@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/api/[id]/duplicate/route.js

@@ -0,0 +1,200 @@
+import { randomUUID } from "node:crypto";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { DocumentAttachment, DocumentEntityLink } from "../../../data/entities.js";
+import { documentTitleSchema } from "../../../data/validators.js";
+import { DOCUMENTS_ENTITY_IDS } from "../../../lib/constants.js";
+import { assertTier } from "../../../lib/permissions.js";
+import {
+  getDocumentEntityLinkEntityId,
+  getDocumentEntityLinkType
+} from "../../../lib/entityLinks.js";
+import { verifyEntityRegistryTargetAccess } from "../../../lib/entityRegistry.server.js";
+import {
+  DOCUMENTS_DUPLICATE_MAX_ATTACHMENTS,
+  DOCUMENTS_DUPLICATE_MAX_LINKS
+} from "../../../commands/duplicate.js";
+import {
+  attachDocumentsOperationMetadata,
+  buildDocumentsCommandRuntimeContext,
+  resolveDocumentsCommandBus
+} from "../../_commands.js";
+import {
+  handleDocumentsRouteError,
+  hasDocumentsFeature,
+  readBody,
+  resolveActorUserId,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  runMutationGuardAfterSuccess,
+  validateMutationGuard,
+  withDocumentsContextErrors
+} from "../../_shared.js";
+const duplicateBodySchema = z.object({
+  title: documentTitleSchema.optional()
+});
+const duplicateGuardPayloadSchema = duplicateBodySchema.extend({
+  action: z.literal("duplicate"),
+  sourceDocumentId: z.string().uuid()
+});
+const duplicateResponseSchema = z.object({
+  id: z.string().uuid(),
+  updatedAt: z.string(),
+  copiedAttachments: z.number().int().nonnegative(),
+  copiedLinks: z.number().int().nonnegative(),
+  droppedLinks: z.number().int().nonnegative()
+});
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["documents.create", "documents.edit"] }
+};
+async function collectVerifiedSourceLinks(request, ctx, sourceDocumentId) {
+  const links = await findWithDecryption(
+    ctx.em,
+    DocumentEntityLink,
+    {
+      documentId: sourceDocumentId,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      deletedAt: null
+    },
+    { orderBy: { createdAt: "ASC", id: "ASC" } },
+    { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+  );
+  if (links.length > DOCUMENTS_DUPLICATE_MAX_LINKS) {
+    throw new CrudHttpError(422, { error: "documents.errors.duplicateSourceTooLarge" });
+  }
+  const verificationOutcomes = new Array(links.length).fill(null);
+  const concurrency = Math.min(4, links.length);
+  let nextIndex = 0;
+  await Promise.all(Array.from({ length: concurrency }, async () => {
+    while (nextIndex < links.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      const link = links[index];
+      const entityType = getDocumentEntityLinkType(link);
+      const entityId = getDocumentEntityLinkEntityId(link);
+      if (entityType === "document" && entityId === sourceDocumentId) {
+        continue;
+      }
+      try {
+        const verified = await verifyEntityRegistryTargetAccess(request, { entityType, entityId });
+        verificationOutcomes[index] = {
+          entityType,
+          entityId,
+          labelSnapshot: verified.label,
+          hrefSnapshot: verified.href,
+          source: link.source
+        };
+      } catch {
+        verificationOutcomes[index] = null;
+      }
+    }
+  }));
+  const verifiedLinks = verificationOutcomes.filter((outcome) => outcome !== null);
+  return { verifiedLinks, droppedLinks: links.length - verifiedLinks.length, activeLinkCount: links.length };
+}
+async function POST(request, context) {
+  try {
+    const { id: sourceDocumentId } = await context.params;
+    const ctx = await resolveDocumentsContext(request, ["documents.create", "documents.edit"]);
+    if (!hasDocumentsFeature(ctx.auth, "documents.create") || !hasDocumentsFeature(ctx.auth, "documents.edit")) {
+      throw new CrudHttpError(403, { error: "api.errors.forbidden" });
+    }
+    if (ctx.auth.isApiKey === true || ctx.auth.sub.startsWith("api_key:")) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    await assertTier(ctx.em, sourceDocumentId, ctx.auth, "viewer");
+    const attachmentCount = await ctx.em.count(DocumentAttachment, {
+      documentId: sourceDocumentId,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      deletedAt: null
+    });
+    if (attachmentCount > DOCUMENTS_DUPLICATE_MAX_ATTACHMENTS) {
+      throw new CrudHttpError(422, { error: "documents.errors.duplicateSourceTooLarge" });
+    }
+    const body = duplicateBodySchema.parse(await readBody(request));
+    const guardPayload = duplicateGuardPayloadSchema.parse({
+      ...body,
+      action: "duplicate",
+      sourceDocumentId
+    });
+    const guardResult = await validateMutationGuard(ctx, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: "new",
+      operation: "create",
+      mutationPayload: guardPayload,
+      mutationPayloadSchema: duplicateGuardPayloadSchema
+    });
+    const newDocumentId = randomUUID();
+    const { verifiedLinks, droppedLinks } = await collectVerifiedSourceLinks(
+      request,
+      ctx,
+      sourceDocumentId
+    );
+    const { translate } = await resolveTranslations();
+    const input = {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      sourceDocumentId,
+      newDocumentId,
+      newContentId: randomUUID(),
+      actorUserId: resolveActorUserId(ctx.auth),
+      title: guardPayload.title,
+      localizedCopyTitle: translate("documents.duplicate.copyTitle", "{title} (copy)"),
+      verifiedLinks
+    };
+    const execution = await resolveDocumentsCommandBus(ctx).execute("documents.document.duplicate", {
+      input,
+      ctx: buildDocumentsCommandRuntimeContext(ctx)
+    });
+    await runMutationGuardAfterSuccess(ctx, guardResult, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: execution.result.id,
+      operation: "create"
+    });
+    const response = NextResponse.json({
+      id: execution.result.id,
+      updatedAt: execution.result.updatedAt,
+      copiedAttachments: execution.result.copiedAttachments,
+      copiedLinks: execution.result.copiedLinks,
+      droppedLinks: droppedLinks + execution.result.droppedLinks
+    }, { status: 201 });
+    return attachDocumentsOperationMetadata(response, execution.logEntry, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: execution.result.id
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.duplicate");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Duplicate document",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Create a copy of a visible document owned by the acting user",
+      requestBody: { contentType: "application/json", schema: duplicateBodySchema },
+      responses: [{ status: 201, description: "Copy created", schema: duplicateResponseSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Document not found", schema: routeErrorSchema },
+        { status: 422, description: "Source exceeds the duplicate fanout bounds", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { POST };
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/[id]/duplicate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/documents/api/%5Bid%5D/duplicate/route.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { DocumentAttachment, DocumentEntityLink } from '../../../data/entities'\nimport { documentTitleSchema } from '../../../data/validators'\nimport { DOCUMENTS_ENTITY_IDS } from '../../../lib/constants'\nimport { assertTier } from '../../../lib/permissions'\nimport {\n  getDocumentEntityLinkEntityId,\n  getDocumentEntityLinkType,\n} from '../../../lib/entityLinks'\nimport { verifyEntityRegistryTargetAccess } from '../../../lib/entityRegistry.server'\nimport {\n  DOCUMENTS_DUPLICATE_MAX_ATTACHMENTS,\n  DOCUMENTS_DUPLICATE_MAX_LINKS,\n  type DuplicateDocumentCommandInput,\n  type DuplicateDocumentCommandResult,\n  type DuplicateVerifiedLink,\n} from '../../../commands/duplicate'\nimport {\n  attachDocumentsOperationMetadata,\n  buildDocumentsCommandRuntimeContext,\n  resolveDocumentsCommandBus,\n} from '../../_commands'\nimport {\n  handleDocumentsRouteError,\n  hasDocumentsFeature,\n  readBody,\n  resolveActorUserId,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  runMutationGuardAfterSuccess,\n  validateMutationGuard,\n  type DocumentsRouteContext,\n  withDocumentsContextErrors,\n} from '../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst duplicateBodySchema = z.object({\n  title: documentTitleSchema.optional(),\n})\n\n// The guard sees the same shape the command consumes, so a registry guard can\n// rewrite the title and have that rewrite survive re-validation.\nconst duplicateGuardPayloadSchema = duplicateBodySchema.extend({\n  action: z.literal('duplicate'),\n  sourceDocumentId: z.string().uuid(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  updatedAt: z.string(),\n  copiedAttachments: z.number().int().nonnegative(),\n  copiedLinks: z.number().int().nonnegative(),\n  droppedLinks: z.number().int().nonnegative(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['documents.create', 'documents.edit'] },\n}\n\nasync function collectVerifiedSourceLinks(\n  request: Request,\n  ctx: DocumentsRouteContext,\n  sourceDocumentId: string,\n): Promise<{ verifiedLinks: DuplicateVerifiedLink[]; droppedLinks: number; activeLinkCount: number }> {\n  const links = await findWithDecryption(\n    ctx.em,\n    DocumentEntityLink,\n    {\n      documentId: sourceDocumentId,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      deletedAt: null,\n    },\n    { orderBy: { createdAt: 'ASC', id: 'ASC' } },\n    { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n  )\n  if (links.length > DOCUMENTS_DUPLICATE_MAX_LINKS) {\n    throw new CrudHttpError(422, { error: 'documents.errors.duplicateSourceTooLarge' })\n  }\n  const verificationOutcomes: Array<DuplicateVerifiedLink | null> = new Array(links.length).fill(null)\n  const concurrency = Math.min(4, links.length)\n  let nextIndex = 0\n  await Promise.all(Array.from({ length: concurrency }, async () => {\n    while (nextIndex < links.length) {\n      const index = nextIndex\n      nextIndex += 1\n      const link = links[index]!\n      const entityType = getDocumentEntityLinkType(link)\n      const entityId = getDocumentEntityLinkEntityId(link)\n      if (entityType === 'document' && entityId === sourceDocumentId) {\n        continue\n      }\n      try {\n        const verified = await verifyEntityRegistryTargetAccess(request, { entityType, entityId })\n        verificationOutcomes[index] = {\n          entityType,\n          entityId,\n          labelSnapshot: verified.label,\n          hrefSnapshot: verified.href,\n          source: link.source,\n        }\n      } catch {\n        verificationOutcomes[index] = null\n      }\n    }\n  }))\n  const verifiedLinks = verificationOutcomes.filter((outcome): outcome is DuplicateVerifiedLink => outcome !== null)\n  return { verifiedLinks, droppedLinks: links.length - verifiedLinks.length, activeLinkCount: links.length }\n}\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const { id: sourceDocumentId } = await context.params\n    const ctx = await resolveDocumentsContext(request, ['documents.create', 'documents.edit'])\n    // `resolveDocumentsContext` only proves ONE of the listed features. This\n    // route declares both, so re-assert the conjunction the same way the\n    // sibling `instantiate` route does.\n    if (\n      !hasDocumentsFeature(ctx.auth, 'documents.create')\n      || !hasDocumentsFeature(ctx.auth, 'documents.edit')\n    ) {\n      throw new CrudHttpError(403, { error: 'api.errors.forbidden' })\n    }\n    // Reject machine principals before the link-verification fanout; the\n    // command re-asserts this fail-closed (spec decision 10).\n    if (ctx.auth.isApiKey === true || ctx.auth.sub.startsWith('api_key:')) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    await assertTier(ctx.em, sourceDocumentId, ctx.auth, 'viewer')\n\n    const attachmentCount = await ctx.em.count(DocumentAttachment, {\n      documentId: sourceDocumentId,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      deletedAt: null,\n    })\n    if (attachmentCount > DOCUMENTS_DUPLICATE_MAX_ATTACHMENTS) {\n      throw new CrudHttpError(422, { error: 'documents.errors.duplicateSourceTooLarge' })\n    }\n\n    const body = duplicateBodySchema.parse(await readBody(request))\n    const guardPayload = duplicateGuardPayloadSchema.parse({\n      ...body,\n      action: 'duplicate',\n      sourceDocumentId,\n    })\n    const guardResult = await validateMutationGuard(ctx, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: 'new',\n      operation: 'create',\n      mutationPayload: guardPayload,\n      mutationPayloadSchema: duplicateGuardPayloadSchema,\n    })\n\n    const newDocumentId = randomUUID()\n    const { verifiedLinks, droppedLinks } = await collectVerifiedSourceLinks(\n      request,\n      ctx,\n      sourceDocumentId,\n    )\n    const { translate } = await resolveTranslations()\n    const input: DuplicateDocumentCommandInput = {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      sourceDocumentId,\n      newDocumentId,\n      newContentId: randomUUID(),\n      actorUserId: resolveActorUserId(ctx.auth),\n      title: guardPayload.title,\n      localizedCopyTitle: translate('documents.duplicate.copyTitle', '{title} (copy)'),\n      verifiedLinks,\n    }\n    const execution = await resolveDocumentsCommandBus(ctx).execute<\n      DuplicateDocumentCommandInput,\n      DuplicateDocumentCommandResult\n    >('documents.document.duplicate', {\n      input,\n      ctx: buildDocumentsCommandRuntimeContext(ctx),\n    })\n    await runMutationGuardAfterSuccess(ctx, guardResult, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: execution.result.id,\n      operation: 'create',\n    })\n\n    const response = NextResponse.json({\n      id: execution.result.id,\n      updatedAt: execution.result.updatedAt,\n      copiedAttachments: execution.result.copiedAttachments,\n      copiedLinks: execution.result.copiedLinks,\n      droppedLinks: droppedLinks + execution.result.droppedLinks,\n    }, { status: 201 })\n    return attachDocumentsOperationMetadata(response, execution.logEntry, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: execution.result.id,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.duplicate')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Duplicate document',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Create a copy of a visible document owned by the acting user',\n      requestBody: { contentType: 'application/json', schema: duplicateBodySchema },\n      responses: [{ status: 201, description: 'Copy created', schema: duplicateResponseSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Document not found', schema: routeErrorSchema },\n        { status: 422, description: 'Source exceeds the duplicate fanout bounds', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { POST }\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,2BAA2B;AACpC,SAAS,4BAA4B;AACrC,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAMP,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,oBAAoB,SAAS;AACtC,CAAC;AAID,MAAM,8BAA8B,oBAAoB,OAAO;AAAA,EAC7D,QAAQ,EAAE,QAAQ,WAAW;AAAA,EAC7B,kBAAkB,EAAE,OAAO,EAAE,KAAK;AACpC,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC7C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,gBAAgB,EAAE;AACrF;AAEA,eAAe,2BACb,SACA,KACA,kBACoG;AACpG,QAAM,QAAQ,MAAM;AAAA,IAClB,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM,EAAE;AAAA,IAC3C,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,EAC/D;AACA,MAAI,MAAM,SAAS,+BAA+B;AAChD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2CAA2C,CAAC;AAAA,EACpF;AACA,QAAM,uBAA4D,IAAI,MAAM,MAAM,MAAM,EAAE,KAAK,IAAI;AACnG,QAAM,cAAc,KAAK,IAAI,GAAG,MAAM,MAAM;AAC5C,MAAI,YAAY;AAChB,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,YAAY,GAAG,YAAY;AAChE,WAAO,YAAY,MAAM,QAAQ;AAC/B,YAAM,QAAQ;AACd,mBAAa;AACb,YAAM,OAAO,MAAM,KAAK;AACxB,YAAM,aAAa,0BAA0B,IAAI;AACjD,YAAM,WAAW,8BAA8B,IAAI;AACnD,UAAI,eAAe,cAAc,aAAa,kBAAkB;AAC9D;AAAA,MACF;AACA,UAAI;AACF,cAAM,WAAW,MAAM,iCAAiC,SAAS,EAAE,YAAY,SAAS,CAAC;AACzF,6BAAqB,KAAK,IAAI;AAAA,UAC5B;AAAA,UACA;AAAA,UACA,eAAe,SAAS;AAAA,UACxB,cAAc,SAAS;AAAA,UACvB,QAAQ,KAAK;AAAA,QACf;AAAA,MACF,QAAQ;AACN,6BAAqB,KAAK,IAAI;AAAA,MAChC;AAAA,IACF;AAAA,EACF,CAAC,CAAC;AACF,QAAM,gBAAgB,qBAAqB,OAAO,CAAC,YAA8C,YAAY,IAAI;AACjH,SAAO,EAAE,eAAe,cAAc,MAAM,SAAS,cAAc,QAAQ,iBAAiB,MAAM,OAAO;AAC3G;AAEA,eAAsB,KAAK,SAAkB,SAA0C;AACrF,MAAI;AACF,UAAM,EAAE,IAAI,iBAAiB,IAAI,MAAM,QAAQ;AAC/C,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,oBAAoB,gBAAgB,CAAC;AAIzF,QACE,CAAC,oBAAoB,IAAI,MAAM,kBAAkB,KAC9C,CAAC,oBAAoB,IAAI,MAAM,gBAAgB,GAClD;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AAGA,QAAI,IAAI,KAAK,aAAa,QAAQ,IAAI,KAAK,IAAI,WAAW,UAAU,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,WAAW,IAAI,IAAI,kBAAkB,IAAI,MAAM,QAAQ;AAE7D,UAAM,kBAAkB,MAAM,IAAI,GAAG,MAAM,oBAAoB;AAAA,MAC7D,YAAY;AAAA,MACZ,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,kBAAkB,qCAAqC;AACzD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2CAA2C,CAAC;AAAA,IACpF;AAEA,UAAM,OAAO,oBAAoB,MAAM,MAAM,SAAS,OAAO,CAAC;AAC9D,UAAM,eAAe,4BAA4B,MAAM;AAAA,MACrD,GAAG;AAAA,MACH,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,UAAM,cAAc,MAAM,sBAAsB,KAAK;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,uBAAuB;AAAA,IACzB,CAAC;AAED,UAAM,gBAAgB,WAAW;AACjC,UAAM,EAAE,eAAe,aAAa,IAAI,MAAM;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,QAAuC;AAAA,MAC3C,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA,cAAc,WAAW;AAAA,MACzB,aAAa,mBAAmB,IAAI,IAAI;AAAA,MACxC,OAAO,aAAa;AAAA,MACpB,oBAAoB,UAAU,iCAAiC,gBAAgB;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,YAAY,MAAM,2BAA2B,GAAG,EAAE,QAGtD,gCAAgC;AAAA,MAChC;AAAA,MACA,KAAK,oCAAoC,GAAG;AAAA,IAC9C,CAAC;AACD,UAAM,6BAA6B,KAAK,aAAa;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY,UAAU,OAAO;AAAA,MAC7B,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,UAAU,OAAO;AAAA,MACrB,WAAW,UAAU,OAAO;AAAA,MAC5B,mBAAmB,UAAU,OAAO;AAAA,MACpC,aAAa,UAAU,OAAO;AAAA,MAC9B,cAAc,eAAe,UAAU,OAAO;AAAA,IAChD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClB,WAAO,iCAAiC,UAAU,UAAU,UAAU;AAAA,MACpE,cAAc,qBAAqB;AAAA,MACnC,YAAY,UAAU,OAAO;AAAA,IAC/B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,qBAAqB;AAAA,EAC/D;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC5E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,iBAAiB;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK;",
+  "names": []
+}

package/dist/modules/documents/api/[id]/export/route.js

@@ -0,0 +1,421 @@
+import { existsSync } from "node:fs";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { sanitizeRichTextHtml } from "@open-mercato/shared/lib/html/sanitizeRichText";
+import { assertTier } from "../../../lib/permissions.js";
+import { loadDocumentContent } from "../../../lib/contentService.js";
+import {
+  isDocxRenderFailedError,
+  isDocxRenderOutputTooLargeError,
+  isDocxRenderOverloadedError,
+  isDocxRenderTimeoutError,
+  renderDocxWithCapacity
+} from "../../../lib/docxRenderer.js";
+import {
+  isPdfRenderOutputTooLargeError,
+  isPdfRenderOverloadedError,
+  isPdfRenderTimeoutError,
+  renderPdfWithChromium
+} from "../../../lib/pdfRenderer.js";
+import { buildDocumentPdfHtml } from "../../../lib/pdfHtml.js";
+import {
+  assertDocumentContentResourceLimits,
+  DOCUMENTS_MAX_CONTENT_HTML_BYTES,
+  maxBase64EncodedLength
+} from "../../../lib/resourceLimits.js";
+import { DOCUMENTS_JSON_BODY_LIMITS } from "../../../lib/requestBody.js";
+import {
+  handleDocumentsRouteError,
+  loadScopedDocument,
+  readBody,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../_shared.js";
+const exportQuerySchema = z.object({
+  format: z.enum(["docx", "pdf"]).optional()
+});
+const docxSnapshotSchema = z.object({
+  contentHtml: z.string().max(DOCUMENTS_MAX_CONTENT_HTML_BYTES),
+  pageBreakMarker: z.string().regex(/^OM_DOCX_PAGE_BREAK_[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i)
+});
+const fileResponseSchema = z.string().describe("Binary .docx or PDF file attachment");
+const COMMON_CHROMIUM_PATHS = [
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "/usr/bin/google-chrome",
+  "/usr/bin/chromium",
+  "/usr/bin/chromium-browser"
+];
+const DOCX_MAX_EMBEDDED_IMAGE_BYTES = 1024 * 1024;
+const PDF_MAX_EMBEDDED_IMAGE_BYTES = 1024 * 1024;
+const MAX_EMBEDDED_RASTER_DIMENSION = 4096;
+const MAX_EMBEDDED_RASTER_PIXELS = 16 * 1024 * 1024;
+const DATA_IMAGE_PATTERN = /^data:image\/(png|jpeg);base64,([a-z0-9+/]+={0,2})$/i;
+const IMAGE_TAG_PATTERN = /<img\b[^>]*>/gi;
+const ENTITY_REF_SPAN_PATTERN = /<span\b(?=[^>]*\bdata-entity-ref(?:\s|=|>))[^>]*>([\s\S]*?)<\/span>/gi;
+const HIGHLIGHT_OPEN_PATTERN = /<mark\b([^>]*)>/gi;
+const HIGHLIGHT_CLOSE_PATTERN = /<\/mark>/gi;
+const LEADING_TABLE_HEADER_ROW_PATTERN = /(<table\b[^>]*>)(\s*)<tbody>(\s*)(<tr>(?:(?:\s*)<th\b[^>]*>[\s\S]*?<\/th>)+\s*<\/tr>)([\s\S]*?)<\/tbody>/gi;
+const IMAGE_SOURCE_PATTERN = /\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/gi;
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.view"] },
+  POST: { requireAuth: true, requireFeatures: ["documents.view"] }
+};
+async function resolveId(context) {
+  const params = await context.params;
+  return params.id;
+}
+function resolveExportFormat(value) {
+  if (value === null || value === "docx") return "docx";
+  if (value === "pdf") return "pdf";
+  return null;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function buildSafeFilename(title) {
+  return title.replace(/[^a-z0-9\-_. ]/gi, "_").slice(0, 120) || "document";
+}
+function readSingleImageSource(tag) {
+  const matches = Array.from(tag.matchAll(IMAGE_SOURCE_PATTERN));
+  if (matches.length !== 1 || matches[0].index === void 0) return null;
+  return {
+    index: matches[0].index,
+    length: matches[0][0].length,
+    value: matches[0][1] ?? matches[0][2] ?? matches[0][3] ?? ""
+  };
+}
+function replaceImageSource(tag, source, value) {
+  return `${tag.slice(0, source.index)}src="${escapeHtml(value)}"${tag.slice(source.index + source.length)}`;
+}
+function hasSafeRasterDimensions(width, height) {
+  return Number.isSafeInteger(width) && Number.isSafeInteger(height) && width > 0 && height > 0 && width <= MAX_EMBEDDED_RASTER_DIMENSION && height <= MAX_EMBEDDED_RASTER_DIMENSION && width * height <= MAX_EMBEDDED_RASTER_PIXELS;
+}
+function pngCrc32(bytes) {
+  let crc = 4294967295;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+    }
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function readPngDimensions(bytes) {
+  const signature = "89504e470d0a1a0a";
+  if (bytes.length < 45 || bytes.subarray(0, 8).toString("hex") !== signature) return null;
+  let offset = 8;
+  let dimensions = null;
+  let sawImageData = false;
+  while (offset + 12 <= bytes.length) {
+    const length = bytes.readUInt32BE(offset);
+    const chunkEnd = offset + 12 + length;
+    if (chunkEnd > bytes.length) return null;
+    const type = bytes.subarray(offset + 4, offset + 8);
+    const data = bytes.subarray(offset + 8, offset + 8 + length);
+    const expectedCrc = bytes.readUInt32BE(offset + 8 + length);
+    if (pngCrc32(bytes.subarray(offset + 4, offset + 8 + length)) !== expectedCrc) return null;
+    const chunkType = type.toString("ascii");
+    if (offset === 8) {
+      if (chunkType !== "IHDR" || length !== 13) return null;
+      const width = data.readUInt32BE(0);
+      const height = data.readUInt32BE(4);
+      const bitDepth = data[8];
+      const colorType = data[9];
+      const validBitDepth = colorType === 0 && [1, 2, 4, 8, 16].includes(bitDepth) || colorType === 2 && [8, 16].includes(bitDepth) || colorType === 3 && [1, 2, 4, 8].includes(bitDepth) || colorType === 4 && [8, 16].includes(bitDepth) || colorType === 6 && [8, 16].includes(bitDepth);
+      if (!validBitDepth || data[10] !== 0 || data[11] !== 0 || data[12] !== 0 && data[12] !== 1 || !hasSafeRasterDimensions(width, height)) return null;
+      dimensions = { width, height };
+    } else if (chunkType === "IHDR") {
+      return null;
+    }
+    if (chunkType === "IDAT") sawImageData = true;
+    if (chunkType === "IEND") {
+      return length === 0 && chunkEnd === bytes.length && sawImageData ? dimensions : null;
+    }
+    offset = chunkEnd;
+  }
+  return null;
+}
+const JPEG_START_OF_FRAME_MARKERS = /* @__PURE__ */ new Set([
+  192,
+  193,
+  194,
+  195,
+  197,
+  198,
+  199,
+  201,
+  202,
+  203,
+  205,
+  206,
+  207
+]);
+function readJpegDimensions(bytes) {
+  if (bytes.length < 12 || bytes[0] !== 255 || bytes[1] !== 216 || bytes.at(-2) !== 255 || bytes.at(-1) !== 217) return null;
+  let offset = 2;
+  while (offset + 4 <= bytes.length - 2) {
+    if (bytes[offset] !== 255) return null;
+    while (bytes[offset] === 255) offset += 1;
+    const marker = bytes[offset];
+    offset += 1;
+    if (marker === void 0 || marker === 218 || marker === 217) return null;
+    if (marker === 1 || marker >= 208 && marker <= 215) continue;
+    if (offset + 2 > bytes.length - 2) return null;
+    const segmentLength = bytes.readUInt16BE(offset);
+    if (segmentLength < 2 || offset + segmentLength > bytes.length - 2) return null;
+    if (JPEG_START_OF_FRAME_MARKERS.has(marker)) {
+      if (segmentLength < 7) return null;
+      const height = bytes.readUInt16BE(offset + 3);
+      const width = bytes.readUInt16BE(offset + 5);
+      return hasSafeRasterDimensions(width, height) ? { width, height } : null;
+    }
+    offset += segmentLength;
+  }
+  return null;
+}
+function readSafeEmbeddedImageBytes(source, maxDecodedBytes) {
+  const match = DATA_IMAGE_PATTERN.exec(source);
+  if (!match) return null;
+  const mimeType = match[1].toLowerCase();
+  const payload = match[2];
+  if (!payload || payload.length > maxBase64EncodedLength(maxDecodedBytes) || payload.length % 4 !== 0) return null;
+  const bytes = Buffer.from(payload, "base64");
+  if (bytes.length === 0 || bytes.length > maxDecodedBytes || bytes.toString("base64") !== payload) return null;
+  const dimensions = mimeType === "png" ? readPngDimensions(bytes) : readJpegDimensions(bytes);
+  if (!dimensions) return null;
+  return bytes.length;
+}
+function sanitizeEmbeddedRasterExportContent(contentHtml, maxEmbeddedBytes, placeholderNamespace) {
+  assertDocumentContentResourceLimits(
+    { contentHtml },
+    { error: "documents.export.inputTooLarge" }
+  );
+  const embeddedImages = /* @__PURE__ */ new Map();
+  let embeddedBytes = 0;
+  const placeholderHtml = contentHtml.replace(IMAGE_TAG_PATTERN, (tag) => {
+    const source = readSingleImageSource(tag);
+    if (!source) return "";
+    const remainingBytes = maxEmbeddedBytes - embeddedBytes;
+    const imageBytes = readSafeEmbeddedImageBytes(source.value, remainingBytes);
+    if (imageBytes === null || embeddedBytes + imageBytes > maxEmbeddedBytes) return "";
+    embeddedBytes += imageBytes;
+    const placeholder = `https://${placeholderNamespace}.invalid/__embedded-image-${embeddedImages.size}`;
+    embeddedImages.set(placeholder, source.value);
+    return replaceImageSource(tag, source, placeholder);
+  });
+  return sanitizeRichTextHtml(placeholderHtml).replace(IMAGE_TAG_PATTERN, (tag) => {
+    const source = readSingleImageSource(tag);
+    if (!source) return "";
+    const embeddedSource = embeddedImages.get(source.value);
+    return embeddedSource ? replaceImageSource(tag, source, embeddedSource) : "";
+  });
+}
+function sanitizeDocxExportContent(contentHtml) {
+  return sanitizeEmbeddedRasterExportContent(
+    contentHtml,
+    DOCX_MAX_EMBEDDED_IMAGE_BYTES,
+    "docx"
+  );
+}
+function sanitizePdfExportContent(contentHtml) {
+  const semanticHtml = contentHtml.replace(ENTITY_REF_SPAN_PATTERN, "<strong><code><span>$1</span></code></strong>").replace(HIGHLIGHT_OPEN_PATTERN, (_tag, attributes) => /\bstyle\s*=/i.test(attributes) ? `<span${attributes}>` : `<span style="background-color:#fef08a"${attributes}>`).replace(HIGHLIGHT_CLOSE_PATTERN, "</span>");
+  const sanitized = sanitizeEmbeddedRasterExportContent(
+    semanticHtml,
+    PDF_MAX_EMBEDDED_IMAGE_BYTES,
+    "pdf"
+  );
+  return sanitized.replace(
+    LEADING_TABLE_HEADER_ROW_PATTERN,
+    "$1$2<thead>$4</thead><tbody>$3$5</tbody>"
+  );
+}
+function buildExportHtml(title, contentHtml) {
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'none'; frame-src 'none'; connect-src 'none'; base-uri 'none'; form-action 'none'"><title>${escapeHtml(title)}</title></head><body>${contentHtml}</body></html>`;
+}
+function applyDocxPageBreakMarkers(contentHtml, marker) {
+  const markerParagraph = `<p>${marker}</p>`;
+  const breakCount = contentHtml.split(markerParagraph).length - 1;
+  if (breakCount > 100) {
+    throw new CrudHttpError(413, { error: "documents.export.inputTooLarge" });
+  }
+  return contentHtml.replaceAll(
+    markerParagraph,
+    '<div class="page-break" style="page-break-after: always"></div>'
+  );
+}
+function resolveChromiumExecutablePath() {
+  const configured = process.env.DOCUMENTS_PDF_CHROMIUM_PATH?.trim() || process.env.PUPPETEER_EXECUTABLE_PATH?.trim();
+  if (configured) return configured;
+  return COMMON_CHROMIUM_PATHS.find((path) => existsSync(path)) ?? null;
+}
+function toArrayBuffer(bytes) {
+  const arrayBuffer = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(arrayBuffer).set(bytes);
+  return arrayBuffer;
+}
+function isAllowedPdfAssetRequest(request) {
+  if (request.isNavigationRequest || request.resourceType !== "image") return false;
+  const embeddedBytes = readSafeEmbeddedImageBytes(request.url, PDF_MAX_EMBEDDED_IMAGE_BYTES);
+  return embeddedBytes !== null && embeddedBytes <= PDF_MAX_EMBEDDED_IMAGE_BYTES;
+}
+async function handleExport(request, context, options) {
+  try {
+    const format = resolveExportFormat(new URL(request.url).searchParams.get("format"));
+    if (!format) {
+      throw new CrudHttpError(400, { error: "documents.export.unsupportedFormat" });
+    }
+    const id = await resolveId(context);
+    const ctx = await resolveDocumentsContext(request, ["documents.view"]);
+    await assertTier(ctx.em, id, ctx.auth, "viewer");
+    const doc = await loadScopedDocument(ctx, id);
+    const snapshot = options?.loadSnapshot ? await options.loadSnapshot() : void 0;
+    const content = await loadDocumentContent(ctx.em, id, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId
+    });
+    const contentHtml = format === "docx" && snapshot ? snapshot.contentHtml : content?.contentHtml ?? "";
+    assertDocumentContentResourceLimits(
+      { contentHtml, contentText: content?.contentText },
+      { error: "documents.export.inputTooLarge" }
+    );
+    const safeName = buildSafeFilename(doc.title);
+    if (format === "docx") {
+      const sanitized = sanitizeDocxExportContent(contentHtml);
+      const paginated = snapshot ? applyDocxPageBreakMarkers(sanitized, snapshot.pageBreakMarker) : sanitized;
+      const docxHtml = buildExportHtml(doc.title, paginated);
+      let bufferBytes;
+      try {
+        bufferBytes = await renderDocxWithCapacity(docxHtml);
+      } catch (error) {
+        if (isDocxRenderOverloadedError(error)) {
+          throw new CrudHttpError(503, { error: "documents.export.overloaded" });
+        }
+        if (isDocxRenderTimeoutError(error)) {
+          throw new CrudHttpError(503, { error: "documents.export.renderTimeout" });
+        }
+        if (isDocxRenderOutputTooLargeError(error)) {
+          throw new CrudHttpError(413, { error: "documents.export.outputTooLarge" });
+        }
+        if (isDocxRenderFailedError(error)) {
+          throw new CrudHttpError(503, { error: "documents.export.runtimeUnavailable" });
+        }
+        throw error;
+      }
+      return new Response(toArrayBuffer(bufferBytes), {
+        headers: {
+          "content-type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+          "content-disposition": `attachment; filename="${safeName}.docx"`,
+          "cache-control": "private, no-store"
+        }
+      });
+    }
+    const executablePath = resolveChromiumExecutablePath();
+    if (!executablePath) {
+      throw new CrudHttpError(503, { error: "documents.export.runtimeUnavailable" });
+    }
+    const pdfHtml = buildDocumentPdfHtml(doc.title, sanitizePdfExportContent(contentHtml));
+    let pdf;
+    try {
+      pdf = await renderPdfWithChromium({
+        html: pdfHtml,
+        executablePath,
+        isAllowedRequest: (interceptedRequest) => isAllowedPdfAssetRequest({
+          url: interceptedRequest.url(),
+          resourceType: interceptedRequest.resourceType(),
+          isNavigationRequest: interceptedRequest.isNavigationRequest()
+        })
+      });
+    } catch (error) {
+      if (isPdfRenderOverloadedError(error)) {
+        throw new CrudHttpError(503, { error: "documents.export.overloaded" });
+      }
+      if (isPdfRenderTimeoutError(error)) {
+        throw new CrudHttpError(503, { error: "documents.export.renderTimeout" });
+      }
+      if (isPdfRenderOutputTooLargeError(error)) {
+        throw new CrudHttpError(413, { error: "documents.export.outputTooLarge" });
+      }
+      throw new CrudHttpError(503, { error: "documents.export.runtimeUnavailable" });
+    }
+    return new Response(toArrayBuffer(pdf), {
+      headers: {
+        "content-type": "application/pdf",
+        "content-disposition": `attachment; filename="${safeName}.pdf"`,
+        "cache-control": "private, no-store"
+      }
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, options?.operation ?? "documents.export.get");
+  }
+}
+async function GET(request, context) {
+  return handleExport(request, context);
+}
+async function POST(request, context) {
+  return handleExport(request, context, {
+    loadSnapshot: async () => docxSnapshotSchema.parse(await readBody(
+      request,
+      DOCUMENTS_JSON_BODY_LIMITS.exportSnapshot
+    )),
+    operation: "documents.export.post"
+  });
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document export",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Export document",
+      description: "Returns a binary .docx or PDF file attachment for a document.",
+      query: exportQuerySchema,
+      responses: [
+        { status: 200, description: "Document export file", schema: fileResponseSchema, mediaType: "application/octet-stream" }
+      ],
+      errors: [
+        { status: 400, description: "Unsupported format", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Not found", schema: routeErrorSchema },
+        { status: 413, description: "Document or generated export exceeds the safe resource bound", schema: routeErrorSchema },
+        { status: 503, description: "Export runtime is unavailable, overloaded, or timed out", schema: routeErrorSchema }
+      ]
+    },
+    POST: {
+      summary: "Export a paginated DOCX document",
+      description: "Returns a DOCX attachment using the editor pagination snapshot supplied by the client.",
+      query: exportQuerySchema,
+      requestBody: { contentType: "application/json", schema: docxSnapshotSchema },
+      responses: [
+        { status: 200, description: "Paginated DOCX export file", schema: fileResponseSchema, mediaType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document" }
+      ],
+      errors: [
+        { status: 400, description: "Invalid pagination snapshot or unsupported format", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Not found", schema: routeErrorSchema },
+        { status: 413, description: "Document or generated export exceeds the safe resource bound", schema: routeErrorSchema },
+        { status: 503, description: "Export runtime is unavailable, overloaded, or timed out", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET, POST };
+export {
+  DOCX_MAX_EMBEDDED_IMAGE_BYTES,
+  GET,
+  MAX_EMBEDDED_RASTER_DIMENSION,
+  MAX_EMBEDDED_RASTER_PIXELS,
+  PDF_MAX_EMBEDDED_IMAGE_BYTES,
+  POST,
+  applyDocxPageBreakMarkers,
+  route_default as default,
+  isAllowedPdfAssetRequest,
+  metadata,
+  openApi,
+  sanitizeDocxExportContent,
+  sanitizePdfExportContent
+};
+//# sourceMappingURL=route.js.map