@promptowl/contextnest-community 1.17.0 → 1.19.0

package/CONFIGURATION.md

@@ -60,7 +60,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
 | `MANUAL_SIGN_IN` | `open` | Email + password sign-in mode. `open` = anyone may log in and self-register a new account; `invite-only` = existing/invited users may log in but brand-new self-registration returns `403` (the admin provisions accounts via invite/share/steward and shares the password — there is no self-service "set password", which would be account takeover without email verification); `disabled` = no email/password sign-in at all (`POST /auth/login` and `POST /auth/register` return `403`). Independent of `PROMPTOWL_SIGN_IN_GATE`, so the two methods are controlled separately (e.g. `invite-only` manual + `admin-only` PromptOwl). Also settable from Settings → General. The server refuses `disabled` while PromptOwl sign-in is also `disabled` (that would leave no way to log in). Unknown values fall back to `open`. |
 | `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
-| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Two uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — only when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Three uses. (1) Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another — only when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. (2) **Set this whenever `OIDC_ENABLED=true`.** It's the base for the OIDC `redirect_uri` sent to your IdP and replayed at token exchange. Unset, that URI is derived from the incoming request's `Host` header — fine when your proxy overwrites `Host` with a trusted value, but a proxy that passes an attacker-supplied `Host` through would feed it straight into the redirect URI. Setting this pins the value regardless of what the proxy forwards. (Your IdP's own redirect-URI allowlist is a second line of defence, not a substitute.) (3) **Set this wherever `POST /nests/:id/context` citations reach users.** The `url` on each node and the `_source:` line in each context block are built from it; unset, they fall back to the request origin, so a proxy forwarding an untrusted `Host` would put an attacker-influenced URL in front of both the model and the reader as a trustworthy citation. |
 | `OIDC_ENABLED` | `false` | Turn on generic OIDC single sign-on (`GET /auth/oidc/login` / `GET /auth/oidc/callback`). Requires `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET` — the login-page button only appears once all three are set. Also editable from Settings → Single sign-on. See [Single sign-on (OIDC)](#single-sign-on-oidc). |
 | `OIDC_ISSUER` | `""` | OIDC issuer URL, e.g. `https://login.microsoftonline.com/<tenant>/v2.0` (Microsoft Entra ID) or `https://accounts.google.com` (Google). **`https://` only** — a non-https value is rejected with a warning and SSO stays off. Must serve `<issuer>/.well-known/openid-configuration`. |
 | `OIDC_CLIENT_ID` | `""` | Application (client) ID from your IdP app registration. |

package/README.md

@@ -10,12 +10,12 @@
 
 ContextNest Community Edition is a self-hosted server that lets you:
 
-- Store, version, and govern markdown-based context documents ("nests")
+- Store, version, and govern markdown-based context documents ("nests"), filed in folders you can reorganize as the vault grows
 - Import an existing folder or vault of markdown files in one step
 - Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
-- Serve approved context to AI agents via MCP or HTTP
+- Serve approved context to AI agents via MCP or HTTP — connect one by pasting a generated setup prompt or downloading a ready `.env`
 - Sync with the PromptOwl hosted platform for multi-user collaboration
 
 The server runs locally or on your own infrastructure. Your PromptOwl account handles authentication, entitlement, and governance metadata.
@@ -99,8 +99,12 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
 | Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Folder organization — nested folders, move documents, lazy folder tree | ✅ | ✅ |
+| Scales to large vaults — nest listings served from a document index, not a disk crawl | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |
 | MCP server for AI agents | ✅ | ✅ |
+| One-shot agent setup — generated connect prompt + `.env` download | ✅ | ✅ |
+| Several API keys per account — one credential per client, rotate one at a time | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
 | Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
 | SAML / SCIM provisioning | — | ✅ |

package/dist/{chunk-YF4OFT2V.js → chunk-3GMGLYTZ.js}

@@ -11,16 +11,16 @@ import {
   resolveNestPermission,
   resolveTeamRolesForUser,
   sendEmailToRecipient
-} from "./chunk-SNFGU5Q7.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-GUNJTORH.js";
+} from "./chunk-YVMSM7LS.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -229,7 +229,7 @@ async function createStewardRecord(params) {
     );
     let userId = userRow?.id;
     if (!userId) {
-      const { hashPassword } = await import("./keys-73STFJJB.js");
+      const { hashPassword } = await import("./keys-CTOGAG3W.js");
       userId = uuid();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
@@ -389,7 +389,7 @@ async function resolveGrantRoles(nestId, userEmail, userId) {
     )
   ];
 }
-async function resolveUserRoles(nestId, userEmail, opts) {
+async function resolveNestWideRoles(nestId, userEmail) {
   const roles = /* @__PURE__ */ new Set();
   if (isSuperAdmin(userEmail)) roles.add("admin");
   const owner = await getNestOwnerEmail(nestId);
@@ -404,6 +404,35 @@ async function resolveUserRoles(nestId, userEmail, opts) {
       roles.add(role);
     }
   }
+  return [...roles];
+}
+async function stewardCoverageForUser(nestId, userEmail) {
+  const db = getDb();
+  const rows = await db.all(
+    `SELECT scope, node_pattern, tag_name FROM stewards
+       WHERE nest_id = ? AND is_active = 1 AND LOWER(user_email) = LOWER(?)`,
+    [nestId, userEmail]
+  );
+  const nodeIds = /* @__PURE__ */ new Set();
+  const tags = [];
+  for (const r of rows) {
+    if (r.scope === "nest") return { nestWide: true, nodeIds };
+    if (r.scope === "document" && r.node_pattern) nodeIds.add(r.node_pattern);
+    else if (r.scope === "tag" && r.tag_name) tags.push(r.tag_name);
+  }
+  if (tags.length) {
+    const placeholders = tags.map(() => "?").join(", ");
+    const tagged = await db.all(
+      `SELECT DISTINCT node_id FROM node_tag_index
+         WHERE nest_id = ? AND tag_name IN (${placeholders})`,
+      [nestId, ...tags]
+    );
+    for (const t of tagged) nodeIds.add(t.node_id);
+  }
+  return { nestWide: false, nodeIds };
+}
+async function resolveUserRoles(nestId, userEmail, opts) {
+  const roles = new Set(await resolveNestWideRoles(nestId, userEmail));
   const stewardRoles = opts?.nodeId ? (await resolveStewardsForNode(nestId, opts.nodeId)).filter(
     (r) => r.steward.userEmail.toLowerCase() === userEmail.toLowerCase()
   ).map((r) => r.steward.role) : await getStewardRolesForUser(nestId, userEmail);
@@ -614,6 +643,8 @@ export {
   getStewardsForUser,
   getCollaboratorRole,
   resolveGrantRoles,
+  resolveNestWideRoles,
+  stewardCoverageForUser,
   resolveUserRoles,
   canManageStewards,
   canCreateInNest,

package/dist/{chunk-UXJSO54R.js → chunk-BXUVIAMP.js}

@@ -2,10 +2,10 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-SNFGU5Q7.js";
+} from "./chunk-ENDHMQPD.js";
 import {
   getDb
-} from "./chunk-JMJLNEXE.js";
+} from "./chunk-HYSTFMFG.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -178,32 +178,76 @@ async function getNodeTags(nestId, nodeId) {
     return [];
   }
 }
+function decideDisplayStatus(hasPendingReview, current, approvedVersion) {
+  if (hasPendingReview) return "pending_review";
+  if (!current) return "draft";
+  if (current.status === "published" || current.status === "approved") {
+    if (approvedVersion === current.version) {
+      return current.status === "published" ? "published" : "approved";
+    }
+    return "draft";
+  }
+  if (current.status === "rejected") return "rejected";
+  return "draft";
+}
 async function getDisplayStatus(nestId, nodeId) {
   const db = getDb();
   const pending = await db.get(
     "SELECT 1 FROM review_requests WHERE nest_id = ? AND node_id = ? AND status = 'pending' LIMIT 1",
     [nestId, nodeId]
   );
-  if (pending) return "pending_review";
   const current = await db.get(
     `SELECT version, status FROM node_versions
        WHERE nest_id = ? AND node_id = ?
        ORDER BY version DESC LIMIT 1`,
     [nestId, nodeId]
   );
-  if (!current) return "draft";
-  if (current.status === "published" || current.status === "approved") {
-    const approved = await db.get(
-      "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
-      [nestId, nodeId]
+  const approved = current && (current.status === "published" || current.status === "approved") ? await db.get(
+    "SELECT approved_version FROM approved_versions WHERE nest_id = ? AND node_id = ?",
+    [nestId, nodeId]
+  ) : void 0;
+  return decideDisplayStatus(!!pending, current, approved?.approved_version);
+}
+async function getDisplayStatuses(nestId) {
+  const db = getDb();
+  const [pendingRows, currentRows, approvedRows] = await Promise.all([
+    db.all(
+      "SELECT DISTINCT node_id FROM review_requests WHERE nest_id = ? AND status = 'pending'",
+      [nestId]
+    ),
+    // The latest version per node, via a grouped self-join — portable across
+    // the SQLite and Postgres adapters (no window functions, no row values).
+    db.all(
+      `SELECT nv.node_id, nv.version, nv.status
+         FROM node_versions nv
+         JOIN (SELECT node_id, MAX(version) AS max_version
+                 FROM node_versions WHERE nest_id = ? GROUP BY node_id) latest
+           ON latest.node_id = nv.node_id AND latest.max_version = nv.version
+        WHERE nv.nest_id = ?`,
+      [nestId, nestId]
+    ),
+    db.all(
+      "SELECT node_id, approved_version FROM approved_versions WHERE nest_id = ?",
+      [nestId]
+    )
+  ]);
+  const pending = new Set(pendingRows.map((r) => r.node_id));
+  const approved = new Map(
+    approvedRows.map((r) => [r.node_id, r.approved_version])
+  );
+  const current = new Map(currentRows.map((r) => [r.node_id, r]));
+  const statuses = /* @__PURE__ */ new Map();
+  for (const nodeId of /* @__PURE__ */ new Set([...pending, ...current.keys()])) {
+    statuses.set(
+      nodeId,
+      decideDisplayStatus(
+        pending.has(nodeId),
+        current.get(nodeId),
+        approved.get(nodeId)
+      )
     );
-    if (approved?.approved_version === current.version) {
-      return current.status === "published" ? "published" : "approved";
-    }
-    return "draft";
   }
-  if (current.status === "rejected") return "rejected";
-  return "draft";
+  return statuses;
 }
 async function listMyDrafts(params) {
   if (params.nestIds.length === 0) return { drafts: [], total: 0 };
@@ -286,5 +330,6 @@ export {
   checkConflict,
   getNodeTags,
   getDisplayStatus,
+  getDisplayStatuses,
   listMyDrafts
 };