@promptowl/contextnest-community 1.24.0 → 1.26.0

package/README.md

@@ -134,7 +134,7 @@ Keys are minted in the app (Workspace → API keys, or the Connect dialog) — o
 | Custom logo / branding | ✅ | ✅ |
 | Admin password reset + user removal (in-platform) | ✅ | ✅ |
 | Wiki backlinks, outline, hover-preview, link health | ✅ | ✅ |
-| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload | ✅ | ✅ |
+| Rich editor — tables, callouts, toggles, code highlight, find/replace, image & video upload, YouTube / Vimeo embeds | ✅ | ✅ |
 | Folder organization — nested folders, move documents, lazy folder tree | ✅ | ✅ |
 | Scales to large vaults — nest listings served from a document index, not a disk crawl | ✅ | ✅ |
 | Steward version revert | ✅ | ✅ |
@@ -150,7 +150,7 @@ Keys are minted in the app (Workspace → API keys, or the Connect dialog) — o
 | Activity trace — every governance action, per nest and server-wide | ✅ | ✅ |
 | Notifications — Slack, Microsoft Teams, email | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) — [admin guide](./CONFIGURATION.md#single-sign-on-oidc) | ✅ | ✅ |
 | SAML / SCIM provisioning | — | ✅ |
 | Audit log streaming | — | ✅ |
 | Policy transforms (redaction, summarization) | — | ✅ |
@@ -165,6 +165,7 @@ Release notes live in [CHANGELOG.md](./CHANGELOG.md).
 ## Documentation
 
 - [CONFIGURATION.md](./CONFIGURATION.md) — every environment variable (port, auth mode, storage, notifications, telemetry)
+- [Single sign-on admin guide](./CONFIGURATION.md#single-sign-on-oidc) — connect Microsoft Entra ID, Google, Okta, Keycloak or any OIDC provider; what happens to existing accounts, API keys and agents; every `sso_error` code with its fix
 - [API.md](./API.md) — complete REST reference with request and response bodies
 - [STEWARDSHIP.md](./STEWARDSHIP.md) — the governance model: modes, stewards, scopes, prime documents, teams, super-admins
 - `<server>/llms.txt` — the agent manual the running server publishes; rendered as **Docs** in the app
@@ -217,4 +218,4 @@ The Software injects content into large language models. AI output may be inaccu
 **Copyright © 2026 Promptowl LLC.** All rights reserved.
 "ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
 
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/STEWARDSHIP.md

@@ -90,6 +90,30 @@ Prime documents carry a **Prime** badge in the nest's document list, with a tool
 
 Flipping any of this only affects **future** writes. Marking a published document prime doesn't unpublish it; the next edit is what needs approval.
 
+## Creators review their own documents (`creator_is_reviewer`)
+
+A per-nest flag (**off** by default; nest Settings → "Creators review their own documents") for the GitHub posture: anyone with write access creates documents, and the person who created a document is the one who approves changes to it.
+
+When it's on, creating a document in a governed nest does two things:
+
+1. **The author is stewarded as a document-scope `reviewer`** of that document — exactly the row an admin would otherwise add by hand (`POST /nests/:id/stewards` with `scope: "document"`, or the `documents:` section of `stewards.yaml`). The nest owner is skipped; they already approve everything.
+2. **The first version publishes immediately.** The author is the document's reviewer, so nobody else needs to bless v1. This holds for the owner too: with this on, the owner's own new documents publish at v1 whether or not `allow_self_approve` is on — the two settings are independent, and this one only ever touches v1.
+
+The row is written **before** the publish decision, so v1 only publishes when the author really can approve the next change. If a document-scope row for the author already exists on that id with a lesser role (an admin stewarded the id ahead of time), it is left alone and v1 lands as a draft instead. If the row can't be written, the create fails with nothing written.
+
+Everything after v1 is the ordinary review cycle, and separation of duties is untouched:
+
+| | Who approves |
+|---|---|
+| A teammate edits the document | The creator (plus any tag- or nest-level reviewer, and admins) |
+| The creator edits their own document | Another reviewer — the creator can't approve their own submission |
+
+**Prime wins.** A prime document still lands as a draft: its creator is made its reviewer, but someone else has to approve the first version.
+
+Only **future** creates are affected. Turning it on doesn't steward anyone on existing documents, and turning it off leaves every steward row it created in place — remove them from the Stewards tab like any other. Every create surface participates (the editor, the REST and MCP APIs, and `ctx push` — the pusher authored what they pushed); the derived annotations document is the one exception, since nobody authored it.
+
+Like prime, this only applies to **governed** nests. With stewardship off there is nothing to review, so the flag is inert until you turn stewardship on.
+
 ## Who sees what
 
 Governance gates two things: who can **approve**, and who can **read**.

package/dist/{chunk-XUIWAWDO.js → chunk-2QOJE7A5.js}

@@ -6,10 +6,10 @@ import {
   markIndexStale,
   resolveNestPath,
   syncSuggestionRows
-} from "./chunk-KIAAEHWL.js";
+} from "./chunk-SWA5M5XX.js";
 import {
   getDb
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-TRSGPS27.js";
 
 // src/governance/external-edit-service.ts
 import { readFile, readdir } from "fs/promises";
@@ -83,7 +83,7 @@ async function scanDocumentForDriftInternal(nestId, documentId, actor) {
   if (await bodyMatchesLatestVersion(storage, documentId, drift.actualHash)) {
     return null;
   }
-  const { hasUnsealedDraft } = await import("./version-service-KIOQME6U.js");
+  const { hasUnsealedDraft } = await import("./version-service-C3JTZLJH.js");
   if (await hasUnsealedDraft(nestId, documentId)) {
     return null;
   }
@@ -254,7 +254,7 @@ async function listExternalEditVerdicts(nestId, documentId) {
 async function mirrorVersion(input) {
   const { storage } = await engineCache.get(input.nestId);
   const node = await storage.readDocument(input.documentId);
-  const { upsertVersion, setApprovedVersion } = await import("./version-service-KIOQME6U.js");
+  const { upsertVersion, setApprovedVersion } = await import("./version-service-C3JTZLJH.js");
   await upsertVersion({
     nestId: input.nestId,
     nodeId: input.documentId,

package/dist/{chunk-2TPQTN4Y.js → chunk-DGPTJXIV.js}

@@ -1,27 +1,30 @@
 import {
   buildTitleMap,
-  canEditWith,
-  canViewWith,
-  collabPermToRole,
   docLink,
   isSuperAdmin,
   nestAllowsSelfApprove,
   nestName,
-  primaryRole,
   resolveNestAccess,
   resolveNestPermission,
-  resolveTeamRolesForUser,
-  sendEmailToRecipient
-} from "./chunk-KIAAEHWL.js";
+  resolveTeamRolesForUser
+} from "./chunk-SWA5M5XX.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-YVMSM7LS.js";
+} from "./chunk-LHWOJPFE.js";
+import {
+  canApproveWith,
+  canEditWith,
+  canViewWith,
+  collabPermToRole,
+  primaryRole,
+  sendEmailToRecipient
+} from "./chunk-I5EDEZBQ.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-LA3VTQ22.js";
+} from "./chunk-TRSGPS27.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -230,12 +233,8 @@ async function createStewardRecord(params) {
     );
     let userId = userRow?.id;
     if (!userId) {
-      const { hashPassword } = await import("./keys-CTOGAG3W.js");
-      userId = uuid();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword(uuid())]
-      );
+      const { findOrCreateInvitedUser } = await import("./invited-user-AM6A3WGO.js");
+      userId = (await findOrCreateInvitedUser(email)).id;
     }
     const created = await assignSteward({
       nestId: params.nestId,
@@ -283,6 +282,38 @@ async function createStewardRecord(params) {
   }
   return results;
 }
+async function stewardDocumentCreator(nestId, nodeId, userEmail) {
+  const email = userEmail.trim().toLowerCase();
+  if (!email) return { canApprove: false };
+  const ownerEmail = (await getNestOwnerEmail(nestId) || "").toLowerCase();
+  if (email === ownerEmail) return { canApprove: true };
+  const row = {
+    nestId,
+    scope: "document",
+    nodePattern: nodeId,
+    userEmail: email,
+    userId: await userIdForEmail(email),
+    role: "reviewer",
+    assignedBy: email,
+    assignedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    isActive: true
+  };
+  try {
+    const created = await assignSteward(row);
+    return { canApprove: true, insertedId: created.id };
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+  }
+  return {
+    canApprove: canApproveWith(
+      await resolveUserRoles(nestId, email, { nodeId })
+    )
+  };
+}
+function isUniqueViolation(err) {
+  const code = err?.code;
+  return code === "SQLITE_CONSTRAINT_UNIQUE" || code === "23505";
+}
 async function resolveStewardsForNode(nestId, nodeId) {
   return (await resolve(nestId, nodeId)).stewards;
 }
@@ -638,6 +669,7 @@ export {
   getStewardsForScope,
   listStewards,
   createStewardRecord,
+  stewardDocumentCreator,
   resolveStewardsForNode,
   resolveStewardsWithFallback,
   getStewardRolesForUser,