@promptowl/contextnest-community 1.17.0 → 1.18.0

package/README.md

@@ -10,12 +10,12 @@
 
 ContextNest Community Edition is a self-hosted server that lets you:
 
-- Store, version, and govern markdown-based context documents ("nests")
+- Store, version, and govern markdown-based context documents ("nests"), filed in folders you can reorganize as the vault grows
 - Import an existing folder or vault of markdown files in one step
 - Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP or HTTP
+- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
 The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
@@ -99,8 +99,12 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
 | Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Folder organization — nested folders, move documents, lazy folder tree | ✅ | ✅ |
+| Scales to large vaults — nest listings served from a document index, not a disk crawl | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
+| One-shot agent setup — generated connect prompt + `.env` download | ✅ | ✅ |
+| Several API keys per account — one credential per client, rotate one at a time | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
 | Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
 | SAML / SCIM provisioning | — | ✅ |

package/dist/{chunk-UXJSO54R.js → chunk-34UXRZXD.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-SNFGU5Q7.js";
+} from "./chunk-FUUJG6XP.js";
 import {
   getDb
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -178,32 +178,76 @@ async function getNodeTags(nestId, nodeId) {
     return [];
   }
 }
+function decideDisplayStatus(hasPendingReview, current, approvedVersion) {
+  if (hasPendingReview) return "pending_review";
+  if (!current) return "draft";
+  if (current.status === "published" || current.status === "approved") {
+    if (approvedVersion === current.version) {
+      return current.status === "published" ? "published" : "approved";
+    }
+    return "draft";
+  }
+  if (current.status === "rejected") return "rejected";
+  return "draft";
+}
 async function getDisplayStatus(nestId, nodeId) {
   const db = getDb();
   const pending = await db.get(
     "SELECT 1 FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' LIMIT 1",
     [nestId, nodeId]
   );
-  if (pending) return "pending_review";
   const current = await db.get(
     `SELECT version, status FROM node_versions
        WHERE nest_id = ? AND node_id = ?
        ORDER BY version DESC LIMIT 1`,
     [nestId, nodeId]
   );
-  if (!current) return "draft";
-  if (current.status === "published" || current.status === "approved") {
-    const approved = await db.get(
-      "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
+  const approved = current && (current.status === "published" || current.status === "approved") ? await db.get(
+    "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  ) : void 0;
+  return decideDisplayStatus(!!pending, current, approved?.approved_version);
+}
+async function getDisplayStatuses(nestId) {
+  const db = getDb();
+  const [pendingRows, currentRows, approvedRows] = await Promise.all([
+    db.all(
+      "SELECT DISTINCT node_id FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [nestId]
+    ),
+    // The latest version per node, via a grouped self-join — portable across
+    // the SQLite and Postgres adapters (no window functions, no row values).
+    db.all(
+      `SELECT nv.node_id, nv.version, nv.status
+         FROM node_versions nv
+         JOIN (SELECT node_id, MAX(version) AS max_version
+                 FROM node_versions WHERE nest_id = ? GROUP BY node_id) latest
+           ON latest.node_id = nv.node_id AND latest.max_version = nv.version
+        WHERE nv.nest_id = ?`,
+      [nestId, nestId]
+    ),
+    db.all(
+      "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+      [nestId]
+    )
+  ]);
+  const pending = new Set(pendingRows.map((r) => r.node_id));
+  const approved = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const current = new Map(currentRows.map((r) => [r.node_id, r]));
+  const statuses = /* @__PURE__ */ new Map();
+  for (const nodeId of /* @__PURE__ */ new Set([...pending, ...current.keys()])) {
+    statuses.set(
+      nodeId,
+      decideDisplayStatus(
+        pending.has(nodeId),
+        current.get(nodeId),
+        approved.get(nodeId)
+      )
     );
-    if (approved?.approved_version === current.version) {
-      return current.status === "published" ? "published" : "approved";
-    }
-    return "draft";
   }
-  if (current.status === "rejected") return "rejected";
-  return "draft";
+  return statuses;
 }
 async function listMyDrafts(params) {
   if (params.nestIds.length === 0) return { drafts: [], total: 0 };
@@ -286,5 +330,6 @@ export {
   checkConflict,
   getNodeTags,
   getDisplayStatus,
+  getDisplayStatuses,
   listMyDrafts
 };

package/dist/chunk-F66VCBLA.js

@@ -0,0 +1,136 @@
+// src/auth/keys.ts
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
+import bcrypt from "bcryptjs";
+var KEY_PREFIX = "cnst_";
+var BCRYPT_ROUNDS = process.env.VITEST ? 4 : 12;
+function generateApiKey() {
+  return KEY_PREFIX + randomBytes(32).toString("hex");
+}
+function hashApiKey(key) {
+  return createHash("sha256").update(key).digest("hex");
+}
+function getKeyPrefix(key) {
+  return key.slice(0, 12) + "...";
+}
+function parseBearerToken(header) {
+  if (!header) return null;
+  const BEARER = "Bearer ";
+  if (!header.startsWith(BEARER)) return null;
+  const token = header.slice(BEARER.length);
+  if (!token.startsWith(KEY_PREFIX)) return null;
+  if (token.length < KEY_PREFIX.length + 32) return null;
+  return token;
+}
+async function hashPassword(password) {
+  return bcrypt.hash(password, BCRYPT_ROUNDS);
+}
+async function verifyPassword(password, stored) {
+  if (isBcrypt(stored)) {
+    return { ok: await bcrypt.compare(password, stored), needsRehash: false };
+  }
+  const [salt, hash] = stored.split(":");
+  if (!salt || !hash) return { ok: false, needsRehash: false };
+  const attempt = createHash("sha256").update(salt + password).digest("hex");
+  return {
+    ok: timingSafeEqualHex(hash, attempt),
+    needsRehash: true
+  };
+}
+function isBcrypt(stored) {
+  return stored.startsWith("$2a$") || stored.startsWith("$2b$") || stored.startsWith("$2y$");
+}
+function timingSafeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+var MAX_API_KEYS_PER_USER = 20;
+var MAX_LABEL_LENGTH = 60;
+async function verifyKeyRequest(db, userId, opts) {
+  const label = normalizeKeyLabel(opts.label);
+  if (label === INVALID_LABEL) {
+    return {
+      ok: false,
+      status: 400,
+      error: `Label must be a string of at most ${MAX_LABEL_LENGTH} characters.`
+    };
+  }
+  if (opts.action === "fetch") return { ok: true, label, key: null };
+  const rows = await db.all(
+    "SELECT id, key_prefix, nest_id, label, created_at, last_used_at FROM api_keys WHERE user_id = ? ORDER BY created_at ASC, id ASC",
+    [userId]
+  );
+  if (opts.action === "generate") {
+    if (rows.length >= MAX_API_KEYS_PER_USER) {
+      return {
+        ok: false,
+        status: 409,
+        error: `You already have ${MAX_API_KEYS_PER_USER} API keys. Revoke one before creating another.`
+      };
+    }
+    if (!label) {
+      return {
+        ok: false,
+        status: 400,
+        error: "Name this key so you can tell it apart later."
+      };
+    }
+    if (rows.some((r) => r.label?.trim().toLowerCase() === label.toLowerCase())) {
+      return {
+        ok: false,
+        status: 409,
+        error: `You already have a key named "${label}". Pick a different name.`
+      };
+    }
+    return { ok: true, label, key: null };
+  }
+  const renameCollides = (targetId) => !!label && rows.some(
+    (r) => r.id !== targetId && r.label?.trim().toLowerCase() === label.toLowerCase()
+  );
+  const collision = {
+    ok: false,
+    status: 409,
+    error: `You already have a key named "${label}". Pick a different name.`
+  };
+  if (opts.keyId) {
+    const match = rows.find((r) => r.id === opts.keyId);
+    if (!match) return { ok: false, status: 404, error: "Key not found" };
+    if (renameCollides(match.id)) return collision;
+    return { ok: true, label, key: match };
+  }
+  if (rows.length === 1) {
+    if (renameCollides(rows[0].id)) return collision;
+    return { ok: true, label, key: rows[0] };
+  }
+  if (rows.length === 0) {
+    return { ok: false, status: 404, error: "No API key to rotate." };
+  }
+  return {
+    ok: false,
+    status: 400,
+    error: "You have several API keys \u2014 say which one to rotate (key_id)."
+  };
+}
+var INVALID_LABEL = /* @__PURE__ */ Symbol("invalid-label");
+function normalizeKeyLabel(raw) {
+  if (raw === void 0 || raw === null || raw === "") return null;
+  if (typeof raw !== "string") return INVALID_LABEL;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed.length > MAX_LABEL_LENGTH) return INVALID_LABEL;
+  return trimmed;
+}
+
+export {
+  generateApiKey,
+  hashApiKey,
+  getKeyPrefix,
+  parseBearerToken,
+  hashPassword,
+  verifyPassword,
+  MAX_API_KEYS_PER_USER,
+  verifyKeyRequest
+};