@aphexcms/cms-core 9.7.0 → 9.8.1

package/dist/server/api/routes/agent-chat.js

@@ -0,0 +1,223 @@
+import { Hono } from 'hono';
+import { streamSSE } from 'hono/streaming';
+import { z } from 'zod';
+import { agentChatRequest } from '../../../api/schemas/agent-chat.js';
+import { recordWorkspaceOperationRequest } from '../../../api/schemas/agent-operations.js';
+import { authToContext } from '../../../local-api/auth-helpers.js';
+import { resolveAgentTools } from '../../../mcp/tools.js';
+import { runAgentTurn } from '../../../ai/run-agent-turn.js';
+import { DEFAULT_AGENT_SYSTEM_PROMPT } from '../../../ai/default-system-prompt.js';
+import { cmsLogger } from '../../../utils/logger.js';
+const SUMMARY_MAX_LENGTH = 200;
+// A mutating tool's `data` is `unknown` at this boundary (AgentToolResult.data) — every tool
+// returns a different shape (list_collections -> {collections}, upload_asset -> {asset, ...},
+// document tools -> {document, validation}), and this route dispatches by name against
+// whatever's registered, including plugin-contributed tools it's never seen at compile time.
+// There's no static type to give it, so the id is pulled out via a runtime-validated parse
+// (the same idiom `run-agent-turn.ts` already uses for tool arguments) rather than an `as`
+// cast asserting a shape without checking it.
+const toolResultWithDocumentId = z.object({ document: z.object({ id: z.string() }) });
+/** `create_document` has no `id` argument (nothing to reference before it exists) — its new
+ * id only shows up in the result. Falls back to that when the args don't have one, so a
+ * create is still attributable to a document instead of being silently dropped. */
+function resolveDocumentId(args, data) {
+    if (typeof args.id === 'string')
+        return args.id;
+    const parsed = toolResultWithDocumentId.safeParse(data);
+    return parsed.success ? parsed.data.document.id : null;
+}
+/**
+ * Best-effort audit record for one mutating tool call — looks up the two most recent
+ * document-version rows to capture `versionBefore`/`versionAfter` (the version an undo would
+ * restore to, and the one this write produced), then records the operation. Never throws: a
+ * failure to record the audit trail must never break the actual tool call or the SSE stream.
+ * Exported for unit testing — not part of the route's own public surface.
+ */
+export async function recordMutatingOperation(aphexCMS, context, changeSetId, toolName, args, success, error, data) {
+    const collection = typeof args.collection === 'string' ? args.collection : null;
+    // `resolveDocumentId` checks `args.id` first, so a failed update_document/publish_document
+    // (which does have `args.id`) is still attributable — it only falls through to parsing
+    // `data` for the rare case for `create_document`, whose result won't parse on failure anyway.
+    const documentId = resolveDocumentId(args, data);
+    if (!collection || !documentId)
+        return;
+    try {
+        const { databaseAdapter, localAPI } = aphexCMS;
+        const { versions } = await localAPI.versionService.listVersions(databaseAdapter, context.organizationId, documentId, { limit: 2 });
+        const [versionAfter, versionBefore] = versions;
+        await databaseAdapter.recordOperation({
+            changeSetId,
+            organizationId: context.organizationId,
+            collection,
+            documentId,
+            toolName,
+            arguments: args,
+            success,
+            error,
+            versionBefore: versionBefore?.versionNumber ?? null,
+            versionAfter: versionAfter?.versionNumber ?? null
+        });
+    }
+    catch (err) {
+        cmsLogger.error('[agent-chat] failed to record agent operation (continuing):', err);
+    }
+}
+export const agentChatRouter = new Hono();
+/**
+ * POST /api/agent/chat — the in-admin agent's streaming chat endpoint (Milestone 2 item 5
+ * of references/content-copilot-phase-1-plan.md). Stateless per call: the browser sends
+ * the full running conversation each time (conversation persistence is a separate,
+ * not-yet-built piece — see the plan). Requires an authenticated session; individual tool
+ * calls are separately capability-gated by `resolveAgentTools`/each tool's own checks —
+ * this endpoint is a dumb transport over the same tool-execution service MCP uses, not an
+ * additional authorization layer.
+ *
+ * 404s (rather than 401) when no `aiProvider` is configured, so the route doesn't exist as
+ * a surface at all on an instance that hasn't opted in — same "don't advertise an unset
+ * feature" posture as `workers-run.ts`'s worker secret gate.
+ *
+ * Also records an audit/undo trail (`cms_agent_change_sets`/`cms_agent_operations`): a
+ * change-set row is created eagerly for every turn (so token usage is captured even for a
+ * pure Q&A turn with no mutations), and every mutating tool call gets an operation row. All
+ * of this recording is best-effort — see `recordMutatingOperation` above and the try/catch
+ * around change-set creation/completion below — a failure here must never break the chat.
+ */
+agentChatRouter.post('/chat', async (c) => {
+    const { aphexCMS, auth } = c.var;
+    const { aiProvider, agentModel } = aphexCMS.config;
+    const { databaseAdapter } = aphexCMS;
+    if (!aiProvider)
+        return c.json({ success: false, error: 'Not found' }, 404);
+    if (!auth)
+        return c.json({ success: false, error: 'Unauthorized' }, 401);
+    if (!agentModel) {
+        return c.json({ success: false, error: 'Server misconfigured: no agentModel configured for aiProvider' }, 501);
+    }
+    const body = await c.req.json().catch(() => null);
+    const parsed = agentChatRequest.safeParse(body);
+    if (!parsed.success) {
+        return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+    }
+    const context = authToContext(auth);
+    const tools = resolveAgentTools({ aphexCMS, context }, { documentContext: parsed.data.documentContext });
+    const toolsByName = new Map(tools.map((t) => [t.definition.name, t]));
+    const model = parsed.data.model ?? agentModel;
+    const abortController = new AbortController();
+    // A turn paused for a workspace tool resumes as a brand-new HTTP request (see
+    // `types/agent-stream.ts`) — the client echoes back the change-set id from the leg that
+    // paused so every leg of one logical turn records against the same row, instead of a
+    // fresh `cms_agent_change_sets` row per leg.
+    let changeSetId = parsed.data.changeSetId ?? null;
+    if (!changeSetId) {
+        try {
+            const firstUserMessage = parsed.data.messages.find((m) => m.role === 'user')?.content ?? '';
+            const changeSet = await databaseAdapter.createChangeSet({
+                organizationId: context.organizationId,
+                createdBy: context.user?.id ?? null,
+                summary: firstUserMessage.slice(0, SUMMARY_MAX_LENGTH) || null,
+                provider: aiProvider.name,
+                model
+            });
+            changeSetId = changeSet.id;
+        }
+        catch (err) {
+            cmsLogger.error('[agent-chat] failed to create change-set (continuing without one):', err);
+        }
+    }
+    return streamSSE(c, async (stream) => {
+        c.req.raw.signal.addEventListener('abort', () => abortController.abort());
+        let promptTokens = parsed.data.priorUsage?.promptTokens ?? 0;
+        let completionTokens = parsed.data.priorUsage?.completionTokens ?? 0;
+        let turnFailed = false;
+        let turnPaused = false;
+        // toolCall args aren't repeated on the matching toolResult event, so stash them here
+        // to correlate the two when it's time to record a mutating operation.
+        const argsByToolCallId = new Map();
+        try {
+            for await (const event of runAgentTurn({
+                aiProvider,
+                model,
+                messages: parsed.data.messages,
+                tools,
+                toolContext: { aphexCMS, context },
+                systemPrompt: aphexCMS.config.agentSystemPrompt ?? DEFAULT_AGENT_SYSTEM_PROMPT,
+                signal: abortController.signal
+            })) {
+                if (event.type === 'usage') {
+                    promptTokens += event.promptTokens;
+                    completionTokens += event.completionTokens;
+                }
+                else if (event.type === 'toolCall') {
+                    argsByToolCallId.set(event.toolCallId, event.arguments);
+                }
+                else if (event.type === 'toolResult' && changeSetId) {
+                    const tool = toolsByName.get(event.name);
+                    const args = argsByToolCallId.get(event.toolCallId);
+                    if (tool?.definition.mutates && args) {
+                        await recordMutatingOperation(aphexCMS, context, changeSetId, event.name, args, event.success, event.error, event.data);
+                    }
+                }
+                else if (event.type === 'error') {
+                    turnFailed = true;
+                }
+                if (event.type === 'done') {
+                    event.changeSetId = changeSetId;
+                    if (event.finishReason === 'awaiting_workspace_tool')
+                        turnPaused = true;
+                }
+                await stream.writeSSE({ data: JSON.stringify(event) });
+            }
+        }
+        catch (err) {
+            turnFailed = true;
+            cmsLogger.error('[agent-chat] turn failed:', err);
+            await stream.writeSSE({
+                data: JSON.stringify({
+                    type: 'error',
+                    message: err instanceof Error ? err.message : 'Unknown error'
+                })
+            });
+        }
+        finally {
+            // A paused leg isn't the end of the turn — the client resumes with the same
+            // changeSetId, and only the truly-terminal leg should mark the change-set complete.
+            if (changeSetId && !turnPaused) {
+                try {
+                    await databaseAdapter.completeChangeSet(context.organizationId, changeSetId, {
+                        status: turnFailed ? 'failed' : 'completed',
+                        promptTokens,
+                        completionTokens
+                    });
+                }
+                catch (err) {
+                    cmsLogger.error('[agent-chat] failed to complete change-set (continuing):', err);
+                }
+            }
+        }
+    });
+});
+/**
+ * POST /api/agent/operations — records an audit/undo row for a tool the *client* executed
+ * against a live `DocumentWorkspace` (the `content_patch_fields`/`content_save_draft` bridge
+ * tools — see `ai/content-workspace-tools.ts`). `agent-chat.ts`'s own `recordMutatingOperation`
+ * call above only sees tool results resolved server-side inside `runAgentTurn`'s loop, so a
+ * workspace tool's result — resolved client-side after a paused turn — needs this separate
+ * path to reach the same `cms_agent_change_sets`/`cms_agent_operations` tables. Same
+ * session-authenticated posture as `/chat`; not itself a mutation of document data (the
+ * client already made that call directly via the normal document API), purely bookkeeping.
+ */
+agentChatRouter.post('/operations', async (c) => {
+    const { aphexCMS, auth } = c.var;
+    if (!aphexCMS.config.aiProvider)
+        return c.json({ success: false, error: 'Not found' }, 404);
+    if (!auth)
+        return c.json({ success: false, error: 'Unauthorized' }, 401);
+    const body = await c.req.json().catch(() => null);
+    const parsed = recordWorkspaceOperationRequest.safeParse(body);
+    if (!parsed.success) {
+        return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+    }
+    const context = authToContext(auth);
+    await recordMutatingOperation(aphexCMS, context, parsed.data.changeSetId, parsed.data.toolName, { collection: parsed.data.collection, id: parsed.data.id, ...parsed.data.arguments }, parsed.data.success, parsed.data.error, parsed.data.data);
+    return c.json({ success: true });
+});

package/dist/server/api/routes/document-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAiK/C,CAAC"}
+{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/document-versions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAsL/C,CAAC"}

package/dist/server/api/routes/document-versions.js

@@ -3,7 +3,8 @@ import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { hasCapability } from '../../../types/capabilities.js';
-import { listVersionsQuery } from '../../../api/schemas/documents.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
+import { listVersionsQuery, restoreVersionRequest } from '../../../api/schemas/documents.js';
 export const documentVersionsRouter = new Hono()
     .get('/:id/versions', zValidator('query', listVersionsQuery, (result, c) => {
     if (!result.success) {
@@ -103,7 +104,12 @@ export const documentVersionsRouter = new Hono()
         if (isNaN(versionNumber)) {
             return c.json({ success: false, error: 'Version must be a number' }, 400);
         }
-        const document = await localAPI.versionService.restoreVersion(databaseAdapter, context.organizationId, id, versionNumber, context.user?.id);
+        const body = await c.req.json().catch(() => ({}));
+        const parsed = restoreVersionRequest.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+        }
+        const document = await localAPI.versionService.restoreVersion(databaseAdapter, context.organizationId, id, versionNumber, context.user?.id, parsed.data.expectedRevision);
         if (!document) {
             return c.json({ success: false, error: 'Version not found or restore failed' }, 404);
         }
@@ -115,6 +121,14 @@ export const documentVersionsRouter = new Hono()
     }
     catch (error) {
         cmsLogger.error('Failed to restore document version:', error);
+        if (error instanceof RevisionConflictError) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: error.message,
+                currentRevision: error.currentRevision
+            }, 409);
+        }
         return c.json({ success: false, error: 'Failed to restore version' }, 500);
     }
 });

package/dist/server/api/routes/documents-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAqN5C,CAAC"}
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAiO5C,CAAC"}

package/dist/server/api/routes/documents-by-id.js

@@ -3,6 +3,7 @@ import { zValidator } from '@hono/zod-validator';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { PermissionError } from '../../../local-api/permissions.js';
 import { SingletonOperationError } from '../../../local-api/collection-api.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
 import { cmsLogger } from '../../../utils/logger.js';
 import { updateDocumentRequest } from '../../../api/schemas/documents.js';
 export const documentsByIdRouter = new Hono()
@@ -82,7 +83,8 @@ export const documentsByIdRouter = new Hono()
             }, 400);
         }
         const result = await collection.update(context, id, documentData, {
-            publish: shouldPublish
+            publish: shouldPublish,
+            expectedRevision: parsed.expectedRevision
         });
         if (!result) {
             return c.json({ success: false, error: 'Document not found' }, 404);
@@ -98,6 +100,14 @@ export const documentsByIdRouter = new Hono()
         if (error instanceof PermissionError) {
             return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
+        if (error instanceof RevisionConflictError) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: error.message,
+                currentRevision: error.currentRevision
+            }, 409);
+        }
         if (error instanceof Error && error.message.includes('validation errors')) {
             return c.json({ success: false, error: 'Validation failed', message: error.message }, 400);
         }

package/dist/server/api/routes/documents-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAoR/C,CAAC"}
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/documents-publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkU/C,CAAC"}

package/dist/server/api/routes/documents-publish.js

@@ -1,8 +1,9 @@
 import { Hono } from 'hono';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { PermissionError } from '../../../local-api/permissions.js';
+import { RevisionConflictError } from '../../../db/interfaces/index.js';
 import { cmsLogger } from '../../../utils/logger.js';
-import { scheduleDocumentRequest } from '../../../api/schemas/documents.js';
+import { scheduleDocumentRequest, publishDocumentRequest, unpublishDocumentRequest } from '../../../api/schemas/documents.js';
 export const documentsPublishRouter = new Hono()
     .post('/:id/schedule', async (c) => {
     try {
@@ -141,7 +142,16 @@ export const documentsPublishRouter = new Hono()
                 message: `Collection '${found.type}' not found`
             }, 400);
         }
-        const publishedDocument = await collection.publish(context, id);
+        // Body is optional — a bare POST with no body is still valid, only
+        // carries the CAS guard when the caller has one to send.
+        const body = await c.req.json().catch(() => ({}));
+        const parsed = publishDocumentRequest.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+        }
+        const publishedDocument = await collection.publish(context, id, {
+            expectedRevision: parsed.data.expectedRevision
+        });
         if (!publishedDocument) {
             return c.json({
                 success: false,
@@ -160,6 +170,14 @@ export const documentsPublishRouter = new Hono()
         if (error instanceof PermissionError) {
             return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
+        if (error instanceof RevisionConflictError) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: error.message,
+                currentRevision: error.currentRevision
+            }, 409);
+        }
         if (error instanceof Error && error.message.includes('validation errors')) {
             return c.json({
                 success: false,
@@ -202,7 +220,14 @@ export const documentsPublishRouter = new Hono()
                 message: `Collection '${found.type}' not found`
             }, 400);
         }
-        const unpublishedDocument = await collection.unpublish(context, id);
+        const body = await c.req.json().catch(() => ({}));
+        const parsed = unpublishDocumentRequest.safeParse(body);
+        if (!parsed.success) {
+            return c.json({ success: false, error: 'Invalid request', issues: parsed.error.issues }, 400);
+        }
+        const unpublishedDocument = await collection.unpublish(context, id, {
+            expectedRevision: parsed.data.expectedRevision
+        });
         if (!unpublishedDocument) {
             return c.json({
                 success: false,
@@ -221,6 +246,14 @@ export const documentsPublishRouter = new Hono()
         if (error instanceof PermissionError) {
             return c.json({ success: false, error: 'Forbidden', message: error.message }, 403);
         }
+        if (error instanceof RevisionConflictError) {
+            return c.json({
+                success: false,
+                error: 'Conflict',
+                message: error.message,
+                currentRevision: error.currentRevision
+            }, 409);
+        }
         return c.json({
             success: false,
             error: 'Failed to unpublish document',

package/dist/server/api/routes/jobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4CzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAiDnC,CAAC"}
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA6CzC,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,QAAQ,CAkDnC,CAAC"}

package/dist/server/api/routes/jobs.js

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { authToContext } from '../../../local-api/auth-helpers.js';
 import { hasCapability } from '../../../types/capabilities.js';
 import { cmsLogger } from '../../../utils/logger.js';
+import { withCreatedByNames } from './resolve-created-by.js';
 // Read-only history / observability for the durable spine. Gated on `document.read`:
 // the operational log of publish work is visible to anyone who can read content.
 // Mirrors JobStatus (types/events) as a zod enum — the API contract's source of truth.
@@ -76,14 +77,15 @@ export const jobsRouter = new Hono()
             return c.json({ success: false, error: 'Invalid query', issues: parsed.error.issues }, 400);
         }
         const { type, limit, offset } = parsed.data;
-        const { databaseAdapter } = c.var.aphexCMS;
+        const { databaseAdapter, auth } = c.var.aphexCMS;
         const page = await databaseAdapter.listEvents({
             organizationId: gate.organizationId,
             type,
             limit,
             offset
         });
-        return c.json({ success: true, data: page.items, pagination: toPagination(page) });
+        const items = await withCreatedByNames(page.items, auth);
+        return c.json({ success: true, data: items, pagination: toPagination(page) });
     }
     catch (error) {
         cmsLogger.error('Failed to list events:', error);

package/dist/server/api/routes/resolve-created-by.d.ts

@@ -0,0 +1,13 @@
+import type { AuthProvider } from '../../../auth/provider.js';
+/**
+ * Resolves `createdBy` user ids on a list of rows to a display name (or `'API Key'` for a
+ * `apikey:<id>` synthetic id — see `authToContext`'s API-key branch). Shared by every
+ * read-only history view (`GET /api/events`, `GET /api/agent/change-sets`, ...) — an audit
+ * trail whose whole point is accountability needs to show *who*, not a raw id.
+ */
+export declare function withCreatedByNames<T extends {
+    createdBy: string | null;
+}>(rows: T[], auth: AuthProvider | undefined): Promise<Array<T & {
+    createdByName: string | null;
+}>>;
+//# sourceMappingURL=resolve-created-by.d.ts.map

package/dist/server/api/routes/resolve-created-by.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-created-by.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/resolve-created-by.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC9E,IAAI,EAAE,CAAC,EAAE,EACT,IAAI,EAAE,YAAY,GAAG,SAAS,GAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG;IAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAyBtD"}

package/dist/server/api/routes/resolve-created-by.js

@@ -0,0 +1,30 @@
+/**
+ * Resolves `createdBy` user ids on a list of rows to a display name (or `'API Key'` for a
+ * `apikey:<id>` synthetic id — see `authToContext`'s API-key branch). Shared by every
+ * read-only history view (`GET /api/events`, `GET /api/agent/change-sets`, ...) — an audit
+ * trail whose whole point is accountability needs to show *who*, not a raw id.
+ */
+export async function withCreatedByNames(rows, auth) {
+    const userIds = [...new Set(rows.map((r) => r.createdBy).filter((id) => !!id))];
+    const userMap = new Map();
+    if (userIds.length > 0 && auth) {
+        await Promise.all(userIds.map(async (userId) => {
+            if (userId.startsWith('apikey:')) {
+                userMap.set(userId, 'API Key');
+                return;
+            }
+            try {
+                const user = await auth.getUserById(userId);
+                if (user)
+                    userMap.set(userId, user.name || user.email);
+            }
+            catch {
+                // User not found — skip
+            }
+        }));
+    }
+    return rows.map((r) => ({
+        ...r,
+        createdByName: r.createdBy ? (userMap.get(r.createdBy) ?? null) : null
+    }));
+}

package/dist/server/index.d.ts

@@ -2,6 +2,7 @@ export * from '../types/index.js';
 export * from '../auth/provider.js';
 export * from '../cache/index.js';
 export * from '../email/index.js';
+export * from '../ai/index.js';
 export { AuthError, type AuthErrorCode } from '../auth/auth-errors.js';
 export { createCMSConfig } from '../config.js';
 export { cmsLogger, setLogger, type Logger } from '../utils/logger.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAC;AAE/B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC;AAE/B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxF,cAAc,wBAAwB,CAAC;AAGvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAG7C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI5D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG/F,cAAc,eAAe,CAAC;AAG9B,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EACN,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,QAAQ,EACR,cAAc,EACd,WAAW,EACX,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACN,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,MAAM,cAAc,CAAC"}

package/dist/server/index.js

@@ -5,6 +5,7 @@ export * from '../types/index.js';
 export * from '../auth/provider.js';
 export * from '../cache/index.js';
 export * from '../email/index.js';
+export * from '../ai/index.js';
 // Authentication errors
 export { AuthError } from '../auth/auth-errors.js';
 // Configuration system

package/dist/services/references-service.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseAdapter } from '../db/interfaces.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
 import type { SchemaType } from '../types/schemas.js';
 /**
  * Maintains the back-reference index. After every doc save the collection-API

package/dist/services/references-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}
+{"version":3,"file":"references-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/references-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACjB,OAAO,CAAC,eAAe;gBAAf,eAAe,EAAE,eAAe;IAEpD;;;OAGG;IACG,iBAAiB,CACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,QAAQ,EAAE,UAAU,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;OAOG;IACG,eAAe,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EAAE,EACrB,gBAAgB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,GACjF,OAAO,CAAC,IAAI,CAAC;CAwBhB"}

package/dist/services/version-service.d.ts

@@ -27,7 +27,7 @@ export declare class VersionService {
      * Publish + snapshot on an already-transactional adapter. Caller owns the tx
      * and retention. Returns the published document (or null if publish was a no-op).
      */
-    publishTx(tx: DatabaseAdapter, organizationId: string, documentId: string): Promise<Document | null>;
+    publishTx(tx: DatabaseAdapter, organizationId: string, documentId: string, expectedRevision?: number): Promise<Document | null>;
     /**
      * Public retention trigger for callers that manage their own transaction and
      * therefore can't rely on `saveWithVersion`/`publishWithVersion` to run it.
@@ -36,15 +36,15 @@ export declare class VersionService {
     /**
      * Save draft and create version atomically using adapter transaction.
      */
-    saveWithVersion(db: DatabaseAdapter, organizationId: string, documentId: string, data: any, userId?: string): Promise<Document | null>;
+    saveWithVersion(db: DatabaseAdapter, organizationId: string, documentId: string, data: any, userId?: string, expectedRevision?: number): Promise<Document | null>;
     /**
      * Publish and create version.
      */
-    publishWithVersion(db: DatabaseAdapter, organizationId: string, documentId: string): Promise<Document | null>;
+    publishWithVersion(db: DatabaseAdapter, organizationId: string, documentId: string, expectedRevision?: number): Promise<Document | null>;
     /**
      * Restore a version to draft. Creates a 'draft' version entry.
      */
-    restoreVersion(db: DatabaseAdapter, organizationId: string, documentId: string, versionNumber: number, userId?: string): Promise<Document | null>;
+    restoreVersion(db: DatabaseAdapter, organizationId: string, documentId: string, versionNumber: number, userId?: string, expectedRevision?: number): Promise<Document | null>;
     listVersions(db: DatabaseAdapter, organizationId: string, documentId: string, options?: {
         limit?: number;
         offset?: number;

package/dist/services/version-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG7E;;;;;;GAMG;AACH,qBAAa,cAAc;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAI9C;;OAEG;IACG,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAelC;;;;OAIG;IACG,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC;IAWhB;;;OAGG;IACG,SAAS,CACd,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAoB3B;;;OAGG;IACG,mBAAmB,CACxB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAgB3B;;OAEG;IACG,kBAAkB,CACvB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiB3B;;OAEG;IACG,cAAc,CACnB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA0BrB,YAAY,CACjB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC;IAKzB,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAKpB,gBAAgB;CAuB9B"}
+{"version":3,"file":"version-service.d.ts","sourceRoot":"","sources":["../../src/lib/services/version-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG7E;;;;;;GAMG;AACH,qBAAa,cAAc;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAI9C;;OAEG;IACG,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAelC;;;;OAIG;IACG,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC;IAWhB;;;OAGG;IACG,SAAS,CACd,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAoB3B;;;OAGG;IACG,mBAAmB,CACxB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,GAAG,EACT,MAAM,CAAC,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAwB3B;;OAEG;IACG,kBAAkB,CACvB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiB3B;;OAEG;IACG,cAAc,CACnB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA6BrB,YAAY,CACjB,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,mBAAmB,CAAC;IAKzB,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAKpB,gBAAgB;CAuB9B"}

package/dist/services/version-service.js

@@ -47,8 +47,8 @@ export class VersionService {
      * Publish + snapshot on an already-transactional adapter. Caller owns the tx
      * and retention. Returns the published document (or null if publish was a no-op).
      */
-    async publishTx(tx, organizationId, documentId) {
-        const result = await tx.publishDoc(organizationId, documentId);
+    async publishTx(tx, organizationId, documentId, expectedRevision) {
+        const result = await tx.publishDoc(organizationId, documentId, expectedRevision);
         if (result) {
             await this.snapshotTx(tx, organizationId, documentId, 'publish', result.publishedData, result.updatedBy);
             // Transactional outbox: record the durable fact in the same tx as the publish, so
@@ -69,13 +69,15 @@ export class VersionService {
     /**
      * Save draft and create version atomically using adapter transaction.
      */
-    async saveWithVersion(db, organizationId, documentId, data, userId) {
+    async saveWithVersion(db, organizationId, documentId, data, userId, expectedRevision) {
         // No versioning support: a single write, atomic on its own.
         if (!db.createDocumentVersion) {
-            return db.updateDocDraft(organizationId, documentId, data, userId);
+            return db.updateDocDraft(organizationId, documentId, data, userId, expectedRevision);
         }
+        // RevisionConflictError propagates out of the transaction un-swallowed —
+        // callers must surface it distinctly from a validation error.
         const updated = await db.withTransaction(async (txAdapter) => {
-            const result = await txAdapter.updateDocDraft(organizationId, documentId, data, userId);
+            const result = await txAdapter.updateDocDraft(organizationId, documentId, data, userId, expectedRevision);
             if (result)
                 await this.snapshotTx(txAdapter, organizationId, documentId, 'draft', data, userId);
             return result;
@@ -87,15 +89,15 @@ export class VersionService {
     /**
      * Publish and create version.
      */
-    async publishWithVersion(db, organizationId, documentId) {
+    async publishWithVersion(db, organizationId, documentId, expectedRevision) {
         // Publish + version snapshot must commit together: a crash between them
         // would leave a published document with no 'publish' version row. Mirror
         // saveWithVersion / restoreVersion and run both writes in one transaction.
         // No versioning support: a single write, atomic on its own.
         if (!db.createDocumentVersion) {
-            return db.publishDoc(organizationId, documentId);
+            return db.publishDoc(organizationId, documentId, expectedRevision);
         }
-        const published = await db.withTransaction((txAdapter) => this.publishTx(txAdapter, organizationId, documentId));
+        const published = await db.withTransaction((txAdapter) => this.publishTx(txAdapter, organizationId, documentId, expectedRevision));
         if (published)
             await this.enforceRetention(db, documentId, organizationId);
         return published;
@@ -103,18 +105,20 @@ export class VersionService {
     /**
      * Restore a version to draft. Creates a 'draft' version entry.
      */
-    async restoreVersion(db, organizationId, documentId, versionNumber, userId) {
+    async restoreVersion(db, organizationId, documentId, versionNumber, userId, expectedRevision) {
         if (!db.getDocumentVersion)
             return null;
         const version = await db.getDocumentVersion(organizationId, documentId, versionNumber);
         if (!version)
             return null;
+        // A restore is itself a draft write — just as capable of clobbering a
+        // concurrent edit as a normal save, so it goes through the same CAS guard.
         // No versioning support: a single write, atomic on its own.
         if (!db.createDocumentVersion) {
-            return db.updateDocDraft(organizationId, documentId, version.data, userId);
+            return db.updateDocDraft(organizationId, documentId, version.data, userId, expectedRevision);
         }
         const restored = await db.withTransaction(async (txAdapter) => {
-            const result = await txAdapter.updateDocDraft(organizationId, documentId, version.data, userId);
+            const result = await txAdapter.updateDocDraft(organizationId, documentId, version.data, userId, expectedRevision);
             if (result)
                 await this.snapshotTx(txAdapter, organizationId, documentId, 'draft', version.data, userId);
             return result;

package/dist/type-gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-gen.d.ts","sourceRoot":"","sources":["../src/lib/type-gen.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAoJzD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAG3E;AA6VD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CA8I3D;AAgGD,wBAAsB,uBAAuB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoDf"}
+{"version":3,"file":"type-gen.d.ts","sourceRoot":"","sources":["../src/lib/type-gen.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAoJzD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAG3E;AA6VD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CA8I3D;AA2GD,wBAAsB,uBAAuB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoDf"}