edition
-
-**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
-
-> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
-
----
-
-## What it is
-
-ContextNest Community Edition is a self-hosted server that lets you:
-
-- Store, version, and govern markdown-based context documents ("nests")
-- Import an existing folder or vault of markdown files in one step
-- Export a nest as a portable bundle and re-import it on another self-hosted host
-- Apply stewardship workflows — draft, pending review, approved
-- Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP, HTTP, or CLI
-- Sync with the PromptOwl hosted platform for multi-user collaboration
-
-The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
-
-## Quickstart
-
-```bash
-# 1. Run the community server
-npx @promptowl/contextnest-community
-
-# 2. Open the server in your browser
-#    http://localhost:3838
-#    On first boot with no license, it lands on the License Setup Page.
-
-# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
-```
-
-The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
-
-> **Optional:** scaffold a local nest with the open-source CLI before connecting:
-> ```bash
-> npx @promptowl/contextnest-cli init
-> ```
-
-## License setup
-
-ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
-
-### 1. Create the key (free)
-
-1. Sign up or log in at <https://app.promptowl.ai>
-2. Open the **Overview** menu → **Community License**
-3. Click **Create a Community License key**
-4. Copy the generated key — it starts with `pk_`
-
-### 2. Activate the server
-
-Pick **one** of two ways:
-
-**A. Browser setup page (recommended for first run)**
-
-1. Start the server: `npx @promptowl/contextnest-community`
-2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
-3. Paste your `pk_...` key and submit
-4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
-
-**B. Environment variable (recommended for Docker / CI / scripted deploys)**
-
-```bash
-PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
-```
-
-The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
-
-### 3. How licensing behaves at runtime
-
-- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
-- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
-- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
-
-For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
-
-## System requirements
-
-- **Node.js** 20.x or later
-- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
-- **OS:** Windows, macOS, or Linux
-- **Disk:** ~200 MB for the server, plus storage for your nests
-
-## What you get
-
-| Feature | Community Edition | Enterprise |
-|---|:---:|:---:|
-| Self-hosted context server | ✅ | ✅ |
-| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
-| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
-| Markdown + YAML frontmatter vaults | ✅ | ✅ |
-| Import existing folder / vault | ✅ | ✅ |
-| Export nest as portable bundle (.zip) | ✅ | ✅ |
-| Markdown rendering + wiki cross-linking | ✅ | ✅ |
-| External-edit detection + version diff | ✅ | ✅ |
-| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
-| Per-nest sharing + collaborators | ✅ | ✅ |
-| Public read-only nests | ✅ | ✅ |
-| Custom logo / branding | ✅ | ✅ |
-| Admin password reset + user removal (in-platform) | ✅ | ✅ |
-| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
-| Steward version revert | ✅ | ✅ |
-| MCP server for AI agents | ✅ | ✅ |
-| Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
-| SAML / SCIM provisioning | — | ✅ |
-| Audit log streaming | — | ✅ |
-| Policy transforms (redaction, summarization) | — | ✅ |
-| Priority support and SLA | — | ✅ |
-
-For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
-
-## What's new
-
-Release notes live in [CHANGELOG.md](./CHANGELOG.md).
-
-## Licensing
-
-ContextNest Community Edition is **commercial software**. It is **not open source**.
-
-**You may:**
-- Install and run the Software on devices You own or control
-- Use the Software for internal business purposes, tied to a valid PromptOwl account
-- Make backup and archival copies
-
-**You may not:**
-- Redistribute, resell, rent, lease, or sublicense the Software
-- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
-- Reverse engineer, decompile, or create derivative works
-- Use the Software to build a competing product or service
-- Remove copyright, trademark, or license notices
-
-Full license text: [LICENSE.md](./LICENSE.md)
-
-**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
-
-## Platform terms
-
-Because the Software requires a PromptOwl account, the following terms also apply to Your use:
-
-- **End User License Agreement** — <https://promptowl.ai/eula/>
-- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
-- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
-- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
-- **Disclaimer** — <https://promptowl.ai/disclaimer/>
-- **Cookie Policy** — <https://promptowl.ai/cookies/>
-
-## Support
-
-- **Documentation:** <https://promptowl.ai/contextnest/>
-- **Product questions:** <https://promptowl.ai/contact-us/>
-- **Support & bugs:** `hoot@promptowl.ai`
-- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
-
-## AI output disclaimer
-
-The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
-
----
-
-**Copyright © 2026 Promptowl LLC.** All rights reserved.
-"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
-
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+# ContextNest Community Edition
+
+**Self-hosted context governance server for AI workflows.** Part of the [PromptOwl](https://promptowl.ai) platform.
+
+> ⚠️ **Commercial Software.** ContextNest Community Edition is proprietary software licensed by Promptowl LLC. A free [PromptOwl account](https://app.promptowl.ai) is required to use it. Redistribution, hosting-as-a-service, and competitive use are prohibited. See [LICENSE.md](./LICENSE.md) for full terms.
+
+---
+
+## What it is
+
+ContextNest Community Edition is a self-hosted server that lets you:
+
+- Store, version, and govern markdown-based context documents ("nests"), filed in folders you can reorganize as the vault grows
+- Import an existing folder or vault of markdown files in one step
+- Export a nest as a portable bundle and re-import it on another self-hosted host
+- Apply stewardship workflows — draft, pending review, approved
+- Share nests with collaborators or publish them read-only to the public
+- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`
+- Sync with the PromptOwl hosted platform for multi-user collaboration
+
+The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
+
+## Quickstart
+
+```bash
+# 1. Run the community server
+npx @promptowl/contextnest-community
+
+# 2. Open the server in your browser
+#    http://localhost:3838
+#    On first boot with no license, it lands on the License Setup Page.
+
+# 3. Paste your PromptOwl license key (pk_...) — see "License setup" below
+```
+
+The server listens on `http://localhost:3838` by default. Without a valid license the server still runs and serves reads, but write actions return `503` until you activate. See [CONFIGURATION.md](./CONFIGURATION.md) for all environment variables (port, auth mode, storage, telemetry).
+
+## License setup
+
+ContextNest Community Edition requires a PromptOwl Community License key (`pk_...`). Getting and activating one:
+
+### 1. Create the key (free)
+
+1. Sign up or log in at <https://app.promptowl.ai>
+2. Open the **Overview** menu → **Community License**
+3. Click **Create a Community License key**
+4. Copy the generated key — it starts with `pk_`
+
+### 2. Activate the server
+
+Pick **one** of two ways:
+
+**A. Browser setup page (recommended for first run)**
+
+1. Start the server: `npx @promptowl/contextnest-community`
+2. Open <http://localhost:3838> — with no license installed, the server boots into **setup mode** and shows the **License Setup Page**
+3. Paste your `pk_...` key and submit
+4. The server validates it against PromptOwl, writes it to your `.env`, and exits setup mode — no restart needed
+
+**B. Environment variable (recommended for Docker / CI / scripted deploys)**
+
+```bash
+PROMPTOWL_KEY=pk_... npx @promptowl/contextnest-community
+```
+
+The key is read at boot. The server validates against PromptOwl on startup; if valid, it goes straight into licensed mode.
+
+### 3. How licensing behaves at runtime
+
+- **Unlicensed / setup mode** — reads work; every non-GET (write) request returns `503` until a valid key is installed.
+- **Live revocation** — a long-poll watcher tracks license state against PromptOwl. If your key is revoked, the server blocks writes within seconds (no restart required) and returns to setup mode.
+- **Admin identity follows the license** — the admin user is whichever PromptOwl account owns the installed key, resolved live per request. Transferring the license to another account immediately promotes the new owner and demotes the old one.
+
+For redistribution, hosted-service, OEM, or regulated-industry licensing, contact **hoot@promptowl.ai**.
+
+## System requirements
+
+- **Node.js** 20.x or later
+- **PromptOwl account** — free signup at <https://app.promptowl.ai/signup>
+- **OS:** Windows, macOS, or Linux
+- **Disk:** ~200 MB for the server, plus storage for your nests
+
+## What you get
+
+| Feature | Community Edition | Enterprise |
+|---|:---:|:---:|
+| Self-hosted context server | ✅ | ✅ |
+| SQLite or PostgreSQL / Cloud SQL backend | ✅ | ✅ |
+| Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
+| Markdown + YAML frontmatter vaults | ✅ | ✅ |
+| Import existing folder / vault | ✅ | ✅ |
+| Export nest as portable bundle (.zip) | ✅ | ✅ |
+| Markdown rendering + wiki cross-linking | ✅ | ✅ |
+| External-edit detection + version diff | ✅ | ✅ |
+| Stewardship workflow (draft/review/approve) | ✅ | ✅ |
+| Per-nest sharing + collaborators | ✅ | ✅ |
+| Public read-only nests | ✅ | ✅ |
+| Custom logo / branding | ✅ | ✅ |
+| Admin password reset + user removal (in-platform) | ✅ | ✅ |
+| Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Folder organization — nested folders, move documents, lazy folder tree | ✅ | ✅ |
+| Scales to large vaults — nest listings served from a document index, not a disk crawl | ✅ | ✅ |
+| Steward version revert | ✅ | ✅ |
+| MCP server for AI agents | ✅ | ✅ |
+| One-shot agent setup — generated connect prompt + `.env` download | ✅ | ✅ |
+| Several API keys per account — one credential per client, rotate one at a time | ✅ | ✅ |
+| Centralized multi-tenant admin console | — | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| SAML / SCIM provisioning | — | ✅ |
+| Audit log streaming | — | ✅ |
+| Policy transforms (redaction, summarization) | — | ✅ |
+| Priority support and SLA | — | ✅ |
+
+For Enterprise pricing and features, contact **hoot@promptowl.ai** or visit <https://promptowl.ai/contextnest/>.
+
+## What's new
+
+Release notes live in [CHANGELOG.md](./CHANGELOG.md).
+
+## Licensing
+
+ContextNest Community Edition is **commercial software**. It is **not open source**.
+
+**You may:**
+- Install and run the Software on devices You own or control
+- Use the Software for internal business purposes, tied to a valid PromptOwl account
+- Make backup and archival copies
+
+**You may not:**
+- Redistribute, resell, rent, lease, or sublicense the Software
+- Offer the Software as a hosted, managed, or software-as-a-service product to third parties
+- Reverse engineer, decompile, or create derivative works
+- Use the Software to build a competing product or service
+- Remove copyright, trademark, or license notices
+
+Full license text: [LICENSE.md](./LICENSE.md)
+
+**For redistribution, hosted-service, OEM, or regulated-industry use,** contact **hoot@promptowl.ai** for a commercial license agreement.
+
+## Platform terms
+
+Because the Software requires a PromptOwl account, the following terms also apply to Your use:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+## Support
+
+- **Documentation:** <https://promptowl.ai/contextnest/>
+- **Product questions:** <https://promptowl.ai/contact-us/>
+- **Support & bugs:** `hoot@promptowl.ai`
+- **Commercial licensing:** `hoot@promptowl.ai` (subject: *ContextNest Commercial License*)
+
+## AI output disclaimer
+
+The Software injects content into large language models. AI output may be inaccurate, incomplete, or inappropriate for your use case. You are responsible for reviewing and validating any AI-generated content before relying on it, particularly in business-critical or regulated contexts. Do not deploy the Software in medical, legal, financial-advisory, or safety-critical environments without appropriate human oversight.
+
+---
+
+**Copyright © 2026 Promptowl LLC.** All rights reserved.
+"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
+
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-D6HICFVW.js → chunk-34UXRZXD.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-L7UCMGWZ.js";
+} from "./chunk-FUUJG6XP.js";
 import {
   getDb
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -178,32 +178,76 @@ async function getNodeTags(nestId, nodeId) {
     return [];
   }
 }
+function decideDisplayStatus(hasPendingReview, current, approvedVersion) {
+  if (hasPendingReview) return "pending_review";
+  if (!current) return "draft";
+  if (current.status === "published" || current.status === "approved") {
+    if (approvedVersion === current.version) {
+      return current.status === "published" ? "published" : "approved";
+    }
+    return "draft";
+  }
+  if (current.status === "rejected") return "rejected";
+  return "draft";
+}
 async function getDisplayStatus(nestId, nodeId) {
   const db = getDb();
   const pending = await db.get(
     "SELECT 1 FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' LIMIT 1",
     [nestId, nodeId]
   );
-  if (pending) return "pending_review";
   const current = await db.get(
     `SELECT version, status FROM node_versions
        WHERE nest_id = ? AND node_id = ?
        ORDER BY version DESC LIMIT 1`,
     [nestId, nodeId]
   );
-  if (!current) return "draft";
-  if (current.status === "published" || current.status === "approved") {
-    const approved = await db.get(
-      "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
+  const approved = current && (current.status === "published" || current.status === "approved") ? await db.get(
+    "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  ) : void 0;
+  return decideDisplayStatus(!!pending, current, approved?.approved_version);
+}
+async function getDisplayStatuses(nestId) {
+  const db = getDb();
+  const [pendingRows, currentRows, approvedRows] = await Promise.all([
+    db.all(
+      "SELECT DISTINCT node_id FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [nestId]
+    ),
+    // The latest version per node, via a grouped self-join — portable across
+    // the SQLite and Postgres adapters (no window functions, no row values).
+    db.all(
+      `SELECT nv.node_id, nv.version, nv.status
+         FROM node_versions nv
+         JOIN (SELECT node_id, MAX(version) AS max_version
+                 FROM node_versions WHERE nest_id = ? GROUP BY node_id) latest
+           ON latest.node_id = nv.node_id AND latest.max_version = nv.version
+        WHERE nv.nest_id = ?`,
+      [nestId, nestId]
+    ),
+    db.all(
+      "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+      [nestId]
+    )
+  ]);
+  const pending = new Set(pendingRows.map((r) => r.node_id));
+  const approved = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const current = new Map(currentRows.map((r) => [r.node_id, r]));
+  const statuses = /* @__PURE__ */ new Map();
+  for (const nodeId of /* @__PURE__ */ new Set([...pending, ...current.keys()])) {
+    statuses.set(
+      nodeId,
+      decideDisplayStatus(
+        pending.has(nodeId),
+        current.get(nodeId),
+        approved.get(nodeId)
+      )
     );
-    if (approved?.approved_version === current.version) {
-      return current.status === "published" ? "published" : "approved";
-    }
-    return "draft";
   }
-  if (current.status === "rejected") return "rejected";
-  return "draft";
+  return statuses;
 }
 async function listMyDrafts(params) {
   if (params.nestIds.length === 0) return { drafts: [], total: 0 };
@@ -286,5 +330,6 @@ export {
   checkConflict,
   getNodeTags,
   getDisplayStatus,
+  getDisplayStatuses,
   listMyDrafts
 };

package/dist/chunk-F66VCBLA.js

@@ -0,0 +1,136 @@
+// src/auth/keys.ts
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
+import bcrypt from "bcryptjs";
+var KEY_PREFIX = "cnst_";
+var BCRYPT_ROUNDS = process.env.VITEST ? 4 : 12;
+function generateApiKey() {
+  return KEY_PREFIX + randomBytes(32).toString("hex");
+}
+function hashApiKey(key) {
+  return createHash("sha256").update(key).digest("hex");
+}
+function getKeyPrefix(key) {
+  return key.slice(0, 12) + "...";
+}
+function parseBearerToken(header) {
+  if (!header) return null;
+  const BEARER = "Bearer ";
+  if (!header.startsWith(BEARER)) return null;
+  const token = header.slice(BEARER.length);
+  if (!token.startsWith(KEY_PREFIX)) return null;
+  if (token.length < KEY_PREFIX.length + 32) return null;
+  return token;
+}
+async function hashPassword(password) {
+  return bcrypt.hash(password, BCRYPT_ROUNDS);
+}
+async function verifyPassword(password, stored) {
+  if (isBcrypt(stored)) {
+    return { ok: await bcrypt.compare(password, stored), needsRehash: false };
+  }
+  const [salt, hash] = stored.split(":");
+  if (!salt || !hash) return { ok: false, needsRehash: false };
+  const attempt = createHash("sha256").update(salt + password).digest("hex");
+  return {
+    ok: timingSafeEqualHex(hash, attempt),
+    needsRehash: true
+  };
+}
+function isBcrypt(stored) {
+  return stored.startsWith("$2a$") || stored.startsWith("$2b$") || stored.startsWith("$2y$");
+}
+function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+var MAX_API_KEYS_PER_USER = 20;
+var MAX_LABEL_LENGTH = 60;
+async function verifyKeyRequest(db, userId, opts) {
+  const label = normalizeKeyLabel(opts.label);
+  if (label === INVALID_LABEL) {
+    return {
+      ok: false,
+      status: 400,
+      error: `Label must be a string of at most ${MAX_LABEL_LENGTH} characters.`
+    };
+  }
+  if (opts.action === "fetch") return { ok: true, label, key: null };
+  const rows = await db.all(
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ? ORDER BY created_at ASC, id ASC",
+    [userId]
+  );
+  if (opts.action === "generate") {
+    if (rows.length >= MAX_API_KEYS_PER_USER) {
+      return {
+        ok: false,
+        status: 409,
+        error: `You already have ${MAX_API_KEYS_PER_USER} API keys. Revoke one before creating another.`
+      };
+    }
+    if (!label) {
+      return {
+        ok: false,
+        status: 400,
+        error: "Name this key so you can tell it apart later."
+      };
+    }
+    if (rows.some((r) => r.label?.trim().toLowerCase() === label.toLowerCase())) {
+      return {
+        ok: false,
+        status: 409,
+        error: `You already have a key named "${label}". Pick a different name.`
+      };
+    }
+    return { ok: true, label, key: null };
+  }
+  const renameCollides = (targetId) => !!label && rows.some(
+    (r) => r.id !== targetId && r.label?.trim().toLowerCase() === label.toLowerCase()
+  );
+  const collision = {
+    ok: false,
+    status: 409,
+    error: `You already have a key named "${label}". Pick a different name.`
+  };
+  if (opts.keyId) {
+    const match = rows.find((r) => r.id === opts.keyId);
+    if (!match) return { ok: false, status: 404, error: "Key not found" };
+    if (renameCollides(match.id)) return collision;
+    return { ok: true, label, key: match };
+  }
+  if (rows.length === 1) {
+    if (renameCollides(rows[0].id)) return collision;
+    return { ok: true, label, key: rows[0] };
+  }
+  if (rows.length === 0) {
+    return { ok: false, status: 404, error: "No API key to rotate." };
+  }
+  return {
+    ok: false,
+    status: 400,
+    error: "You have several API keys \u2014 say which one to rotate (key_id)."
+  };
+}
+var INVALID_LABEL = /* @__PURE__ */ Symbol("invalid-label");
+function normalizeKeyLabel(raw) {
+  if (raw === void 0 || raw === null || raw === "") return null;
+  if (typeof raw !== "string") return INVALID_LABEL;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed.length > MAX_LABEL_LENGTH) return INVALID_LABEL;
+  return trimmed;
+}
+
+export {
+  generateApiKey,
+  hashApiKey,
+  getKeyPrefix,
+  parseBearerToken,
+  hashPassword,
+  verifyPassword,
+  MAX_API_KEYS_PER_USER,
+  verifyKeyRequest
+};