@promptowl/contextnest-community 1.25.0 → 1.27.0

package/README.md

@@ -150,7 +150,7 @@ Keys are minted in the app (Workspace → API keys, or the Connect dialog) — o
 | Activity trace — every governance action, per nest and server-wide | ✅ | ✅ |
 | Notifications — Slack, Microsoft Teams, email | ✅ | ✅ |
 | Centralized multi-tenant admin console | — | ✅ |
-| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) | ✅ | ✅ |
+| Single sign-on (OIDC — Entra ID, Google, Okta, Keycloak) — [admin guide](./CONFIGURATION.md#single-sign-on-oidc) | ✅ | ✅ |
 | SAML / SCIM provisioning | — | ✅ |
 | Audit log streaming | — | ✅ |
 | Policy transforms (redaction, summarization) | — | ✅ |
@@ -165,6 +165,7 @@ Release notes live in [CHANGELOG.md](./CHANGELOG.md).
 ## Documentation
 
 - [CONFIGURATION.md](./CONFIGURATION.md) — every environment variable (port, auth mode, storage, notifications, telemetry)
+- [Single sign-on admin guide](./CONFIGURATION.md#single-sign-on-oidc) — connect Microsoft Entra ID, Google, Okta, Keycloak or any OIDC provider; what happens to existing accounts, API keys and agents; every `sso_error` code with its fix
 - [API.md](./API.md) — complete REST reference with request and response bodies
 - [STEWARDSHIP.md](./STEWARDSHIP.md) — the governance model: modes, stewards, scopes, prime documents, teams, super-admins
 - `<server>/llms.txt` — the agent manual the running server publishes; rendered as **Docs** in the app
@@ -217,4 +218,4 @@ The Software injects content into large language models. AI output may be inaccu
 **Copyright © 2026 Promptowl LLC.** All rights reserved.
 "ContextNest" and "PromptOwl" are trademarks of Promptowl LLC.
 
-Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA
+Promptowl LLC · 3060 Mercer University Dr Ste 110 · Atlanta, GA 30341 · USA

package/dist/{chunk-JDAOA5KP.js → chunk-H3W72HN3.js}

@@ -2,11 +2,6 @@ import {
   ANON_USER_ID
 } from "./chunk-YB3LKF7U.js";
 
-// src/db/client.ts
-import Database from "better-sqlite3";
-import { mkdirSync, readFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-
 // src/config.ts
 import { join, dirname } from "path";
 import { existsSync } from "fs";
@@ -356,6 +351,14 @@ var config = {
   get PEOPLE_SUGGEST_ALL_USERS() {
     return process.env.PEOPLE_SUGGEST_ALL_USERS === "true";
   },
+  /**
+   * Who may create nests. "admins" (default): server admins only, until the
+   * server is on a paid plan. "everyone": any signed-in user. Open mode is
+   * unaffected (everyone is admin there).
+   */
+  get NEST_CREATION() {
+    return process.env.NEST_CREATION?.trim().toLowerCase() === "everyone" ? "everyone" : "admins";
+  },
   /**
    * This server hosts several unrelated organizations (the PromptOwl-hosted
    * deployment) rather than one company (a self-hosted install).
@@ -498,6 +501,34 @@ var config = {
   get TYPE_TABLE_ENABLED() {
     return process.env.TYPE_TABLE_ENABLED !== "false";
   },
+  /**
+   * Hootie in the nest: the floating assistant on every page of the UI and
+   * its POST /nests/:id/chat route (default ON). Superadmin-editable at
+   * runtime via /admin/settings (hootie_enabled). Off → the route 404s and
+   * the launcher is hidden. Answering additionally needs the server-wide
+   * ANTHROPIC_API_KEY; without one the route answers 503, not 404 — the
+   * feature is on, it just isn't configured yet.
+   */
+  get HOOTIE_ENABLED() {
+    return process.env.HOOTIE_ENABLED !== "false";
+  },
+  /** Model Hootie answers with. Superadmin-editable at runtime via
+   *  /admin/settings (hootie_model). A gateway-side name (`ollama/…`,
+   *  `gpt-…`) is fine when ANTHROPIC_BASE_URL points at one. */
+  get HOOTIE_MODEL() {
+    return process.env.HOOTIE_MODEL || "claude-opus-5";
+  },
+  /**
+   * Where the Anthropic-shaped model calls go. Empty = Anthropic directly.
+   * Set to a LiteLLM (or PromptOwl) gateway to route Hootie AND agent runs
+   * through it — one setting: the runner honours the same variable via the
+   * run bundle's env floor. Superadmin-editable (anthropic_base_url).
+   * Never a per-user vendor key: that is the shadow-AI hole the gateway
+   * exists to close.
+   */
+  get ANTHROPIC_BASE_URL() {
+    return (process.env.ANTHROPIC_BASE_URL || "").trim().replace(/\/$/, "");
+  },
   /**
    * Sub-agent runs: lets a run spawn nested runs (an external runner calling
    * back into POST /run for a child agent). Gated SEPARATELY from the base
@@ -553,6 +584,27 @@ var config = {
     }
     return raw;
   },
+  /**
+   * Email transport: "smtp" (SMTP_URL, default) or "ses" (AWS SES via the SDK,
+   * for deployments that can't use SMTP). Anything else falls back to smtp.
+   */
+  get EMAIL_PROVIDER() {
+    return process.env.EMAIL_PROVIDER?.trim().toLowerCase() === "ses" ? "ses" : "smtp";
+  },
+  /** AWS region for SES, e.g. us-east-1. Required when EMAIL_PROVIDER=ses. */
+  get SES_REGION() {
+    return process.env.SES_REGION?.trim() || null;
+  },
+  /**
+   * Optional static SES credentials. Both unset → the AWS default credential
+   * chain (IAM role, AWS_* env, shared profile). The secret is write-only.
+   */
+  get SES_ACCESS_KEY_ID() {
+    return process.env.SES_ACCESS_KEY_ID?.trim() || null;
+  },
+  get SES_SECRET_ACCESS_KEY() {
+    return process.env.SES_SECRET_ACCESS_KEY?.trim() || null;
+  },
   /**
    * From address for notification emails. Shape-validated here (not only in
    * the /admin/settings PATCH) so a value set directly via env/Docker can't
@@ -670,6 +722,11 @@ var config = {
   }
 };
 
+// src/db/client.ts
+import Database from "better-sqlite3";
+import { mkdirSync, readFileSync } from "fs";
+import { dirname as dirname2 } from "path";
+
 // src/db/migrations.ts
 function runMigrations(db) {
   db.exec(`
@@ -867,6 +924,9 @@ function runMigrations(db) {
   if (!nestCols.includes("reader_home_node")) {
     db.exec("ALTER TABLE nests ADD COLUMN reader_home_node TEXT");
   }
+  if (!nestCols.includes("branding_json")) {
+    db.exec("ALTER TABLE nests ADD COLUMN branding_json TEXT");
+  }
   const userCols = db.prepare("PRAGMA table_info(users)").all().map((c) => c.name);
   if (!userCols.includes("is_admin")) {
     db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
@@ -2097,7 +2157,7 @@ async function initDb() {
   if (config.DB_DRIVER === "postgres") {
     const { Pool } = await import("pg");
     const { PostgresAdapter } = await import("./adapter.postgres-6VZCMPQL.js");
-    const { runPostgresMigrations } = await import("./migrations.postgres-23VJJJJX.js");
+    const { runPostgresMigrations } = await import("./migrations.postgres-HGSQ7IA5.js");
     const pool = new Pool(buildPgConfig());
     adapter = new PostgresAdapter(pool);
     await runPostgresMigrations(adapter);
@@ -2117,18 +2177,11 @@ function getDb() {
   }
   return adapter;
 }
-async function resetDb() {
-  if (adapter) {
-    await adapter.close();
-    adapter = null;
-  }
-}
 
 export {
   isEmailish,
   isEmailListish,
   config,
   initDb,
-  getDb,
-  resetDb
+  getDb
 };

package/dist/{chunk-2KHM5C7V.js → chunk-MB52DWWP.js}

@@ -1,28 +1,30 @@
 import {
   buildTitleMap,
-  canApproveWith,
-  canEditWith,
-  canViewWith,
-  collabPermToRole,
   docLink,
   isSuperAdmin,
   nestAllowsSelfApprove,
   nestName,
-  primaryRole,
   resolveNestAccess,
   resolveNestPermission,
-  resolveTeamRolesForUser,
-  sendEmailToRecipient
-} from "./chunk-7FROMOZM.js";
+  resolveTeamRolesForUser
+} from "./chunk-QMQDWRHN.js";
 import {
   ConflictError,
   ValidationError
 } from "./chunk-LHWOJPFE.js";
+import {
+  canApproveWith,
+  canEditWith,
+  canViewWith,
+  collabPermToRole,
+  primaryRole,
+  sendEmailToRecipient
+} from "./chunk-RXCVXG34.js";
 import {
   config,
   getDb,
   isEmailish
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-H3W72HN3.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid } from "uuid";
@@ -231,12 +233,8 @@ async function createStewardRecord(params) {
     );
     let userId = userRow?.id;
     if (!userId) {
-      const { hashPassword } = await import("./keys-CTOGAG3W.js");
-      userId = uuid();
-      await db.run(
-        "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword(uuid())]
-      );
+      const { findOrCreateInvitedUser } = await import("./invited-user-XEBX6BM4.js");
+      userId = (await findOrCreateInvitedUser(email)).id;
     }
     const created = await assignSteward({
       nestId: params.nestId,

package/dist/{chunk-TI7HMP64.js → chunk-NFFUZF2B.js}

@@ -2,13 +2,13 @@ import {
   buildTitleMap,
   insertOrReplace,
   nowExpr
-} from "./chunk-7FROMOZM.js";
+} from "./chunk-QMQDWRHN.js";
 import {
   ValidationError
 } from "./chunk-LHWOJPFE.js";
 import {
   getDb
-} from "./chunk-JDAOA5KP.js";
+} from "./chunk-H3W72HN3.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";
@@ -215,6 +215,25 @@ async function setApprovedVersion(nestId, nodeId, version, approvedBy) {
   );
   await db.run(sql, [nestId, nodeId, version, approvedBy]);
 }
+var APPROVED_HEAL_AUTHOR = "system:approved-heal";
+async function moveApprovedVersion(nestId, nodeId, from, to) {
+  const db = getDb();
+  const moved = await db.run(
+    `UPDATE approved_versions
+        SET approved_version = ?, approved_by = ?, approved_at = ${nowExpr(db)}
+      WHERE nest_id = ? AND node_id = ? AND approved_version = ?`,
+    [to, APPROVED_HEAL_AUTHOR, nestId, nodeId, from]
+  );
+  if (moved.changes === 0) return false;
+  const note = `Approved version moved from v${from} to v${to} \u2014 v${from} could not be rebuilt`;
+  await db.run(
+    `UPDATE node_versions
+        SET change_note = CASE WHEN change_note IS NULL OR change_note = '' THEN ? ELSE change_note || ' \xB7 ' || ? END
+      WHERE nest_id = ? AND node_id = ? AND version = ?`,
+    [note, note, nestId, nodeId, to]
+  );
+  return true;
+}
 async function getSealedVersion(nestId, nodeId) {
   const approved = await getApprovedVersion(nestId, nodeId);
   if (approved != null) return approved;
@@ -458,6 +477,8 @@ export {
   getApprovedVersion,
   getApprovedVersions,
   setApprovedVersion,
+  APPROVED_HEAL_AUTHOR,
+  moveApprovedVersion,
   getSealedVersion,
   deleteSupersededDrafts,
   deleteUnsealedVersions,

package/dist/{chunk-F66VCBLA.js → chunk-O3JEI33N.js}

@@ -1,3 +1,17 @@
+import {
+  sendEmailToRecipient
+} from "./chunk-RXCVXG34.js";
+import {
+  config,
+  getDb
+} from "./chunk-H3W72HN3.js";
+import {
+  normalizeEmail
+} from "./chunk-FRQJWGN3.js";
+
+// src/auth/invited-user.ts
+import { v4 as uuid } from "uuid";
+
 // src/auth/keys.ts
 import { randomBytes, createHash, timingSafeEqual } from "crypto";
 import bcrypt from "bcryptjs";
@@ -124,6 +138,40 @@ function normalizeKeyLabel(raw) {
   return trimmed;
 }
 
+// src/auth/invited-user.ts
+async function createInvitedUser(rawEmail, opts = {}) {
+  const email = normalizeEmail(rawEmail);
+  const id = uuid();
+  const tempPassword = uuid().replace(/-/g, "").slice(0, 16);
+  await getDb().run(
+    "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
+    [id, email, null, await hashPassword(tempPassword)]
+  );
+  const base = (opts.baseUrl || config.PUBLIC_BASE_URL || "").replace(/\/$/, "");
+  void sendEmailToRecipient(email, {
+    status: "invited",
+    docTitle: "ContextNest",
+    path: "",
+    actor: email,
+    by: opts.invitedBy || void 0,
+    tempPassword,
+    promptowlSignIn: config.PROMPTOWL_SIGN_IN_GATE === "open",
+    // ?invite= prefills the login page and guides them to sign in.
+    link: base ? `${base}/?invite=${encodeURIComponent(email)}` : ""
+  });
+  return { id, tempPassword };
+}
+async function findOrCreateInvitedUser(rawEmail, opts = {}) {
+  const email = normalizeEmail(rawEmail);
+  const existing = await getDb().get(
+    "SELECT id FROM users WHERE LOWER(email) = ?",
+    [email]
+  );
+  if (existing) return { id: existing.id, created: false };
+  const { id } = await createInvitedUser(email, opts);
+  return { id, created: true };
+}
+
 export {
   generateApiKey,
   hashApiKey,
@@ -131,6 +179,7 @@ export {
   parseBearerToken,
   hashPassword,
   verifyPassword,
-  MAX_API_KEYS_PER_USER,
-  verifyKeyRequest
+  verifyKeyRequest,
+  createInvitedUser,
+  findOrCreateInvitedUser
 };