@promptowl/contextnest-community 1.5.0 → 1.7.0

package/CONFIGURATION.md

@@ -1,123 +1,181 @@
-# Configuration
-
-All server configuration is driven by environment variables. Set them in your shell, in a `.env` file, in a Docker image, or via your process manager — however you deploy the rest of your stack.
-
-## Auth modes
-
-The server supports two authentication modes. You pick one per instance with `AUTH_MODE`.
-
-### `AUTH_MODE=key` (default)
-
-Every request requires an `Authorization: Bearer cnst_...` header. Use this for any multi-user or internet-facing deployment.
-
-- Users register via `POST /auth/register` (email + password) or log in with PromptOwl via `POST /auth/device` → `POST /auth/promptowl`.
-- API keys are per-user (`cnst_<64-hex>`) and can be scoped to a single nest for service-account use.
-- Rate-limited login / register / device-auth endpoints (sliding window, per IP + per email).
-- First PromptOwl-authenticated user becomes the server admin (atomic claim). Admin can invite teammates at `POST /auth/invite`.
-
-Clients include the token on every request:
-
-```bash
-curl -H 'Authorization: Bearer cnst_<your-token>' http://your-server/nests
-```
-
-### `AUTH_MODE=open`
-
-No authentication required. Every request is attributed to the anonymous admin user (`00000000-...`). Everyone effectively owns every anon-created nest.
-
-**Use this only when:**
-- You're running locally for yourself (`bind 127.0.0.1`), or
-- You're on a trusted LAN and don't care about access controls, or
-- You're behind an upstream reverse proxy that already authenticates.
-
-**Don't use this when:**
-- The port is reachable from the public internet
-- Multiple people share the deployment and need isolated data
-- You need audit trails (every write shows up under "anonymous admin")
-
-The server prints a loud warning at startup when `AUTH_MODE=open` is active.
-
----
-
-## Full env var reference
-
-| Var | Default | Purpose |
-|---|---|---|
-| `PORT` | `3838` | HTTP port the server listens on. |
-| `DATA_ROOT` | `./data` (relative to cwd) | Root directory for SQLite DB + nest filesystem vaults. Set to an absolute path in production so it's independent of where you `cd`'d from. |
-| `DATABASE_PATH` | `$DATA_ROOT/community.db` | Override the SQLite file location explicitly. |
-| `AUTH_MODE` | `key` | `key` or `open`. See above. |
-| `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
-| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
-| `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
-| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
-| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another. Only relevant when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. |
-| `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars), and which the server also reads at boot. Defaults **under `DATA_ROOT`** so the browser License Setup Page persists durably in containers — `$cwd` is `/app` in the official image (root-owned, discarded on container recreate), which silently lost the key. Override only if your writable, persisted `.env` lives elsewhere. In containers, providing `PROMPTOWL_KEY` directly via the environment also works and is read at boot. |
-| `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
-| `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
-| `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
-| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
-| `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
-
----
-
-## Typical deployments
-
-### Local dev / single user
-
-```bash
-AUTH_MODE=open DATA_ROOT=./my-data npm run dev
-```
-
-Or the default dev mode if `npm run dev` already sets `AUTH_MODE=open` in your scripts.
-
-### Team / multi-user behind a reverse proxy
-
-```bash
-AUTH_MODE=key \
-CORS_ORIGINS="https://team.example.com,https://admin.example.com" \
-DATA_ROOT=/var/lib/contextnest \
-PROMPTOWL_KEY=pk_... \
-npm start
-```
-
-Terminate TLS at the proxy, forward `X-Forwarded-For` and `X-Real-IP` headers (the rate limiter reads them), and bind the server to `127.0.0.1` so only the proxy can reach it.
-
-### Hosted / commercial SaaS
-
-Same as team, plus:
-- Run N instances behind a load balancer sharing a network-attached `DATA_ROOT` (note: SQLite + shared filesystem is not a great long-term story — migrate to the MongoDB storage adapter when scaling beyond one box).
-- Set `TELEMETRY_ENABLED=true` and a valid `PROMPTOWL_KEY` so usage rolls up to PromptOwl.
-- Rotate keys regularly via `DELETE /auth/keys/:id` + `POST /auth/keys`.
-
----
-
-## access.yaml (optional, open + key mode)
-
-Drop an `access.yaml` at `$DATA_ROOT/access.yaml` to add a server-level ABAC layer — useful even in key mode for super-admins and group-based defaults.
-
-```yaml
-mode: restricted
-allowed_users:
-  - "*.acme.com"                # email wildcard — anyone @acme.com
-  - "partner@vendor.com"         # exact match
-super_admins:
-  - "ceo@acme.com"               # admin on every nest: visibility, collaborators, stewards (not owner-only delete/transfer)
-groups:
-  engineering:
-    default_permission: write
-    members:
-      - "*.eng.acme.com"
-  viewers:
-    default_permission: read
-    members:
-      - "*.contractor.acme.com"
-```
-
-See `STEWARDSHIP.md` for how super-admins and groups interact with per-nest stewardship.
-
----
-
-## Reload
-
-Changing env vars requires a restart — the server reads them at boot. `tsx watch` in dev will pick up code changes automatically but not env changes.
+# Configuration
+
+All server configuration is driven by environment variables. Set them in your shell, in a `.env` file, in a Docker image, or via your process manager — however you deploy the rest of your stack.
+
+## Auth modes
+
+The server supports two authentication modes. You pick one per instance with `AUTH_MODE`.
+
+### `AUTH_MODE=key` (default)
+
+Every request requires an `Authorization: Bearer cnst_...` header. Use this for any multi-user or internet-facing deployment.
+
+- Users register via `POST /auth/register` (email + password) or log in with PromptOwl via `POST /auth/device` → `POST /auth/promptowl`.
+- API keys are per-user (`cnst_<64-hex>`) and can be scoped to a single nest for service-account use.
+- Rate-limited login / register / device-auth endpoints (sliding window, per IP + per email).
+- First PromptOwl-authenticated user becomes the server admin (atomic claim). Admin can invite teammates at `POST /auth/invite`.
+
+Clients include the token on every request:
+
+```bash
+curl -H 'Authorization: Bearer cnst_<your-token>' http://your-server/nests
+```
+
+### `AUTH_MODE=open`
+
+No authentication required. Every request is attributed to the anonymous admin user (`00000000-...`). Everyone effectively owns every anon-created nest.
+
+**Use this only when:**
+- You're running locally for yourself (`bind 127.0.0.1`), or
+- You're on a trusted LAN and don't care about access controls, or
+- You're behind an upstream reverse proxy that already authenticates.
+
+**Don't use this when:**
+- The port is reachable from the public internet
+- Multiple people share the deployment and need isolated data
+- You need audit trails (every write shows up under "anonymous admin")
+
+The server prints a loud warning at startup when `AUTH_MODE=open` is active.
+
+---
+
+## Full env var reference
+
+| Var | Default | Purpose |
+|---|---|---|
+| `PORT` | `3838` | HTTP port the server listens on. |
+| `DATA_ROOT` | `./data` (relative to cwd) | Root directory for SQLite DB + nest filesystem vaults. Set to an absolute path in production so it's independent of where you `cd`'d from. |
+| `DATABASE_PATH` | `$DATA_ROOT/community.db` | Override the SQLite file location explicitly. (SQLite backend only.) |
+| `NEST_STORAGE_ROOT` | `$DATA_ROOT/nests` | Root directory for nest vault files (markdown + version history). Override to store nests separately from the DB — e.g. point it at a Cloud Storage (GCS) volume mount on Cloud Run (`/mnt/nests`) while the SQLite DB stays on `DATA_ROOT` off the mount. **Moving existing nests:** the app does not relocate files — copy `$DATA_ROOT/nests/*` to the new root (e.g. `gsutil rsync`) before switching, or existing nests will appear empty (DB rows present, files missing). On a GCS mount, also set `DRIFT_SCAN_INTERVAL_MS=0` to avoid constant FUSE scans, and run a single instance (GCS FUSE has no file locking — concurrent writers lose data). |
+| `DB_DRIVER` | `sqlite` | Database backend: `sqlite` (default) or `postgres`. When unset, the server infers `postgres` if `DATABASE_URL` or `CLOUD_SQL_CONNECTION_NAME` is set, else `sqlite`. Existing deployments need no change — they stay on SQLite. See [Database backends](#database-backends). |
+| `DATABASE_URL` | `""` | PostgreSQL connection string for a TCP connection, e.g. `postgres://user:pass@host:5432/dbname`. Setting it selects the Postgres backend (unless `DB_DRIVER=sqlite`). |
+| `CLOUD_SQL_CONNECTION_NAME` | `""` | Cloud SQL instance connection name (`project:region:instance`). When set, the server connects over the Cloud SQL Auth Proxy unix socket at `/cloudsql/<name>` — the recommended Cloud Run setup. Combine with `DB_USER`, `DB_PASSWORD`, `DB_NAME`. |
+| `DB_HOST` / `DB_PORT` / `DB_USER` / `DB_PASSWORD` / `DB_NAME` | `localhost` / `5432` / `""` / `""` / `""` | Discrete Postgres connection params, used when neither `CLOUD_SQL_CONNECTION_NAME` nor `DATABASE_URL` is set. |
+| `DB_POOL_MAX` | `10` | Max Postgres pool connections. Keep modest — Cloud SQL tiers cap total connections. |
+| `DB_SSL` | `false` | Set `true` to require TLS on a Postgres TCP connection (not needed over the Cloud SQL unix socket, which is already secure). |
+| `DB_SSL_CA` | `""` | Path to a CA certificate (PEM) for verify-ca/verify-full TLS when `DB_SSL=true`. |
+| `AUTH_MODE` | `key` | `key` or `open`. See above. |
+| `PROMPTOWL_API_URL` | `https://app.promptowl.ai` | PromptOwl's API origin — used for device auth, license validation, telemetry. Override for air-gapped or test setups. |
+| `PROMPTOWL_KEY` | `""` | Your PromptOwl Community License key (`pk_...`). Unlicensed instances still run and serve reads, but every write returns `503` until a valid key is installed. Can also be set via the browser License Setup Page, which persists it to `ENV_FILE_PATH`. |
+| `PROMPTOWL_SIGN_IN_GATE` | `open` | Restrict "Sign in with PromptOwl". `open` = anyone may; `admin-only` = only the license owner (admin) may, everyone else uses email/password (admin opens the login page with `?admin=1`); `disabled` = nobody may. Enforced server-side at `POST /auth/promptowl` and surfaced on the health endpoint. Unknown values fall back to `open`. |
+| `OFFICIAL_COMMUNITY_SSO_SECRET` | `""` | **Official deployment only — leave unset on self-hosted.** Shared HMAC secret enabling the one-click "Open Community" SSO auto-login from PromptOwl. Must exactly match the same-named var on PromptOwl. When unset, `GET /auth/sso` returns `404` and the feature is disabled; self-hosted users keep using the manual device-code flow. |
+| `PUBLIC_BASE_URL` | `""` | This server's canonical external URL (e.g. `https://community.promptowl.ai`). Checked against the SSO ticket's `aud` claim so a ticket minted for this server can't be replayed against another. Only relevant when `OFFICIAL_COMMUNITY_SSO_SECRET` is set; when unset, the audience check is skipped. |
+| `ENV_FILE_PATH` | `$DATA_ROOT/.env` | Path to the `.env` file the license install flow writes `PROMPTOWL_KEY` into (alongside existing vars), and which the server also reads at boot. Defaults **under `DATA_ROOT`** so the browser License Setup Page persists durably in containers — `$cwd` is `/app` in the official image (root-owned, discarded on container recreate), which silently lost the key. Override only if your writable, persisted `.env` lives elsewhere. In containers, providing `PROMPTOWL_KEY` directly via the environment also works and is read at boot. |
+| `TELEMETRY_ENABLED` | `"true"` (set to `"false"` to disable) | Batched, anonymized usage events sent to PromptOwl. Off disables the loop entirely. |
+| `TELEMETRY_INTERVAL_MS` | `3600000` (1 hour) | How often buffered telemetry is flushed to PromptOwl. |
+| `CORS_ORIGINS` | `*` in open mode; `http://localhost:5173,http://localhost:3838` in key mode | Comma-separated allowlist. Set to `*` to allow any origin (**only** safe in open mode — in key mode with Bearer tokens this enables CSRF). |
+| `MAX_BODY_BYTES` | `10485760` (10 MB) | Reject requests whose `Content-Length` exceeds this. Prevents giant-payload DoS. |
+| `LOGO_URL` | _(unset)_ | Custom logo shown in the UI header + login screen. Must start with `https://`, `http://`, or `data:image/` — other schemes (`file://`, relative, `javascript:`) are rejected with a warning and the bundled icon is used. |
+
+---
+
+## Database backends
+
+The governance/auth metadata (users, sessions, nests registry, stewards, reviews,
+versions index, comments, telemetry) is stored in a relational database. Two
+backends are supported:
+
+- **SQLite (default).** A single file at `DATABASE_PATH`. Zero-config, ideal for
+  single-box and local deployments. Nothing changes for existing installs.
+- **PostgreSQL / Cloud SQL.** For deployments where local disk isn't durable
+  (e.g. Google Cloud Run, where the container filesystem is ephemeral). Selected
+  by setting `DB_DRIVER=postgres`, `DATABASE_URL`, or `CLOUD_SQL_CONNECTION_NAME`.
+
+On first connect the server creates its schema automatically (idempotent) — no
+manual migration step. There is no built-in SQLite→Postgres data migration; a new
+Postgres backend starts empty.
+
+> ⚠️ **Cloud Run durability — read this.** Cloud SQL persists only the *metadata
+> database*. The actual **document content and version history** live on the
+> filesystem under `$DATA_ROOT/nests/`, which on Cloud Run is **ephemeral** and is
+> lost when an instance is recycled. Using Cloud SQL alone does **not** make a
+> Cloud Run deployment fully durable. You must also put `$DATA_ROOT` on persistent,
+> shared storage — e.g. mount a GCS bucket via Cloud Storage FUSE, or use a
+> persistent volume — otherwise documents will disappear on redeploy/scale-in.
+
+### Cloud Run + Cloud SQL (PostgreSQL)
+
+Attach the Cloud SQL instance to the service (`--add-cloudsql-instances`) so the
+Auth Proxy unix socket appears at `/cloudsql/<connection-name>`, then:
+
+```bash
+DB_DRIVER=postgres \
+CLOUD_SQL_CONNECTION_NAME=my-project:us-central1:contextnest \
+DB_USER=contextnest \
+DB_PASSWORD=*** \
+DB_NAME=contextnest \
+DATA_ROOT=/mnt/vault \   # mount GCS/persistent storage here — see warning above
+PROMPTOWL_KEY=pk_... \
+node dist/index.js
+```
+
+Or with a plain TCP connection string (e.g. the Cloud SQL Proxy running on
+localhost, or a private IP):
+
+```bash
+DATABASE_URL=postgres://contextnest:***@127.0.0.1:5432/contextnest \
+DB_DRIVER=postgres \
+DATA_ROOT=/mnt/vault \
+npm start
+```
+
+## Typical deployments
+
+### Local dev / single user
+
+```bash
+AUTH_MODE=open DATA_ROOT=./my-data npm run dev
+```
+
+Or the default dev mode if `npm run dev` already sets `AUTH_MODE=open` in your scripts.
+
+### Team / multi-user behind a reverse proxy
+
+```bash
+AUTH_MODE=key \
+CORS_ORIGINS="https://team.example.com,https://admin.example.com" \
+DATA_ROOT=/var/lib/contextnest \
+PROMPTOWL_KEY=pk_... \
+npm start
+```
+
+Terminate TLS at the proxy, forward `X-Forwarded-For` and `X-Real-IP` headers (the rate limiter reads them), and bind the server to `127.0.0.1` so only the proxy can reach it.
+
+### Hosted / commercial SaaS
+
+Same as team, plus:
+- Run N instances behind a load balancer. SQLite + a shared filesystem is not a great long-term story for the metadata DB when scaling beyond one box — switch to the **PostgreSQL / Cloud SQL** backend (see [Database backends](#database-backends)) so all instances share one consistent database. The on-disk nest vault under `$DATA_ROOT/nests/` still needs durable shared storage.
+- Set `TELEMETRY_ENABLED=true` and a valid `PROMPTOWL_KEY` so usage rolls up to PromptOwl.
+- Rotate keys regularly via `DELETE /auth/keys/:id` + `POST /auth/keys`.
+
+---
+
+## access.yaml (optional, open + key mode)
+
+Drop an `access.yaml` at `$DATA_ROOT/access.yaml` to add a server-level ABAC layer — useful even in key mode for super-admins and group-based defaults.
+
+```yaml
+mode: restricted
+allowed_users:
+  - "*.acme.com"                # email wildcard — anyone @acme.com
+  - "partner@vendor.com"         # exact match
+super_admins:
+  - "ceo@acme.com"               # admin on every nest: visibility, collaborators, stewards (not owner-only delete/transfer)
+groups:
+  engineering:
+    default_permission: write
+    members:
+      - "*.eng.acme.com"
+  viewers:
+    default_permission: read
+    members:
+      - "*.contractor.acme.com"
+```
+
+See `STEWARDSHIP.md` for how super-admins and groups interact with per-nest stewardship.
+
+---
+
+## Reload
+
+Changing env vars requires a restart — the server reads them at boot. `tsx watch` in dev will pick up code changes automatically but not env changes.

package/LICENSE.md

@@ -1,142 +1,142 @@
-# ContextNest Community Edition — Commercial Software License
-
-**Version 1.0 — Effective Date: April 24, 2026**
-
-Copyright © 2026 Promptowl LLC. All rights reserved.
-
-This ContextNest Community Edition Commercial Software License (the **"License"**) is a legal agreement between you (either an individual or a single legal entity, **"You"**) and **Promptowl LLC**, a Georgia limited liability company with its principal place of business at 3060 Mercer University Dr Ste 110, Atlanta, GA 30341, USA (**"Licensor,"** "we," "us," or "our"), governing Your use of the ContextNest Community Edition software, including its command-line interface, server, user interface, source or compiled code, and any related documentation (collectively, the **"Software"**).
-
-**BY INSTALLING, COPYING, EXECUTING, OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THIS LICENSE. IF YOU DO NOT AGREE, DO NOT INSTALL OR USE THE SOFTWARE.**
-
----
-
-## 1. Software and Service Relationship
-
-The Software is a client that interoperates with the hosted **PromptOwl** platform operated by Licensor (the **"Platform"**). Operation of the Software requires a valid PromptOwl account. Your use of the Platform, and any acceptance of Platform-level terms presented upon login or account creation, is governed separately by:
-
-- **End User License Agreement** — <https://promptowl.ai/eula/>
-- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
-- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
-- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
-- **Disclaimer** — <https://promptowl.ai/disclaimer/>
-- **Cookie Policy** — <https://promptowl.ai/cookies/>
-
-(collectively, the **"Platform Terms"**). The Platform Terms are incorporated into this License by reference with respect to any use of the Platform. In the event of a conflict between this License and the Platform Terms regarding the Software itself (as distinct from the Platform), this License controls.
-
-## 2. License Grant
-
-Subject to Your continued compliance with this License and the Platform Terms, Licensor grants You a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to:
-
-**(a)** install and execute the Software on computing devices that You own or control;
-
-**(b)** use the Software solely for Your own internal business purposes or personal non-commercial purposes, in connection with a valid PromptOwl account; and
-
-**(c)** make a reasonable number of copies of the Software solely for backup, archival, or internal deployment purposes, provided that all copyright, trademark, and other proprietary notices are preserved intact.
-
-## 3. Restrictions
-
-You shall not, and shall not permit any third party to:
-
-**(a) Redistribution.** Sell, rent, lease, lend, sublicense, assign, distribute, publish, or otherwise make the Software available to any third party, whether standalone, bundled, or as part of a derivative work.
-
-**(b) Hosting-as-a-Service.** Offer, operate, or make available the Software, or any substantial portion of its functionality, as a hosted, managed, software-as-a-service, or similar service to any third party. Hosting the Software for Your own internal use is permitted; hosting it for use by any person or entity outside Your legal entity is not.
-
-**(c) Competitive Use.** Use the Software, in whole or in part, to develop, train, operate, or support any product or service that competes with ContextNest, PromptOwl, or any Licensor product.
-
-**(d) Reverse Engineering.** Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying ideas, algorithms, file formats, or non-public APIs of the Software, except and only to the extent this restriction is expressly prohibited by applicable law.
-
-**(e) Modification.** Modify, adapt, translate, or create derivative works of the Software, except for configuration files and integration code that You author and that are clearly separable from the Software itself.
-
-**(f) Circumvention.** Circumvent, disable, or interfere with any license, authentication, metering, telemetry, or security mechanism of the Software or the Platform, including but not limited to the PromptOwl login requirement.
-
-**(g) Notice Removal.** Remove, obscure, or alter any copyright, trademark, license, or other proprietary notice contained in or displayed by the Software.
-
-**(h) Trademark Use.** Use the names, logos, or trademarks of Licensor, including "PromptOwl," "ContextNest," or any confusingly similar mark, in any forked, modified, or derivative distribution, or in a manner suggesting endorsement, affiliation, or sponsorship that does not exist.
-
-**(i) Unlawful Use.** Use the Software in violation of any applicable law or regulation, or in any manner that violates the Acceptable Use Policy.
-
-**(j) Regulated Industry Use.** Use the Software in environments subject to HIPAA, FISMA, GLBA, PCI-DSS, or similar industry-specific regulations, unless You have obtained express written authorization from Licensor. The Software is not certified for such environments.
-
-## 4. Ownership and Intellectual Property
-
-The Software is licensed, not sold. Licensor and its licensors retain all right, title, and interest in and to the Software, including all intellectual property rights therein. No rights are granted to You other than those expressly set forth in this License. All rights not expressly granted are reserved by Licensor. "PromptOwl" and "ContextNest" are trademarks of Promptowl LLC.
-
-## 5. Account Requirement and Suspension
-
-The Software's functionality is conditioned on a valid, active PromptOwl account in good standing. Licensor may suspend, terminate, or restrict account access (and, consequently, Software functionality) in accordance with the Platform Terms. Termination or suspension of Your PromptOwl account does not, by itself, waive Licensor's rights under this License.
-
-## 6. Updates
-
-Licensor may, but is not obligated to, provide updates, patches, or new versions of the Software. Any such update is deemed part of the Software and is governed by this License unless accompanied by a separate license.
-
-## 7. Third-Party Components
-
-The Software may include or depend upon open-source or third-party components, each of which is governed by its own license. A listing of such components and their licenses is provided in the Software distribution or in accompanying documentation. Nothing in this License limits Your rights or obligations under those third-party licenses.
-
-## 8. Commercial Licensing for Restricted Uses
-
-If You wish to use the Software in a manner not permitted by Section 3 — including redistribution, hosting-as-a-service, embedding in a commercial product, or use in regulated-industry environments — You must obtain a separate written commercial license from Licensor. Contact: **hoot@promptowl.ai**.
-
-## 9. Term and Termination
-
-**9.1** This License is effective upon Your first installation or use of the Software and continues until terminated.
-
-**9.2** This License terminates automatically and without notice if You breach any term of this License. Licensor may also terminate this License at any time for material breach upon notice.
-
-**9.3** Upon termination, You shall immediately (i) cease all use of the Software, (ii) delete or destroy all copies of the Software in Your possession or control, and (iii) certify such destruction in writing upon Licensor's request.
-
-**9.4** Sections 3, 4, 9.3, 10, 11, 12, 13, and 14 survive termination.
-
-## 10. Disclaimer of Warranties
-
-THE SOFTWARE IS PROVIDED **"AS IS"** AND **"AS AVAILABLE,"** WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, OR UNINTERRUPTED OPERATION. LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, OR BE ERROR-FREE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, IN WHICH CASE THE FOREGOING EXCLUSIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
-
-## 11. AI Output Disclaimer
-
-The Software enables the creation, storage, retrieval, and injection of content into large language models and other AI systems. Licensor makes no representation or warranty regarding the accuracy, legality, completeness, appropriateness, or non-infringement of any output generated by such systems. You are solely responsible for reviewing, validating, and determining the fitness of AI-generated output for Your intended use. You agree not to deploy the Software in high-risk contexts (including medical, legal, financial advisory, safety-critical, or life-critical environments) without appropriate human oversight and independent safeguards.
-
-## 12. Limitation of Liability
-
-TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL LICENSOR, ITS AFFILIATES, OR ITS LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-LICENSOR'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US $100.00) OR THE AMOUNT PAID BY YOU TO LICENSOR FOR THE SOFTWARE IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, WHICHEVER IS GREATER.
-
-THE LIMITATIONS IN THIS SECTION APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS OF LIABILITY, IN WHICH CASE THE FOREGOING LIMITATIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
-
-## 13. Indemnification
-
-You agree to indemnify, defend, and hold harmless Licensor, its affiliates, and its officers, directors, employees, and agents from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to (a) Your use of the Software in breach of this License, (b) Your violation of any applicable law or third-party right, or (c) content or data You process through the Software.
-
-## 14. Governing Law and Venue
-
-This License is governed by the laws of the State of Georgia, United States of America, without regard to its conflict-of-laws principles. The exclusive venue for any dispute arising under or related to this License shall be the state or federal courts located in Fulton County, Georgia, and the parties consent to the personal jurisdiction of such courts. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
-
-## 15. Export Compliance
-
-You represent and warrant that (a) You are not located in a country subject to a U.S. Government embargo or designated as a "terrorist supporting" country, and (b) You are not listed on any U.S. Government list of prohibited or restricted parties. You shall comply with all applicable export-control laws and regulations in Your use of the Software.
-
-## 16. Assignment
-
-You may not assign or transfer this License, in whole or in part, without Licensor's prior written consent. Any attempted assignment in violation of this Section is void. Licensor may assign this License freely.
-
-## 17. Severability and Waiver
-
-If any provision of this License is held unenforceable, the remaining provisions shall remain in full force and effect, and the unenforceable provision shall be reformed to the extent necessary to render it enforceable while preserving the parties' intent. No waiver of any term shall be deemed a waiver of any other term or of a subsequent breach.
-
-## 18. Entire Agreement
-
-This License, together with the Platform Terms to the extent applicable to Your use of the Platform, constitutes the entire agreement between You and Licensor regarding the Software and supersedes all prior or contemporaneous understandings, whether written or oral. Any modification must be in writing and signed by an authorized representative of Licensor.
-
-## 19. Contact
-
-**Promptowl LLC**
-3060 Mercer University Dr Ste 110
-Atlanta, GA 30341, USA
-Email: **hoot@promptowl.ai**
-Web: <https://promptowl.ai>
-
-For commercial licensing inquiries (redistribution, hosted-service offerings, OEM, or regulated-industry use), contact **hoot@promptowl.ai** with subject line "ContextNest Commercial License."
-
----
-
-*"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC. All rights reserved.*
+# ContextNest Community Edition — Commercial Software License
+
+**Version 1.0 — Effective Date: April 24, 2026**
+
+Copyright © 2026 Promptowl LLC. All rights reserved.
+
+This ContextNest Community Edition Commercial Software License (the **"License"**) is a legal agreement between you (either an individual or a single legal entity, **"You"**) and **Promptowl LLC**, a Georgia limited liability company with its principal place of business at 3060 Mercer University Dr Ste 110, Atlanta, GA 30341, USA (**"Licensor,"** "we," "us," or "our"), governing Your use of the ContextNest Community Edition software, including its command-line interface, server, user interface, source or compiled code, and any related documentation (collectively, the **"Software"**).
+
+**BY INSTALLING, COPYING, EXECUTING, OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THIS LICENSE. IF YOU DO NOT AGREE, DO NOT INSTALL OR USE THE SOFTWARE.**
+
+---
+
+## 1. Software and Service Relationship
+
+The Software is a client that interoperates with the hosted **PromptOwl** platform operated by Licensor (the **"Platform"**). Operation of the Software requires a valid PromptOwl account. Your use of the Platform, and any acceptance of Platform-level terms presented upon login or account creation, is governed separately by:
+
+- **End User License Agreement** — <https://promptowl.ai/eula/>
+- **Terms of Service** — <https://promptowl.ai/terms-of-service/>
+- **Privacy Policy** — <https://promptowl.ai/privacy-policy/>
+- **Acceptable Use Policy** — <https://promptowl.ai/acceptable-use/>
+- **Disclaimer** — <https://promptowl.ai/disclaimer/>
+- **Cookie Policy** — <https://promptowl.ai/cookies/>
+
+(collectively, the **"Platform Terms"**). The Platform Terms are incorporated into this License by reference with respect to any use of the Platform. In the event of a conflict between this License and the Platform Terms regarding the Software itself (as distinct from the Platform), this License controls.
+
+## 2. License Grant
+
+Subject to Your continued compliance with this License and the Platform Terms, Licensor grants You a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to:
+
+**(a)** install and execute the Software on computing devices that You own or control;
+
+**(b)** use the Software solely for Your own internal business purposes or personal non-commercial purposes, in connection with a valid PromptOwl account; and
+
+**(c)** make a reasonable number of copies of the Software solely for backup, archival, or internal deployment purposes, provided that all copyright, trademark, and other proprietary notices are preserved intact.
+
+## 3. Restrictions
+
+You shall not, and shall not permit any third party to:
+
+**(a) Redistribution.** Sell, rent, lease, lend, sublicense, assign, distribute, publish, or otherwise make the Software available to any third party, whether standalone, bundled, or as part of a derivative work.
+
+**(b) Hosting-as-a-Service.** Offer, operate, or make available the Software, or any substantial portion of its functionality, as a hosted, managed, software-as-a-service, or similar service to any third party. Hosting the Software for Your own internal use is permitted; hosting it for use by any person or entity outside Your legal entity is not.
+
+**(c) Competitive Use.** Use the Software, in whole or in part, to develop, train, operate, or support any product or service that competes with ContextNest, PromptOwl, or any Licensor product.
+
+**(d) Reverse Engineering.** Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying ideas, algorithms, file formats, or non-public APIs of the Software, except and only to the extent this restriction is expressly prohibited by applicable law.
+
+**(e) Modification.** Modify, adapt, translate, or create derivative works of the Software, except for configuration files and integration code that You author and that are clearly separable from the Software itself.
+
+**(f) Circumvention.** Circumvent, disable, or interfere with any license, authentication, metering, telemetry, or security mechanism of the Software or the Platform, including but not limited to the PromptOwl login requirement.
+
+**(g) Notice Removal.** Remove, obscure, or alter any copyright, trademark, license, or other proprietary notice contained in or displayed by the Software.
+
+**(h) Trademark Use.** Use the names, logos, or trademarks of Licensor, including "PromptOwl," "ContextNest," or any confusingly similar mark, in any forked, modified, or derivative distribution, or in a manner suggesting endorsement, affiliation, or sponsorship that does not exist.
+
+**(i) Unlawful Use.** Use the Software in violation of any applicable law or regulation, or in any manner that violates the Acceptable Use Policy.
+
+**(j) Regulated Industry Use.** Use the Software in environments subject to HIPAA, FISMA, GLBA, PCI-DSS, or similar industry-specific regulations, unless You have obtained express written authorization from Licensor. The Software is not certified for such environments.
+
+## 4. Ownership and Intellectual Property
+
+The Software is licensed, not sold. Licensor and its licensors retain all right, title, and interest in and to the Software, including all intellectual property rights therein. No rights are granted to You other than those expressly set forth in this License. All rights not expressly granted are reserved by Licensor. "PromptOwl" and "ContextNest" are trademarks of Promptowl LLC.
+
+## 5. Account Requirement and Suspension
+
+The Software's functionality is conditioned on a valid, active PromptOwl account in good standing. Licensor may suspend, terminate, or restrict account access (and, consequently, Software functionality) in accordance with the Platform Terms. Termination or suspension of Your PromptOwl account does not, by itself, waive Licensor's rights under this License.
+
+## 6. Updates
+
+Licensor may, but is not obligated to, provide updates, patches, or new versions of the Software. Any such update is deemed part of the Software and is governed by this License unless accompanied by a separate license.
+
+## 7. Third-Party Components
+
+The Software may include or depend upon open-source or third-party components, each of which is governed by its own license. A listing of such components and their licenses is provided in the Software distribution or in accompanying documentation. Nothing in this License limits Your rights or obligations under those third-party licenses.
+
+## 8. Commercial Licensing for Restricted Uses
+
+If You wish to use the Software in a manner not permitted by Section 3 — including redistribution, hosting-as-a-service, embedding in a commercial product, or use in regulated-industry environments — You must obtain a separate written commercial license from Licensor. Contact: **hoot@promptowl.ai**.
+
+## 9. Term and Termination
+
+**9.1** This License is effective upon Your first installation or use of the Software and continues until terminated.
+
+**9.2** This License terminates automatically and without notice if You breach any term of this License. Licensor may also terminate this License at any time for material breach upon notice.
+
+**9.3** Upon termination, You shall immediately (i) cease all use of the Software, (ii) delete or destroy all copies of the Software in Your possession or control, and (iii) certify such destruction in writing upon Licensor's request.
+
+**9.4** Sections 3, 4, 9.3, 10, 11, 12, 13, and 14 survive termination.
+
+## 10. Disclaimer of Warranties
+
+THE SOFTWARE IS PROVIDED **"AS IS"** AND **"AS AVAILABLE,"** WITHOUT WARRANTY OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, OR UNINTERRUPTED OPERATION. LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, OR BE ERROR-FREE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, IN WHICH CASE THE FOREGOING EXCLUSIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
+
+## 11. AI Output Disclaimer
+
+The Software enables the creation, storage, retrieval, and injection of content into large language models and other AI systems. Licensor makes no representation or warranty regarding the accuracy, legality, completeness, appropriateness, or non-infringement of any output generated by such systems. You are solely responsible for reviewing, validating, and determining the fitness of AI-generated output for Your intended use. You agree not to deploy the Software in high-risk contexts (including medical, legal, financial advisory, safety-critical, or life-critical environments) without appropriate human oversight and independent safeguards.
+
+## 12. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL LICENSOR, ITS AFFILIATES, OR ITS LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+LICENSOR'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS LICENSE OR THE SOFTWARE SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US $100.00) OR THE AMOUNT PAID BY YOU TO LICENSOR FOR THE SOFTWARE IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, WHICHEVER IS GREATER.
+
+THE LIMITATIONS IN THIS SECTION APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS OF LIABILITY, IN WHICH CASE THE FOREGOING LIMITATIONS APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
+
+## 13. Indemnification
+
+You agree to indemnify, defend, and hold harmless Licensor, its affiliates, and its officers, directors, employees, and agents from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to (a) Your use of the Software in breach of this License, (b) Your violation of any applicable law or third-party right, or (c) content or data You process through the Software.
+
+## 14. Governing Law and Venue
+
+This License is governed by the laws of the State of Georgia, United States of America, without regard to its conflict-of-laws principles. The exclusive venue for any dispute arising under or related to this License shall be the state or federal courts located in Fulton County, Georgia, and the parties consent to the personal jurisdiction of such courts. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
+
+## 15. Export Compliance
+
+You represent and warrant that (a) You are not located in a country subject to a U.S. Government embargo or designated as a "terrorist supporting" country, and (b) You are not listed on any U.S. Government list of prohibited or restricted parties. You shall comply with all applicable export-control laws and regulations in Your use of the Software.
+
+## 16. Assignment
+
+You may not assign or transfer this License, in whole or in part, without Licensor's prior written consent. Any attempted assignment in violation of this Section is void. Licensor may assign this License freely.
+
+## 17. Severability and Waiver
+
+If any provision of this License is held unenforceable, the remaining provisions shall remain in full force and effect, and the unenforceable provision shall be reformed to the extent necessary to render it enforceable while preserving the parties' intent. No waiver of any term shall be deemed a waiver of any other term or of a subsequent breach.
+
+## 18. Entire Agreement
+
+This License, together with the Platform Terms to the extent applicable to Your use of the Platform, constitutes the entire agreement between You and Licensor regarding the Software and supersedes all prior or contemporaneous understandings, whether written or oral. Any modification must be in writing and signed by an authorized representative of Licensor.
+
+## 19. Contact
+
+**Promptowl LLC**
+3060 Mercer University Dr Ste 110
+Atlanta, GA 30341, USA
+Email: **hoot@promptowl.ai**
+Web: <https://promptowl.ai>
+
+For commercial licensing inquiries (redistribution, hosted-service offerings, OEM, or regulated-industry use), contact **hoot@promptowl.ai** with subject line "ContextNest Commercial License."
+
+---
+
+*"ContextNest" and "PromptOwl" are trademarks of Promptowl LLC. All rights reserved.*