@musnows/scriverse 0.3.8 → 0.3.10

package/dist/app.js

@@ -26,6 +26,7 @@ import { createRequestLoggingMiddleware, sanitizeRequestPath } from "./http-logg
 import { accountReference, logger, sanitizeError } from "./logger.js";
 import { runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
+import { fullWorkModulePermissions } from "./work-permissions.js";
 import { clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
 const identifier = z.string().trim().min(1).max(200);
@@ -55,11 +56,33 @@ const loginSchema = z.object({
     ...captchaFields
 }).strict();
 const userUpdateSchema = z.object({ role: z.enum(["admin", "user"]).optional(), status: z.enum(["active", "disabled"]).optional() }).strict();
-const memberSchema = z.object({ userId: identifier, role: z.enum(["editor", "viewer"]) }).strict();
-const memberRoleSchema = z.object({ role: z.enum(["editor", "viewer"]) }).strict();
+const memberRoleValueSchema = z.enum(["editor", "settings-editor", "viewer"]);
+const moduleAccessSchema = z.enum(["none", "read", "write"]);
+const modulePermissionsSchema = z.object({
+    prose: moduleAccessSchema,
+    settings: moduleAccessSchema,
+    characters: moduleAccessSchema,
+    races: moduleAccessSchema,
+    organizations: moduleAccessSchema,
+    timeline: moduleAccessSchema,
+    relationships: moduleAccessSchema,
+    outlines: moduleAccessSchema,
+    reviews: moduleAccessSchema,
+    ai: moduleAccessSchema,
+    "ai-settings": moduleAccessSchema
+}).strict();
+const memberSchema = z.union([
+    z.object({ userId: identifier, permissions: modulePermissionsSchema }).strict(),
+    z.object({ userId: identifier, role: memberRoleValueSchema }).strict()
+]);
+const memberPermissionSchema = z.union([
+    z.object({ permissions: modulePermissionsSchema }).strict(),
+    z.object({ role: memberRoleValueSchema }).strict()
+]);
 const profileSchema = z.object({ displayName: z.string().trim().min(1).max(80) }).strict();
 const passwordChangeSchema = z.object({ currentPassword: z.string().max(200), newPassword: passwordSchema }).strict();
 const changeNoteSchema = z.string().trim().max(500).optional();
+const expectedVersionNoSchema = z.coerce.number().int().positive().optional();
 function validateImportedText(text) {
     if (text.length > maximumImportedTextLength)
         throw new AppError(413, "IMPORT_TEXT_TOO_LARGE", "导入文件解压后的文本超过 2000 万字符限制");
@@ -174,7 +197,7 @@ const organizationSchema = z.object({
     description: z.string().max(100_000).optional(),
     settings: z.array(z.string().trim().min(1).max(20_000)).max(200).optional(),
     memberIds: z.array(identifier).max(1000).optional()
-});
+}).strict();
 const raceSchema = z.object({
     name: nonEmpty.max(200),
     parentRaceId: identifier.nullable().optional(),
@@ -302,6 +325,55 @@ function noContent(response) {
 function parse(schema, value) {
     return schema.parse(value);
 }
+function recordValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function mapRecords(value, mapper) {
+    if (Array.isArray(value))
+        return value.map((item) => recordValue(item) ? mapper(item) : item);
+    const record = recordValue(value);
+    if (!record)
+        return value;
+    if (Array.isArray(record.items)) {
+        return { ...record, items: record.items.map((item) => recordValue(item) ? mapper(item) : item) };
+    }
+    return mapper(record);
+}
+function redactCharacterLinks(record, permissions) {
+    const result = { ...record };
+    if (permissions.races === "none") {
+        result.raceId = null;
+        result.race = null;
+        result.species = "";
+    }
+    if (permissions.organizations === "none") {
+        result.organizationIds = [];
+        result.organizations = [];
+    }
+    return result;
+}
+function redactRaceMembers(record, permissions) {
+    return permissions.characters === "none" ? { ...record, memberIds: [], members: [] } : record;
+}
+function redactOrganizationMembers(record, permissions) {
+    return permissions.characters === "none" ? { ...record, memberIds: [], members: [] } : record;
+}
+function redactMergeRecords(value, mapper) {
+    const record = recordValue(value);
+    if (!record)
+        return value;
+    return {
+        ...record,
+        ...(recordValue(record.target) ? { target: mapper(record.target) } : {}),
+        ...(recordValue(record.source) ? { source: mapper(record.source) } : {})
+    };
+}
+function redactVersionSnapshots(value, mapper) {
+    return mapRecords(value, (version) => {
+        const snapshot = recordValue(version.snapshot);
+        return snapshot ? { ...version, snapshot: mapper(snapshot) } : version;
+    });
+}
 export function createRuntime(options) {
     logger.info("runtime.initializing", {
         databasePath: options.databasePath,
@@ -318,6 +390,14 @@ export function createRuntime(options) {
     mkdirSync(attachmentStorage.temporaryDirectory, { recursive: true, mode: 0o700 });
     const auth = new UserAuthService(database);
     const store = new Store(database);
+    const requestPermissions = (request, workId) => {
+        if (!request.authUser)
+            return fullWorkModulePermissions();
+        const resolvedWorkId = workId ?? auth.resolveWorkId(request.path) ?? undefined;
+        if (!resolvedWorkId)
+            return fullWorkModulePermissions();
+        return auth.workModulePermissions(request.authUser, resolvedWorkId, request.authMethod !== "api-key") ?? fullWorkModulePermissions();
+    };
     const captcha = new ImageCaptchaService({ revealAnswer: options.revealCaptchaAnswer === true });
     const ai = new AiManager(store, new CredentialVault(options.masterSecret), options.fetchImpl ?? fetch, options.security ? (url) => assertSafeAiEndpoint(url, options.security?.allowPrivateAiEndpoints) : undefined);
     const app = express();
@@ -535,24 +615,43 @@ export function createRuntime(options) {
         if (!request.authUser)
             throw new AppError(401, "AUTH_REQUIRED", "请先登录");
         const input = parse(memberSchema, request.body);
-        const members = auth.addMember(request.params.workId, input.userId, input.role, request.authUser.userId);
-        store.audit(request.params.workId, "work.member-added", "user", input.userId, { role: input.role });
+        const permissionInput = "permissions" in input
+            ? { permissions: input.permissions }
+            : { role: input.role };
+        const members = database.transaction(() => {
+            const result = auth.addMember(request.params.workId, input.userId, permissionInput, request.authUser.userId);
+            store.audit(request.params.workId, "work.member-added", "user", input.userId, permissionInput);
+            return result;
+        });
         data(response, members, 201);
     });
     app.patch("/api/works/:workId/members/:userId", (request, response) => {
-        const input = parse(memberRoleSchema, request.body);
-        const members = auth.updateMemberRole(request.params.workId, request.params.userId, input.role);
-        store.audit(request.params.workId, "work.member-role-updated", "user", request.params.userId, { role: input.role });
+        const input = parse(memberPermissionSchema, request.body);
+        const permissionInput = "permissions" in input
+            ? { permissions: input.permissions }
+            : { role: input.role };
+        const members = database.transaction(() => {
+            const result = auth.updateMemberPermissions(request.params.workId, request.params.userId, permissionInput);
+            store.audit(request.params.workId, "work.member-role-updated", "user", request.params.userId, permissionInput);
+            return result;
+        });
         data(response, members);
     });
     app.delete("/api/works/:workId/members/:userId", (request, response) => {
-        const members = auth.removeMember(request.params.workId, request.params.userId);
-        store.audit(request.params.workId, "work.member-removed", "user", request.params.userId);
+        const members = database.transaction(() => {
+            const result = auth.removeMember(request.params.workId, request.params.userId);
+            store.audit(request.params.workId, "work.member-removed", "user", request.params.userId);
+            return result;
+        });
         data(response, members);
     });
-    app.patch("/api/works/:workId", (request, response) => data(response, store.updateWork(request.params.workId, parse(workSchema.partial(), request.body))));
+    app.patch("/api/works/:workId", (request, response) => {
+        const { expectedVersionNo, changeNote, ...input } = parse(workSchema.partial().extend({ expectedVersionNo: expectedVersionNoSchema, changeNote: changeNoteSchema }).strict(), request.body);
+        data(response, store.updateWork(request.params.workId, input, expectedVersionNo, "manual", null, changeNote));
+    });
     app.delete("/api/works/:workId", async (request, response) => {
-        const removableStorageKeys = store.deleteWork(request.params.workId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        const removableStorageKeys = store.deleteWork(request.params.workId, input.expectedVersionNo);
         await Promise.all(removableStorageKeys.map((storageKey) => attachmentStorage.remove(storageKey)));
         noContent(response);
     });
@@ -574,10 +673,12 @@ export function createRuntime(options) {
         const mimeType = isPng ? "image/png" : isJpeg ? "image/jpeg" : isWebp ? "image/webp" : null;
         if (!mimeType)
             throw new AppError(415, "INVALID_COVER", "封面文件内容不是有效的 PNG、JPEG 或 WebP 图片");
-        data(response, store.setWorkCover(String(request.params.workId), mimeType, bytes));
+        const expectedVersionNo = parse(expectedVersionNoSchema, request.body.expectedVersionNo);
+        data(response, store.setWorkCover(String(request.params.workId), mimeType, bytes, expectedVersionNo));
     });
     app.delete("/api/works/:workId/cover", (request, response) => {
-        store.deleteWorkCover(request.params.workId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteWorkCover(request.params.workId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/file-versions", (request, response) => {
@@ -585,7 +686,8 @@ export function createRuntime(options) {
         data(response, pagination ? store.listFileVersionsPage(request.params.workId, pagination) : store.listFileVersions(request.params.workId));
     });
     app.post("/api/works/:workId/file-versions/:fileVersionId/restore", (request, response) => {
-        data(response, store.restoreFileVersion(request.params.workId, request.params.fileVersionId));
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        data(response, store.restoreFileVersion(request.params.workId, request.params.fileVersionId, input.expectedVersionNo));
     });
     app.post("/api/works/:workId/import", upload.single("file"), async (request, response) => {
         if (!request.file)
@@ -599,19 +701,23 @@ export function createRuntime(options) {
             ? await extractDocxText(request.file.buffer)
             : decodeUtf8ImportedText(request.file.buffer));
         const parsed = applyImportFileHints(parseNovelText(text), originalFileName);
-        data(response, store.importNovel(String(request.params.workId), originalFileName, extension.slice(1), parsed), 201);
+        const mode = parse(z.enum(["append", "overwrite"]), request.body.mode ?? "overwrite");
+        const expectedVersionNo = parse(expectedVersionNoSchema, request.body.expectedVersionNo);
+        data(response, store.importNovel(String(request.params.workId), originalFileName, extension.slice(1), parsed, mode, expectedVersionNo), 201);
     });
     app.post("/api/works/:workId/volumes", (request, response) => {
         const input = parse(z.object({ title: nonEmpty.max(200), kind: z.enum(["main", "prequel", "extra", "epilogue", "appendix"]).optional(), description: z.string().max(5_000).optional(), keywords: z.array(nonEmpty.max(100)).max(100).optional() }), request.body);
         data(response, store.createVolume(request.params.workId, input), 201);
     });
     app.patch("/api/volumes/:volumeId", (request, response) => {
-        const input = parse(z.object({ title: nonEmpty.max(200).optional(), kind: z.enum(["main", "prequel", "extra", "epilogue", "appendix"]).optional(), description: z.string().max(5_000).optional(), keywords: z.array(nonEmpty.max(100)).max(100).optional(), sortOrder: z.number().int().min(0).optional() }), request.body);
-        data(response, store.updateVolume(request.params.volumeId, input));
+        const input = parse(z.object({ title: nonEmpty.max(200).optional(), kind: z.enum(["main", "prequel", "extra", "epilogue", "appendix"]).optional(), description: z.string().max(5_000).optional(), keywords: z.array(nonEmpty.max(100)).max(100).optional(), sortOrder: z.number().int().min(0).optional(), expectedVersionNo: expectedVersionNoSchema, changeNote: changeNoteSchema }).strict(), request.body);
+        const { expectedVersionNo, changeNote, ...volumeInput } = input;
+        data(response, store.updateVolume(request.params.volumeId, volumeInput, expectedVersionNo, "manual", null, changeNote));
     });
     app.get("/api/volumes/:volumeId", (request, response) => data(response, store.getVolume(request.params.volumeId)));
     app.delete("/api/volumes/:volumeId", (request, response) => {
-        store.deleteVolume(request.params.volumeId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteVolume(request.params.volumeId, input.expectedVersionNo);
         noContent(response);
     });
     app.post("/api/works/:workId/chapters", (request, response) => {
@@ -620,12 +726,13 @@ export function createRuntime(options) {
     });
     app.get("/api/chapters/:chapterId", (request, response) => data(response, store.getChapter(request.params.chapterId)));
     app.patch("/api/chapters/:chapterId", (request, response) => {
-        const input = parse(z.object({ title: nonEmpty.max(300).optional(), content: z.string().max(2_000_000).optional(), excludedFromAnalysis: z.boolean().optional(), chapterType: chapterTypeSchema.optional(), source: z.enum(["manual", "auto"]).optional(), changeNote: changeNoteSchema }).strict(), request.body);
-        const { source, changeNote, ...chapterInput } = input;
-        data(response, store.saveChapter(request.params.chapterId, chapterInput, source ?? "manual", null, changeNote));
+        const input = parse(z.object({ title: nonEmpty.max(300).optional(), content: z.string().max(2_000_000).optional(), excludedFromAnalysis: z.boolean().optional(), chapterType: chapterTypeSchema.optional(), source: z.enum(["manual", "auto"]).optional(), changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const { source, changeNote, expectedVersionNo, ...chapterInput } = input;
+        data(response, store.saveChapter(request.params.chapterId, chapterInput, source ?? "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/chapters/:chapterId", (request, response) => {
-        store.deleteChapter(request.params.chapterId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteChapter(request.params.chapterId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/chapters/:chapterId/versions", (request, response) => {
@@ -637,12 +744,13 @@ export function createRuntime(options) {
         data(response, pagination ? store.listChapterInsightsPage(request.params.chapterId, pagination) : store.listChapterInsights(request.params.chapterId));
     });
     app.post("/api/chapters/:chapterId/restore", (request, response) => {
-        const input = parse(z.object({ versionNo: z.number().int().positive() }), request.body);
-        data(response, store.restoreChapter(request.params.chapterId, input.versionNo));
+        const input = parse(z.object({ versionNo: z.number().int().positive(), expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.restoreChapter(request.params.chapterId, input.versionNo, input.expectedVersionNo));
     });
     app.post("/api/chapters/:chapterId/move", (request, response) => {
-        const input = parse(z.object({ volumeId: identifier, sortOrder: z.number().int().min(0) }), request.body);
-        data(response, store.moveChapter(request.params.chapterId, input));
+        const input = parse(z.object({ volumeId: identifier, sortOrder: z.number().int().min(0), expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const { expectedVersionNo, ...moveInput } = input;
+        data(response, store.moveChapter(request.params.chapterId, moveInput, expectedVersionNo));
     });
     app.get("/api/works/:workId/outlines", (request, response) => {
         const pagination = parsePagination(request.query);
@@ -650,11 +758,12 @@ export function createRuntime(options) {
     });
     app.get("/api/chapters/:chapterId/outline", (request, response) => data(response, store.getChapterOutline(request.params.chapterId)));
     app.put("/api/chapters/:chapterId/outline", (request, response) => {
-        const { changeNote, ...input } = parse(chapterOutlineSchema.extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.upsertChapterOutline(request.params.chapterId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(chapterOutlineSchema.extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.upsertChapterOutline(request.params.chapterId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/chapters/:chapterId/outline", (request, response) => {
-        store.deleteChapterOutline(request.params.chapterId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteChapterOutline(request.params.chapterId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/foreshadows", (request, response) => {
@@ -672,21 +781,27 @@ export function createRuntime(options) {
     });
     app.get("/api/foreshadows/:foreshadowId", (request, response) => data(response, store.getForeshadow(request.params.foreshadowId)));
     app.patch("/api/foreshadows/:foreshadowId", (request, response) => {
-        const { changeNote, ...input } = parse(foreshadowSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateForeshadow(request.params.foreshadowId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(foreshadowSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateForeshadow(request.params.foreshadowId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/foreshadows/:foreshadowId", (request, response) => {
-        store.deleteForeshadow(request.params.foreshadowId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteForeshadow(request.params.foreshadowId, input.expectedVersionNo);
         noContent(response);
     });
     app.post("/api/foreshadows/:foreshadowId/occurrences", (request, response) => {
-        data(response, store.createForeshadowOccurrence(request.params.foreshadowId, parse(foreshadowOccurrenceSchema, request.body)), 201);
+        const input = parse(foreshadowOccurrenceSchema.extend({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const { expectedVersionNo, ...occurrenceInput } = input;
+        data(response, store.createForeshadowOccurrence(request.params.foreshadowId, occurrenceInput, expectedVersionNo), 201);
     });
     app.patch("/api/foreshadow-occurrences/:occurrenceId", (request, response) => {
-        data(response, store.updateForeshadowOccurrence(request.params.occurrenceId, parse(foreshadowOccurrenceSchema.partial(), request.body)));
+        const input = parse(foreshadowOccurrenceSchema.partial().extend({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const { expectedVersionNo, ...occurrenceInput } = input;
+        data(response, store.updateForeshadowOccurrence(request.params.occurrenceId, occurrenceInput, expectedVersionNo));
     });
     app.delete("/api/foreshadow-occurrences/:occurrenceId", (request, response) => {
-        store.deleteForeshadowOccurrence(request.params.occurrenceId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteForeshadowOccurrence(request.params.occurrenceId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/settings", (request, response) => {
@@ -696,11 +811,12 @@ export function createRuntime(options) {
     app.post("/api/works/:workId/settings", (request, response) => data(response, store.createSetting(request.params.workId, parse(settingSchema, request.body)), 201));
     app.get("/api/settings/:settingId", (request, response) => data(response, store.getSetting(request.params.settingId)));
     app.patch("/api/settings/:settingId", (request, response) => {
-        const { changeNote, ...input } = parse(settingSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateSetting(request.params.settingId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(settingSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateSetting(request.params.settingId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/settings/:settingId", (request, response) => {
-        store.deleteSetting(request.params.settingId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteSetting(request.params.settingId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/characters", (request, response) => {
@@ -709,28 +825,54 @@ export function createRuntime(options) {
             includeMerged: z.enum(["0", "1"]).default("0")
         }), request.query);
         const pagination = parsePagination(request.query);
-        data(response, pagination
+        const permissions = requestPermissions(request, request.params.workId);
+        const characters = pagination
             ? store.listCharactersPage(request.params.workId, pagination, includeSections === "true", includeMerged === "1")
-            : store.listCharacters(request.params.workId, includeSections === "true", includeMerged === "1"));
+            : store.listCharacters(request.params.workId, includeSections === "true", includeMerged === "1");
+        data(response, mapRecords(characters, (character) => redactCharacterLinks(character, permissions)));
+    });
+    app.post("/api/works/:workId/characters", (request, response) => {
+        const character = store.createCharacter(request.params.workId, parse(characterSchema, request.body));
+        data(response, redactCharacterLinks(character, requestPermissions(request, request.params.workId)), 201);
+    });
+    app.get("/api/characters/:characterId", (request, response) => {
+        data(response, redactCharacterLinks(store.getCharacter(request.params.characterId), requestPermissions(request)));
     });
-    app.post("/api/works/:workId/characters", (request, response) => data(response, store.createCharacter(request.params.workId, parse(characterSchema, request.body)), 201));
-    app.get("/api/characters/:characterId", (request, response) => data(response, store.getCharacter(request.params.characterId)));
     app.patch("/api/characters/:characterId", (request, response) => {
-        const { changeNote, ...input } = parse(characterUpdateSchema, request.body);
-        data(response, store.updateCharacter(request.params.characterId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(characterUpdateSchema.extend({ expectedVersionNo: expectedVersionNoSchema }), request.body);
+        const character = store.updateCharacter(request.params.characterId, input, "manual", null, changeNote, expectedVersionNo);
+        data(response, redactCharacterLinks(character, requestPermissions(request)));
     });
     app.get("/api/characters/:characterId/versions", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listCharacterVersionsPage(request.params.characterId, pagination) : store.listCharacterVersions(request.params.characterId));
+        const versions = pagination ? store.listCharacterVersionsPage(request.params.characterId, pagination) : store.listCharacterVersions(request.params.characterId);
+        const permissions = requestPermissions(request);
+        data(response, redactVersionSnapshots(versions, (snapshot) => redactCharacterLinks(snapshot, permissions)));
     });
     app.post("/api/characters/:characterId/restore", (request, response) => {
-        const input = parse(z.object({ versionNo: z.number().int().positive() }), request.body);
-        data(response, store.restoreCharacter(request.params.characterId, input.versionNo));
+        const input = parse(z.object({ versionNo: z.number().int().positive(), expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const character = store.restoreCharacter(request.params.characterId, input.versionNo, input.expectedVersionNo);
+        data(response, redactCharacterLinks(character, requestPermissions(request)));
     });
     app.delete("/api/characters/:characterId", (request, response) => {
-        store.deleteCharacter(request.params.characterId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteCharacter(request.params.characterId, input.expectedVersionNo);
         noContent(response);
     });
+    app.post("/api/characters/:characterId/merge", (request, response) => {
+        const input = parse(z.object({
+            targetCharacterId: identifier,
+            expectedTargetVersionNo: z.number().int().positive(),
+            expectedSourceVersionNo: z.number().int().positive()
+        }).strict(), request.body);
+        const result = store.mergeCharacters({
+            reviewId: null,
+            sourceCharacterId: request.params.characterId,
+            ...input
+        });
+        const permissions = requestPermissions(request);
+        data(response, redactMergeRecords(result, (character) => redactCharacterLinks(character, permissions)));
+    });
     app.get("/api/characters/:characterId/sections", (request, response) => {
         const pagination = parsePagination(request.query);
         data(response, pagination
@@ -744,11 +886,12 @@ export function createRuntime(options) {
         data(response, store.getCharacterProfileSection(request.params.sectionId));
     });
     app.patch("/api/character-sections/:sectionId", (request, response) => {
-        const { changeNote, ...input } = parse(characterProfileSectionSchema.partial().extend({ changeNote: changeNoteSchema }).strict(), request.body);
-        data(response, store.updateCharacterProfileSection(request.params.sectionId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(characterProfileSectionSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateCharacterProfileSection(request.params.sectionId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/character-sections/:sectionId", (request, response) => {
-        store.deleteCharacterProfileSection(request.params.sectionId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteCharacterProfileSection(request.params.sectionId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/character-sections/:sectionId/versions", (request, response) => {
@@ -758,8 +901,8 @@ export function createRuntime(options) {
             : store.listCharacterProfileSectionVersions(request.params.sectionId));
     });
     app.post("/api/character-sections/:sectionId/restore", (request, response) => {
-        const input = parse(z.object({ versionNo: z.number().int().positive() }).strict(), request.body);
-        data(response, store.restoreCharacterProfileSection(request.params.sectionId, input.versionNo));
+        const input = parse(z.object({ versionNo: z.number().int().positive(), expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.restoreCharacterProfileSection(request.params.sectionId, input.versionNo, input.expectedVersionNo));
     });
     app.get("/api/works/:workId/attachments", (request, response) => {
         const pagination = parsePagination(request.query);
@@ -808,36 +951,62 @@ export function createRuntime(options) {
     });
     app.get("/api/works/:workId/races", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listRacesPage(request.params.workId, pagination) : store.listRaces(request.params.workId));
+        const races = pagination ? store.listRacesPage(request.params.workId, pagination) : store.listRaces(request.params.workId);
+        const permissions = requestPermissions(request, request.params.workId);
+        data(response, mapRecords(races, (race) => redactRaceMembers(race, permissions)));
     });
     app.post("/api/works/:workId/races", (request, response) => {
-        data(response, store.createRace(request.params.workId, parse(raceSchema, request.body)), 201);
+        const race = store.createRace(request.params.workId, parse(raceSchema, request.body));
+        data(response, redactRaceMembers(race, requestPermissions(request, request.params.workId)), 201);
+    });
+    app.get("/api/races/:raceId", (request, response) => {
+        data(response, redactRaceMembers(store.getRace(request.params.raceId), requestPermissions(request)));
     });
-    app.get("/api/races/:raceId", (request, response) => data(response, store.getRace(request.params.raceId)));
     app.patch("/api/races/:raceId", (request, response) => {
-        const { changeNote, ...input } = parse(raceSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateRace(request.params.raceId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(raceSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const race = store.updateRace(request.params.raceId, input, "manual", null, changeNote, expectedVersionNo);
+        data(response, redactRaceMembers(race, requestPermissions(request)));
     });
     app.delete("/api/races/:raceId", (request, response) => {
-        store.deleteRace(request.params.raceId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteRace(request.params.raceId, input.expectedVersionNo);
         noContent(response);
     });
+    app.post("/api/races/:raceId/merge", (request, response) => {
+        const input = parse(z.object({ targetRaceId: identifier }).strict(), request.body);
+        const result = store.mergeRaces(request.params.raceId, input.targetRaceId);
+        const permissions = requestPermissions(request);
+        data(response, redactMergeRecords(result, (race) => redactRaceMembers(race, permissions)));
+    });
     app.get("/api/works/:workId/organizations", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listOrganizationsPage(request.params.workId, pagination) : store.listOrganizations(request.params.workId));
+        const organizations = pagination ? store.listOrganizationsPage(request.params.workId, pagination) : store.listOrganizations(request.params.workId);
+        const permissions = requestPermissions(request, request.params.workId);
+        data(response, mapRecords(organizations, (organization) => redactOrganizationMembers(organization, permissions)));
     });
     app.post("/api/works/:workId/organizations", (request, response) => {
-        data(response, store.createOrganization(request.params.workId, parse(organizationSchema, request.body)), 201);
+        const organization = store.createOrganization(request.params.workId, parse(organizationSchema, request.body));
+        data(response, redactOrganizationMembers(organization, requestPermissions(request, request.params.workId)), 201);
+    });
+    app.get("/api/organizations/:organizationId", (request, response) => {
+        data(response, redactOrganizationMembers(store.getOrganization(request.params.organizationId), requestPermissions(request)));
     });
-    app.get("/api/organizations/:organizationId", (request, response) => data(response, store.getOrganization(request.params.organizationId)));
     app.patch("/api/organizations/:organizationId", (request, response) => {
-        const { changeNote, ...input } = parse(organizationSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateOrganization(request.params.organizationId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(organizationSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        const organization = store.updateOrganization(request.params.organizationId, input, "manual", null, changeNote, expectedVersionNo);
+        data(response, redactOrganizationMembers(organization, requestPermissions(request)));
     });
     app.delete("/api/organizations/:organizationId", (request, response) => {
-        store.deleteOrganization(request.params.organizationId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteOrganization(request.params.organizationId, input.expectedVersionNo);
         noContent(response);
     });
+    app.post("/api/organizations/:organizationId/merge", (request, response) => {
+        const input = parse(z.object({ targetOrganizationId: identifier }).strict(), request.body);
+        const result = store.mergeOrganizations(request.params.organizationId, input.targetOrganizationId);
+        const permissions = requestPermissions(request);
+        data(response, redactMergeRecords(result, (organization) => redactOrganizationMembers(organization, permissions)));
+    });
     app.get("/api/works/:workId/timeline-tracks", (request, response) => {
         const pagination = parsePagination(request.query);
         data(response, pagination ? store.listTimelineTracksPage(request.params.workId, pagination) : store.listTimelineTracks(request.params.workId));
@@ -845,11 +1014,12 @@ export function createRuntime(options) {
     app.post("/api/works/:workId/timeline-tracks", (request, response) => data(response, store.createTimelineTrack(request.params.workId, parse(timelineTrackSchema, request.body)), 201));
     app.get("/api/timeline-tracks/:trackId", (request, response) => data(response, store.getTimelineTrack(request.params.trackId)));
     app.patch("/api/timeline-tracks/:trackId", (request, response) => {
-        const { changeNote, ...input } = parse(timelineTrackSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateTimelineTrack(request.params.trackId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(timelineTrackSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateTimelineTrack(request.params.trackId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/timeline-tracks/:trackId", (request, response) => {
-        store.deleteTimelineTrack(request.params.trackId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteTimelineTrack(request.params.trackId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/timeline", (request, response) => {
@@ -863,14 +1033,16 @@ export function createRuntime(options) {
             name: nonEmpty.max(300),
             description: z.string().max(100_000).optional(),
             timeLabel: z.string().max(300).optional(),
-            timeSort: z.number().finite().nullable().optional()
-        }), request.body);
-        data(response, store.mergeTimelineEvents(request.params.workId, input.eventIds, input), 201);
+            timeSort: z.number().finite().nullable().optional(),
+            expectedVersionNos: z.record(identifier, z.number().int().positive()).optional()
+        }).strict(), request.body);
+        const { expectedVersionNos, ...mergeInput } = input;
+        data(response, store.mergeTimelineEvents(request.params.workId, input.eventIds, mergeInput, expectedVersionNos), 201);
     });
     app.get("/api/timeline/:eventId", (request, response) => data(response, store.getTimelineEvent(request.params.eventId)));
     app.patch("/api/timeline/:eventId", (request, response) => {
-        const { changeNote, ...input } = parse(timelineSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateTimelineEvent(request.params.eventId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(timelineSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateTimelineEvent(request.params.eventId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.post("/api/timeline/:eventId/split", (request, response) => {
         const input = parse(z.object({
@@ -879,12 +1051,14 @@ export function createRuntime(options) {
                 description: z.string().max(100_000).optional(),
                 timeLabel: z.string().max(300).optional(),
                 timeSort: z.number().finite().nullable().optional()
-            })).min(2)
-        }), request.body);
-        data(response, store.splitTimelineEvent(request.params.eventId, input.parts), 201);
+            })).min(2),
+            expectedVersionNo: expectedVersionNoSchema
+        }).strict(), request.body);
+        data(response, store.splitTimelineEvent(request.params.eventId, input.parts, input.expectedVersionNo), 201);
     });
     app.delete("/api/timeline/:eventId", (request, response) => {
-        store.deleteTimelineEvent(request.params.eventId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteTimelineEvent(request.params.eventId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/works/:workId/relationships", (request, response) => {
@@ -899,24 +1073,35 @@ export function createRuntime(options) {
     app.post("/api/works/:workId/relationships", (request, response) => data(response, store.createRelationship(request.params.workId, parse(relationshipSchema, request.body)), 201));
     app.get("/api/relationships/:relationshipId", (request, response) => data(response, store.getRelationship(request.params.relationshipId)));
     app.patch("/api/relationships/:relationshipId", (request, response) => {
-        const { changeNote, ...input } = parse(relationshipSchema.partial().extend({ changeNote: changeNoteSchema }), request.body);
-        data(response, store.updateRelationship(request.params.relationshipId, input, "manual", null, changeNote));
+        const { changeNote, expectedVersionNo, ...input } = parse(relationshipSchema.partial().extend({ changeNote: changeNoteSchema, expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.updateRelationship(request.params.relationshipId, input, "manual", null, changeNote, expectedVersionNo));
     });
     app.delete("/api/relationships/:relationshipId", (request, response) => {
-        store.deleteRelationship(request.params.relationshipId);
+        const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
+        store.deleteRelationship(request.params.relationshipId, input.expectedVersionNo);
         noContent(response);
     });
     app.get("/api/entity-versions/:entityType/:entityId", (request, response) => {
         const input = parse(z.object({ entityType: versionedEntityTypeSchema, entityId: identifier }), request.params);
         const pagination = parsePagination(request.query);
-        data(response, pagination
+        const versions = pagination
             ? store.listEntityVersionsPage(input.entityType, input.entityId, pagination)
-            : store.listEntityVersions(input.entityType, input.entityId));
+            : store.listEntityVersions(input.entityType, input.entityId);
+        const permissions = requestPermissions(request);
+        if (input.entityType === "race") {
+            data(response, redactVersionSnapshots(versions, (snapshot) => redactRaceMembers(snapshot, permissions)));
+            return;
+        }
+        if (input.entityType === "organization") {
+            data(response, redactVersionSnapshots(versions, (snapshot) => redactOrganizationMembers(snapshot, permissions)));
+            return;
+        }
+        data(response, versions);
     });
     app.post("/api/entity-versions/:entityType/:entityId/restore", (request, response) => {
         const params = parse(z.object({ entityType: versionedEntityTypeSchema, entityId: identifier }), request.params);
-        const input = parse(z.object({ versionNo: z.number().int().positive() }), request.body);
-        data(response, store.restoreEntityVersion(params.entityType, params.entityId, input.versionNo));
+        const input = parse(z.object({ versionNo: z.number().int().positive(), expectedVersionNo: expectedVersionNoSchema }).strict(), request.body);
+        data(response, store.restoreEntityVersion(params.entityType, params.entityId, input.versionNo, input.expectedVersionNo));
     });
     app.get("/api/works/:workId/reviews", (request, response) => {
         const status = typeof request.query.status === "string" ? request.query.status : undefined;