@promptowl/contextnest-community 1.3.0 → 1.5.0

package/CONFIGURATION.md

@@ -50,6 +50,8 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
 | `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
 | `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
+| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another. Only relevant when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. |
 | `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars), and which the server also reads at boot. Defaults **under `DATA_ROOT`** so the browser License Setup Page persists durably in containers — `$cwd` is `/app` in the official image (root-owned, discarded on container recreate), which silently lost the key. Override only if your writable, persisted `.env` lives elsewhere. In containers, providing `PROMPTOWL_KEY` directly via the environment also works and is read at boot. |
 | `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
 | `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |

package/dist/{chunk-SO74PQWI.js → chunk-EMOE53KX.js}

@@ -2,7 +2,7 @@ import {
   ANON_USER_ID,
   config,
   getDb
-} from "./chunk-UEHFNBNR.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/stewardship-service.ts
 import { v4 as uuid2 } from "uuid";
@@ -1464,6 +1464,7 @@ export {
   getCurrentLicense,
   isLicenseAdminEmail,
   isLicenseAdminUserId,
+  upsertEnvVar,
   installLicenseKey,
   startLicenseSafetyPoll,
   isSuspended,

package/dist/{chunk-6AXBB65N.js → chunk-HIH7I232.js}

@@ -1,6 +1,6 @@
 import {
   getDb
-} from "./chunk-UEHFNBNR.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";

package/dist/{chunk-EDJRDWPL.js → chunk-IWA2UDAT.js}

@@ -1,16 +1,16 @@
 import {
   createVersion,
   setApprovedVersion
-} from "./chunk-6AXBB65N.js";
+} from "./chunk-HIH7I232.js";
 import {
   buildTitleMap,
   canUserApprove,
   engineCache,
   resolveStewardsForNode
-} from "./chunk-SO74PQWI.js";
+} from "./chunk-EMOE53KX.js";
 import {
   getDb
-} from "./chunk-UEHFNBNR.js";
+} from "./chunk-RMU3LOPH.js";
 
 // src/governance/review-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-UEHFNBNR.js → chunk-RMU3LOPH.js}

@@ -44,6 +44,32 @@ var config = {
   get PROMPTOWL_KEY() {
     return process.env.PROMPTOWL_KEY || "";
   },
+  /**
+   * Shared secret for one-click SSO auto-login from PromptOwl (PO).
+   *
+   * THIS IS THE DOMAIN LOCK. Only the ONE official community deployment is
+   * given this secret (it matches OFFICIAL_COMMUNITY_SSO_SECRET on PO). PO
+   * signs a short-lived JWT ticket with it; this server verifies the ticket
+   * with the same secret at GET /auth/sso.
+   *
+   * Self-hosted deployments leave this UNSET — GET /auth/sso then returns 404,
+   * so the auto-login feature is disabled for every domain except ours. Those
+   * users keep using the manual device-code flow (/auth/promptowl).
+   */
+  get OFFICIAL_COMMUNITY_SSO_SECRET() {
+    return process.env.OFFICIAL_COMMUNITY_SSO_SECRET || "";
+  },
+  /**
+   * This server's own canonical, externally-reachable base URL (e.g.
+   * "https://community.promptowl.ai"). Used to validate the `aud` claim on
+   * incoming SSO tickets — a ticket minted for a different audience is
+   * rejected, so a ticket can't be replayed against another server. Compared
+   * with the trailing slash stripped. When unset, the `aud` check is skipped
+   * (the shared-secret check is still the primary gate).
+   */
+  get PUBLIC_BASE_URL() {
+    return (process.env.PUBLIC_BASE_URL || "").replace(/\/$/, "");
+  },
   /**
    * Restrict "Sign in with PromptOwl":
    *   "open"       — anyone may sign in with PromptOwl (default)
@@ -176,6 +202,35 @@ function runMigrations(db2) {
     CREATE INDEX IF NOT EXISTS idx_nest_collab_nest ON nest_collaborators(nest_id);
     CREATE INDEX IF NOT EXISTS idx_nest_collab_user ON nest_collaborators(user_id);
 
+    -- Annotation threads on hosted artifacts. Deliberately kept OUT of the
+    -- versioned/hash-chained node layer: annotations are high-churn human
+    -- feedback, not canonical node content. They reference the node + the
+    -- snapshot (node version) they were anchored against.
+    CREATE TABLE IF NOT EXISTS annotation_threads (
+      id TEXT PRIMARY KEY,
+      nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+      node_id TEXT NOT NULL,
+      snapshot_version INTEGER,
+      anchor_json TEXT,                 -- JSON {line?,quote,before,after}; NULL = whole-artifact
+      status TEXT NOT NULL DEFAULT 'open'
+        CHECK(status IN ('open', 'resolved')),
+      created_by TEXT NOT NULL,         -- email
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      resolved_by TEXT,
+      resolved_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS annotation_comments (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL REFERENCES annotation_threads(id) ON DELETE CASCADE,
+      author TEXT NOT NULL,             -- email
+      body TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_annot_threads_node
+      ON annotation_threads(nest_id, node_id);
+    CREATE INDEX IF NOT EXISTS idx_annot_comments_thread
+      ON annotation_comments(thread_id);
+
     -- License validation cache
     CREATE TABLE IF NOT EXISTS license_cache (
       key TEXT PRIMARY KEY,
@@ -603,6 +658,50 @@ function runMigrations(db2) {
     })();
     recordMigration("009_lowercase_emails");
   }
+  if (!hasMigration("010_sso_used_jti")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE IF NOT EXISTS sso_used_jti (
+          jti TEXT PRIMARY KEY,
+          used_at TEXT NOT NULL DEFAULT (datetime('now')),
+          expires_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_sso_used_jti_expires
+          ON sso_used_jti(expires_at);
+      `);
+    })();
+    recordMigration("010_sso_used_jti");
+  }
+  if (!hasMigration("011_comments")) {
+    db2.transaction(() => {
+      db2.exec(`
+        CREATE TABLE IF NOT EXISTS comments (
+          id TEXT PRIMARY KEY,
+          nest_id TEXT NOT NULL REFERENCES nests(id) ON DELETE CASCADE,
+          node_id TEXT NOT NULL,
+          version INTEGER,                 -- optional: comment pinned to a version
+          anchor_start INTEGER,            -- optional: highlight span start (char offset)
+          anchor_end INTEGER,              -- optional: highlight span end
+          anchor_text TEXT,                -- optional: quoted highlighted text
+          parent_id TEXT REFERENCES comments(id) ON DELETE CASCADE,  -- threading
+          author TEXT NOT NULL,            -- email
+          body TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'open'
+            CHECK(status IN ('open', 'resolved')),
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          resolved_by TEXT,                -- email
+          resolved_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_comments_node
+          ON comments(nest_id, node_id, created_at);
+        CREATE INDEX IF NOT EXISTS idx_comments_open
+          ON comments(nest_id, node_id, status);
+        CREATE INDEX IF NOT EXISTS idx_comments_thread
+          ON comments(parent_id);
+      `);
+    })();
+    recordMigration("011_comments");
+  }
 }
 
 // src/db/client.ts