@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/commands/versions.js

@@ -0,0 +1,432 @@
+import { LockMode } from "@mikro-orm/core";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { Document, DocumentContent, DocumentVersion } from "../data/entities.js";
+import { resolveWatcherRecipients } from "../lib/watchers.js";
+import { documentVersionLabelSchema } from "../data/validators.js";
+import { DOCUMENTS_ENTITY_IDS } from "../lib/constants.js";
+import {
+  advanceDocumentCollaborationGeneration,
+  mutateDocumentContentState
+} from "../lib/contentService.js";
+import { materializeDocumentVersion } from "../lib/versionContent.js";
+import { sanitizeDocumentVersionLabel } from "../lib/versionLabels.js";
+import {
+  assertDocumentContentResourceLimits,
+  decodeBoundedCanonicalBase64,
+  DOCUMENTS_MAX_YJS_STATE_BYTES
+} from "../lib/resourceLimits.js";
+import { enforceDocumentVersionRetention } from "../lib/historyLimits.js";
+import { loadLockedDocumentContent, lockDocumentAggregateRoot } from "./aggregate.js";
+import {
+  bufferDocumentIndexRefresh,
+  bufferVersionCreatedSideEffect
+} from "./side-effects.js";
+import {
+  assertDocumentCommandCanEdit,
+  resolveDocumentsCommandActor,
+  resolveDocumentsCommandEntityManager,
+  resolveDocumentsCommandScope
+} from "./shared.js";
+import { documentsScopedCommandSchema } from "./mutation-helpers.js";
+const createVersionCommandSchema = documentsScopedCommandSchema.extend({
+  documentId: z.string().uuid(),
+  versionId: z.string().uuid(),
+  label: documentVersionLabelSchema
+});
+const contentStateSchema = z.object({
+  id: z.string().uuid(),
+  yjsState: z.string(),
+  contentHtml: z.string(),
+  contentText: z.string(),
+  updatedAt: z.string().datetime()
+});
+const restoreVersionCommandSchema = z.object({
+  tenantId: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  documentId: z.string().uuid(),
+  versionId: z.string().uuid(),
+  preRestoreVersionId: z.string().uuid(),
+  actorUserId: z.string().uuid(),
+  expectedContentUpdatedAt: z.string().datetime(),
+  restoreContentUpdatedAt: z.string().datetime()
+});
+function captureContentState(content) {
+  assertDocumentContentResourceLimits({
+    yjsState: content.yjsState,
+    contentHtml: content.contentHtml,
+    contentText: content.contentText
+  });
+  return {
+    id: content.id,
+    yjsState: Buffer.from(content.yjsState ?? Buffer.alloc(0)).toString("base64"),
+    contentHtml: content.contentHtml ?? "",
+    contentText: content.contentText ?? "",
+    updatedAt: content.updatedAt.toISOString()
+  };
+}
+function captureVersion(version) {
+  const contentHtml = version.contentHtml ?? "";
+  assertDocumentContentResourceLimits({ yjsState: version.yjsSnapshot, contentHtml });
+  const yjsSnapshot = Buffer.from(version.yjsSnapshot ?? Buffer.alloc(0));
+  const contentDigest = createHash("sha256").update(String(yjsSnapshot.byteLength)).update(":").update(yjsSnapshot).update(String(Buffer.byteLength(contentHtml))).update(":").update(contentHtml).digest("hex");
+  return {
+    id: version.id,
+    tenantId: version.tenantId,
+    organizationId: version.organizationId,
+    documentId: version.documentId,
+    label: sanitizeDocumentVersionLabel(version.label),
+    contentDigest: `sha256:${contentDigest}`,
+    createdByUserId: version.createdByUserId,
+    createdAt: version.createdAt.toISOString()
+  };
+}
+async function loadVersionForCreate(em, input, lock = false) {
+  return findOneWithDecryption(
+    em,
+    DocumentVersion,
+    {
+      id: input.versionId,
+      documentId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId
+    },
+    lock ? { lockMode: LockMode.PESSIMISTIC_WRITE } : void 0,
+    { tenantId: input.tenantId, organizationId: input.organizationId }
+  );
+}
+async function pinDocumentContentUpdatedAt(em, content, scope, updatedAtIso) {
+  const updatedAt = new Date(updatedAtIso);
+  const affected = await em.nativeUpdate(
+    DocumentContent,
+    {
+      id: content.id,
+      documentId: scope.documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    { updatedAt }
+  );
+  if (affected !== 1) {
+    throw new CrudHttpError(409, { error: "Record changed by another user" });
+  }
+  await em.refresh(content);
+  if (content.updatedAt.toISOString() !== updatedAt.toISOString()) {
+    throw new Error("[internal] document content optimistic-lock token was not persisted");
+  }
+}
+async function loadLockedContent(em, input) {
+  const content = await findOneWithDecryption(
+    em,
+    DocumentContent,
+    {
+      documentId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      deletedAt: null
+    },
+    { lockMode: LockMode.PESSIMISTIC_WRITE },
+    { tenantId: input.tenantId, organizationId: input.organizationId }
+  );
+  if (!content) throw new CrudHttpError(404, { error: "documents.content.notFound" });
+  return content;
+}
+async function loadScopedVersion(em, input) {
+  const version = await loadVersionByStableId(em, input, input.versionId);
+  if (!version) throw new CrudHttpError(404, { error: "documents.versions.notFound" });
+  return version;
+}
+async function loadVersionByStableId(em, input, versionId) {
+  return findOneWithDecryption(
+    em,
+    DocumentVersion,
+    {
+      id: versionId,
+      documentId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId
+    },
+    void 0,
+    { tenantId: input.tenantId, organizationId: input.organizationId }
+  );
+}
+function createVersionSnapshot(em, input, id, state, createdByUserId = input.actorUserId) {
+  assertDocumentContentResourceLimits({
+    contentHtml: state.contentHtml,
+    contentText: state.contentText
+  });
+  return em.create(DocumentVersion, {
+    id,
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+    documentId: input.documentId,
+    label: null,
+    yjsSnapshot: decodeBoundedCanonicalBase64(
+      state.yjsState,
+      DOCUMENTS_MAX_YJS_STATE_BYTES
+    ),
+    contentHtml: state.contentHtml,
+    createdByUserId
+  });
+}
+async function persistRetentionBoundVersion(em, scope, version, protectedIds) {
+  await enforceDocumentVersionRetention(
+    em,
+    scope,
+    { yjsSnapshot: version.yjsSnapshot, contentHtml: version.contentHtml },
+    protectedIds
+  );
+  em.persist(version);
+}
+function buildVersionRestoredProjection(input, versionId, preRestoreVersionId, options = {}) {
+  return {
+    kind: "event",
+    eventId: "documents.version.restored",
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+    payload: {
+      id: input.documentId,
+      documentId: input.documentId,
+      versionId,
+      preRestoreVersionId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      ...options.includeActor ? { userId: input.actorUserId } : {}
+    }
+  };
+}
+const createVersionCommand = {
+  id: "documents.version.create",
+  // Version rows are append-only history. Making snapshot creation undoable
+  // would either copy the document body into the action log or make retention
+  // eviction lossy. The history timeline itself is the durable reversal model.
+  isUndoable: false,
+  async execute(rawInput, ctx) {
+    const input = createVersionCommandSchema.parse(rawInput);
+    const scope = resolveDocumentsCommandScope(ctx, input);
+    const actorUserId = resolveDocumentsCommandActor(ctx);
+    const em = resolveDocumentsCommandEntityManager(ctx);
+    let version;
+    await withAtomicFlush(em, [async () => {
+      await lockDocumentAggregateRoot(em, input.documentId, scope);
+      await assertDocumentCommandCanEdit(ctx, em, input.documentId, scope);
+      const existing = await loadVersionForCreate(em, input, true);
+      if (existing) throw new CrudHttpError(409, { error: "Record changed by another user" });
+      const content = await loadLockedDocumentContent(em, input.documentId, scope);
+      assertDocumentContentResourceLimits({
+        yjsState: content?.yjsState,
+        contentHtml: content?.contentHtml,
+        contentText: content?.contentText
+      });
+      const yjsSnapshot = content?.yjsState ? Buffer.from(content.yjsState) : Buffer.alloc(0);
+      const contentHtml = content?.contentHtml ?? "";
+      version = em.create(DocumentVersion, {
+        id: input.versionId,
+        ...scope,
+        documentId: input.documentId,
+        label: input.label ?? null,
+        yjsSnapshot,
+        contentHtml,
+        createdByUserId: actorUserId
+      });
+      await persistRetentionBoundVersion(em, input, version, [input.versionId]);
+    }], { transaction: true, label: "documents.version.create" });
+    const after = captureVersion(version);
+    await bufferVersionCreatedSideEffect(ctx, version);
+    return {
+      id: version.id,
+      label: sanitizeDocumentVersionLabel(version.label),
+      createdByUserId: version.createdByUserId,
+      createdAt: version.createdAt.toISOString(),
+      after
+    };
+  },
+  async buildLog({ input, result }) {
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("documents.versions.actions.snapshot", "Save version"),
+      resourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,
+      resourceId: result.id,
+      parentResourceKind: DOCUMENTS_ENTITY_IDS.document,
+      parentResourceId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      snapshotBefore: null,
+      snapshotAfter: result.after,
+      payload: {
+        versionId: result.id,
+        documentId: input.documentId,
+        contentDigest: result.after.contentDigest,
+        createdAt: result.createdAt
+      }
+    };
+  }
+};
+const restoreVersionCommand = {
+  id: "documents.version.restore",
+  // Restores are reversed by restoring the automatically-created pre-restore
+  // version. Audit undo/redo would need durable body copies outside the bounded
+  // version store, so this command deliberately does not advertise an undo token.
+  isUndoable: false,
+  async execute(rawInput, ctx) {
+    const input = restoreVersionCommandSchema.parse(rawInput);
+    const scope = resolveDocumentsCommandScope(ctx, input);
+    const em = resolveDocumentsCommandEntityManager(ctx);
+    if (resolveDocumentsCommandActor(ctx) !== input.actorUserId) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    let currentContent = null;
+    let before = null;
+    let targetVersion = null;
+    let preRestoreVersion = null;
+    await withAtomicFlush(em, [
+      async () => {
+        await lockDocumentAggregateRoot(em, input.documentId, scope);
+        await assertDocumentCommandCanEdit(ctx, em, input.documentId, scope);
+        currentContent = await loadLockedContent(em, input);
+        await enforceCommandOptimisticLockWithGuards(ctx.container, {
+          resourceKind: DOCUMENTS_ENTITY_IDS.documentContent,
+          resourceId: currentContent.id,
+          current: currentContent.updatedAt,
+          expected: input.expectedContentUpdatedAt,
+          request: ctx.request ?? null
+        });
+        if (Date.parse(input.restoreContentUpdatedAt) <= currentContent.updatedAt.getTime()) {
+          throw new CrudHttpError(409, { error: "Record changed by another user" });
+        }
+        targetVersion = await loadScopedVersion(em, input);
+        const target = materializeDocumentVersion({
+          yjsSnapshot: targetVersion.yjsSnapshot,
+          contentHtml: targetVersion.contentHtml
+        });
+        before = captureContentState(currentContent);
+        const existingPreRestore = await loadVersionByStableId(em, input, input.preRestoreVersionId);
+        if (existingPreRestore) throw new CrudHttpError(409, { error: "Record changed by another user" });
+        preRestoreVersion = createVersionSnapshot(em, input, input.preRestoreVersionId, before);
+        await persistRetentionBoundVersion(em, input, preRestoreVersion, [
+          input.versionId,
+          input.preRestoreVersionId
+        ]);
+        advanceDocumentCollaborationGeneration(currentContent);
+        await mutateDocumentContentState(
+          em,
+          input.documentId,
+          scope,
+          {
+            yjsState: target.yjsState,
+            contentHtml: target.contentHtml,
+            contentText: target.contentText
+          },
+          {
+            existingContent: currentContent,
+            now: new Date(input.restoreContentUpdatedAt)
+          }
+        );
+      },
+      async () => {
+        if (!currentContent) throw new Error("[internal] restored content was not loaded");
+        await pinDocumentContentUpdatedAt(em, currentContent, input, input.restoreContentUpdatedAt);
+      }
+    ], { transaction: true, label: "documents.version.restore" });
+    const finalContent = currentContent;
+    const finalTargetVersion = targetVersion;
+    const finalPreRestoreVersion = preRestoreVersion;
+    if (!before || !finalContent || !finalTargetVersion || !finalPreRestoreVersion) {
+      throw new Error("[internal] version restore did not capture content state");
+    }
+    await bufferDocumentIndexRefresh(ctx, finalContent);
+    const restoredDocument = await findOneWithDecryption(
+      em,
+      Document,
+      {
+        id: input.documentId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+        deletedAt: null
+      },
+      { fields: ["id", "title"] },
+      { tenantId: input.tenantId, organizationId: input.organizationId }
+    );
+    const watcherRecipientIds = restoredDocument ? await resolveWatcherRecipients({
+      em,
+      container: ctx.container,
+      scope: { tenantId: input.tenantId, organizationId: input.organizationId },
+      documentId: input.documentId,
+      actorUserId: input.actorUserId
+    }) : [];
+    return {
+      contentHtml: finalContent.contentHtml ?? "",
+      contentText: finalContent.contentText ?? "",
+      updatedAt: finalContent.updatedAt.toISOString(),
+      restoredVersionId: input.versionId,
+      preRestoreVersionId: input.preRestoreVersionId,
+      preRestoreSnapshot: captureVersion(finalPreRestoreVersion),
+      restoredSnapshot: captureVersion(finalTargetVersion),
+      projections: [
+        buildVersionRestoredProjection(
+          input,
+          input.versionId,
+          input.preRestoreVersionId,
+          { includeActor: true }
+        ),
+        ...restoredDocument ? watcherRecipientIds.map((recipientUserId) => ({
+          kind: "watch-notification",
+          recipientUserId,
+          tenantId: input.tenantId,
+          organizationId: input.organizationId,
+          documentId: input.documentId,
+          documentTitle: restoredDocument.title,
+          notificationType: "documents.watch.changed",
+          bodyKey: "documents.notifications.watch.changed.restoredBody",
+          sourceEntityType: DOCUMENTS_ENTITY_IDS.document,
+          sourceEntityId: input.documentId,
+          linkHref: `/backend/documents/${encodeURIComponent(input.documentId)}`
+        })) : []
+      ]
+    };
+  },
+  async buildLog({ input, result }) {
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("documents.audit.versionRestored", "Restore document version"),
+      resourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,
+      resourceId: input.versionId,
+      parentResourceKind: DOCUMENTS_ENTITY_IDS.document,
+      parentResourceId: input.documentId,
+      relatedResourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,
+      relatedResourceId: input.preRestoreVersionId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      snapshotBefore: result.preRestoreSnapshot,
+      snapshotAfter: {
+        ...result.restoredSnapshot,
+        contentUpdatedAt: result.updatedAt
+      },
+      payload: {
+        documentId: input.documentId,
+        restoredVersionId: input.versionId,
+        preRestoreVersionId: input.preRestoreVersionId,
+        restoredContentDigest: result.restoredSnapshot.contentDigest,
+        preRestoreContentDigest: result.preRestoreSnapshot.contentDigest,
+        contentUpdatedAt: result.updatedAt
+      }
+    };
+  }
+};
+registerCommand(createVersionCommand);
+registerCommand(restoreVersionCommand);
+export {
+  createVersionCommand,
+  createVersionCommandSchema,
+  pinDocumentContentUpdatedAt,
+  restoreVersionCommand,
+  restoreVersionCommandSchema
+};
+//# sourceMappingURL=versions.js.map

package/dist/modules/documents/commands/versions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/commands/versions.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { createHash } from 'node:crypto'\nimport { z } from 'zod'\nimport { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Document, DocumentContent, DocumentVersion } from '../data/entities'\nimport { resolveWatcherRecipients } from '../lib/watchers'\nimport { documentVersionLabelSchema } from '../data/validators'\nimport { DOCUMENTS_ENTITY_IDS } from '../lib/constants'\nimport {\n  advanceDocumentCollaborationGeneration,\n  mutateDocumentContentState,\n} from '../lib/contentService'\nimport { materializeDocumentVersion } from '../lib/versionContent'\nimport { sanitizeDocumentVersionLabel } from '../lib/versionLabels'\nimport {\n  assertDocumentContentResourceLimits,\n  decodeBoundedCanonicalBase64,\n  DOCUMENTS_MAX_YJS_STATE_BYTES,\n} from '../lib/resourceLimits'\nimport { enforceDocumentVersionRetention } from '../lib/historyLimits'\nimport { loadLockedDocumentContent, lockDocumentAggregateRoot } from './aggregate'\nimport type { DocumentsProjectionDescriptor } from './projection-types'\nimport {\n  bufferDocumentIndexRefresh,\n  bufferVersionCreatedSideEffect,\n} from './side-effects'\nimport {\n  assertDocumentCommandCanEdit,\n  resolveDocumentsCommandActor,\n  resolveDocumentsCommandEntityManager,\n  resolveDocumentsCommandScope,\n} from './shared'\nimport { documentsScopedCommandSchema } from './mutation-helpers'\n\nexport const createVersionCommandSchema = documentsScopedCommandSchema.extend({\n  documentId: z.string().uuid(),\n  versionId: z.string().uuid(),\n  label: documentVersionLabelSchema,\n})\n\nexport type CreateVersionCommandInput = z.infer<typeof createVersionCommandSchema>\n\nconst contentStateSchema = z.object({\n  id: z.string().uuid(),\n  yjsState: z.string(),\n  contentHtml: z.string(),\n  contentText: z.string(),\n  updatedAt: z.string().datetime(),\n})\n\nexport const restoreVersionCommandSchema = z.object({\n  tenantId: z.string().uuid(),\n  organizationId: z.string().uuid(),\n  documentId: z.string().uuid(),\n  versionId: z.string().uuid(),\n  preRestoreVersionId: z.string().uuid(),\n  actorUserId: z.string().uuid(),\n  expectedContentUpdatedAt: z.string().datetime(),\n  restoreContentUpdatedAt: z.string().datetime(),\n})\n\nexport type RestoreVersionCommandInput = z.infer<typeof restoreVersionCommandSchema>\n\ntype ContentState = z.infer<typeof contentStateSchema>\n\ntype RestoreVersionResult = {\n  contentHtml: string\n  contentText: string\n  updatedAt: string\n  restoredVersionId: string\n  preRestoreVersionId: string\n  preRestoreSnapshot: VersionCreateSnapshot\n  restoredSnapshot: VersionCreateSnapshot\n  projections: DocumentsProjectionDescriptor[]\n}\n\ntype VersionCreateSnapshot = {\n  id: string\n  tenantId: string\n  organizationId: string\n  documentId: string\n  label: string | null\n  contentDigest: string\n  createdByUserId: string\n  createdAt: string\n}\n\ntype CreateVersionResult = {\n  id: string\n  label: string | null\n  createdByUserId: string\n  createdAt: string\n  after: VersionCreateSnapshot\n}\n\nfunction captureContentState(content: DocumentContent): ContentState {\n  assertDocumentContentResourceLimits({\n    yjsState: content.yjsState,\n    contentHtml: content.contentHtml,\n    contentText: content.contentText,\n  })\n  return {\n    id: content.id,\n    yjsState: Buffer.from(content.yjsState ?? Buffer.alloc(0)).toString('base64'),\n    contentHtml: content.contentHtml ?? '',\n    contentText: content.contentText ?? '',\n    updatedAt: content.updatedAt.toISOString(),\n  }\n}\n\nfunction captureVersion(version: DocumentVersion): VersionCreateSnapshot {\n  const contentHtml = version.contentHtml ?? ''\n  assertDocumentContentResourceLimits({ yjsState: version.yjsSnapshot, contentHtml })\n  const yjsSnapshot = Buffer.from(version.yjsSnapshot ?? Buffer.alloc(0))\n  const contentDigest = createHash('sha256')\n    .update(String(yjsSnapshot.byteLength))\n    .update(':')\n    .update(yjsSnapshot)\n    .update(String(Buffer.byteLength(contentHtml)))\n    .update(':')\n    .update(contentHtml)\n    .digest('hex')\n  return {\n    id: version.id,\n    tenantId: version.tenantId,\n    organizationId: version.organizationId,\n    documentId: version.documentId,\n    label: sanitizeDocumentVersionLabel(version.label),\n    contentDigest: `sha256:${contentDigest}`,\n    createdByUserId: version.createdByUserId,\n    createdAt: version.createdAt.toISOString(),\n  }\n}\n\nasync function loadVersionForCreate(\n  em: EntityManager,\n  input: CreateVersionCommandInput,\n  lock = false,\n): Promise<DocumentVersion | null> {\n  return findOneWithDecryption(\n    em,\n    DocumentVersion,\n    {\n      id: input.versionId,\n      documentId: input.documentId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    },\n    lock ? { lockMode: LockMode.PESSIMISTIC_WRITE } : undefined,\n    { tenantId: input.tenantId, organizationId: input.organizationId },\n  )\n}\n\n/**\n * MikroORM's `onUpdate` initializer replaces an explicitly assigned\n * `updatedAt` during flush. Restore needs the pre-computed optimistic-lock token\n * returned to the client to match the value that actually reached the database.\n * Pin it after the content mutation has flushed, then refresh the managed row so\n * the in-memory response and database agree.\n */\nexport async function pinDocumentContentUpdatedAt(\n  em: EntityManager,\n  content: DocumentContent,\n  scope: Pick<RestoreVersionCommandInput, 'tenantId' | 'organizationId' | 'documentId'>,\n  updatedAtIso: string,\n): Promise<void> {\n  const updatedAt = new Date(updatedAtIso)\n  const affected = await em.nativeUpdate(\n    DocumentContent,\n    {\n      id: content.id,\n      documentId: scope.documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    { updatedAt },\n  )\n  if (affected !== 1) {\n    throw new CrudHttpError(409, { error: 'Record changed by another user' })\n  }\n  await em.refresh(content)\n  if (content.updatedAt.toISOString() !== updatedAt.toISOString()) {\n    throw new Error('[internal] document content optimistic-lock token was not persisted')\n  }\n}\n\nasync function loadLockedContent(\n  em: EntityManager,\n  input: Pick<RestoreVersionCommandInput, 'documentId' | 'tenantId' | 'organizationId'>,\n): Promise<DocumentContent> {\n  const content = await findOneWithDecryption(\n    em,\n    DocumentContent,\n    {\n      documentId: input.documentId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      deletedAt: null,\n    },\n    { lockMode: LockMode.PESSIMISTIC_WRITE },\n    { tenantId: input.tenantId, organizationId: input.organizationId },\n  )\n  if (!content) throw new CrudHttpError(404, { error: 'documents.content.notFound' })\n  return content\n}\n\nasync function loadScopedVersion(\n  em: EntityManager,\n  input: RestoreVersionCommandInput,\n): Promise<DocumentVersion> {\n  const version = await loadVersionByStableId(em, input, input.versionId)\n  if (!version) throw new CrudHttpError(404, { error: 'documents.versions.notFound' })\n  return version\n}\n\nasync function loadVersionByStableId(\n  em: EntityManager,\n  input: RestoreVersionCommandInput,\n  versionId: string,\n): Promise<DocumentVersion | null> {\n  return findOneWithDecryption(\n    em,\n    DocumentVersion,\n    {\n      id: versionId,\n      documentId: input.documentId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    },\n    undefined,\n    { tenantId: input.tenantId, organizationId: input.organizationId },\n  )\n}\n\nfunction createVersionSnapshot(\n  em: EntityManager,\n  input: RestoreVersionCommandInput,\n  id: string,\n  state: ContentState,\n  createdByUserId = input.actorUserId,\n): DocumentVersion {\n  assertDocumentContentResourceLimits({\n    contentHtml: state.contentHtml,\n    contentText: state.contentText,\n  })\n  return em.create(DocumentVersion, {\n    id,\n    tenantId: input.tenantId,\n    organizationId: input.organizationId,\n    documentId: input.documentId,\n    label: null,\n    yjsSnapshot: decodeBoundedCanonicalBase64(\n      state.yjsState,\n      DOCUMENTS_MAX_YJS_STATE_BYTES,\n    ),\n    contentHtml: state.contentHtml,\n    createdByUserId,\n  })\n}\n\nasync function persistRetentionBoundVersion(\n  em: EntityManager,\n  scope: Pick<CreateVersionCommandInput, 'tenantId' | 'organizationId' | 'documentId'>,\n  version: DocumentVersion,\n  protectedIds: Iterable<string>,\n): Promise<void> {\n  await enforceDocumentVersionRetention(\n    em,\n    scope,\n    { yjsSnapshot: version.yjsSnapshot, contentHtml: version.contentHtml },\n    protectedIds,\n  )\n  em.persist(version)\n}\n\nfunction buildVersionRestoredProjection(\n  input: RestoreVersionCommandInput,\n  versionId: string,\n  preRestoreVersionId: string,\n  options: { includeActor?: boolean } = {},\n): DocumentsProjectionDescriptor {\n  return {\n    kind: 'event',\n    eventId: 'documents.version.restored',\n    tenantId: input.tenantId,\n    organizationId: input.organizationId,\n    payload: {\n      id: input.documentId,\n      documentId: input.documentId,\n      versionId,\n      preRestoreVersionId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      ...(options.includeActor ? { userId: input.actorUserId } : {}),\n    },\n  }\n}\n\nconst createVersionCommand: CommandHandler<CreateVersionCommandInput, CreateVersionResult> = {\n  id: 'documents.version.create',\n  // Version rows are append-only history. Making snapshot creation undoable\n  // would either copy the document body into the action log or make retention\n  // eviction lossy. The history timeline itself is the durable reversal model.\n  isUndoable: false,\n  async execute(rawInput, ctx) {\n    const input = createVersionCommandSchema.parse(rawInput)\n    const scope = resolveDocumentsCommandScope(ctx, input)\n    const actorUserId = resolveDocumentsCommandActor(ctx)\n    const em = resolveDocumentsCommandEntityManager(ctx)\n    let version!: DocumentVersion\n    await withAtomicFlush(em, [async () => {\n      await lockDocumentAggregateRoot(em, input.documentId, scope)\n      await assertDocumentCommandCanEdit(ctx, em, input.documentId, scope)\n      const existing = await loadVersionForCreate(em, input, true)\n      if (existing) throw new CrudHttpError(409, { error: 'Record changed by another user' })\n      const content = await loadLockedDocumentContent(em, input.documentId, scope)\n      assertDocumentContentResourceLimits({\n        yjsState: content?.yjsState,\n        contentHtml: content?.contentHtml,\n        contentText: content?.contentText,\n      })\n      const yjsSnapshot = content?.yjsState ? Buffer.from(content.yjsState) : Buffer.alloc(0)\n      const contentHtml = content?.contentHtml ?? ''\n      version = em.create(DocumentVersion, {\n        id: input.versionId,\n        ...scope,\n        documentId: input.documentId,\n        label: input.label ?? null,\n        yjsSnapshot,\n        contentHtml,\n        createdByUserId: actorUserId,\n      })\n      await persistRetentionBoundVersion(em, input, version, [input.versionId])\n    }], { transaction: true, label: 'documents.version.create' })\n\n    const after = captureVersion(version)\n    await bufferVersionCreatedSideEffect(ctx, version)\n    return {\n      id: version.id,\n      label: sanitizeDocumentVersionLabel(version.label),\n      createdByUserId: version.createdByUserId,\n      createdAt: version.createdAt.toISOString(),\n      after,\n    }\n  },\n  async buildLog({ input, result }) {\n    const { translate } = await resolveTranslations()\n    return {\n      actionLabel: translate('documents.versions.actions.snapshot', 'Save version'),\n      resourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,\n      resourceId: result.id,\n      parentResourceKind: DOCUMENTS_ENTITY_IDS.document,\n      parentResourceId: input.documentId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      snapshotBefore: null,\n      snapshotAfter: result.after,\n      payload: {\n        versionId: result.id,\n        documentId: input.documentId,\n        contentDigest: result.after.contentDigest,\n        createdAt: result.createdAt,\n      },\n    }\n  },\n}\n\nconst restoreVersionCommand: CommandHandler<RestoreVersionCommandInput, RestoreVersionResult> = {\n  id: 'documents.version.restore',\n  // Restores are reversed by restoring the automatically-created pre-restore\n  // version. Audit undo/redo would need durable body copies outside the bounded\n  // version store, so this command deliberately does not advertise an undo token.\n  isUndoable: false,\n  async execute(rawInput, ctx) {\n    const input = restoreVersionCommandSchema.parse(rawInput)\n    const scope = resolveDocumentsCommandScope(ctx, input)\n    const em = resolveDocumentsCommandEntityManager(ctx)\n    if (resolveDocumentsCommandActor(ctx) !== input.actorUserId) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n\n    let currentContent: DocumentContent | null = null\n    let before: ContentState | null = null\n    let targetVersion: DocumentVersion | null = null\n    let preRestoreVersion: DocumentVersion | null = null\n    await withAtomicFlush(em, [\n      async () => {\n        await lockDocumentAggregateRoot(em, input.documentId, scope)\n        await assertDocumentCommandCanEdit(ctx, em, input.documentId, scope)\n        currentContent = await loadLockedContent(em, input)\n        await enforceCommandOptimisticLockWithGuards(ctx.container, {\n          resourceKind: DOCUMENTS_ENTITY_IDS.documentContent,\n          resourceId: currentContent.id,\n          current: currentContent.updatedAt,\n          expected: input.expectedContentUpdatedAt,\n          request: ctx.request ?? null,\n        })\n        if (Date.parse(input.restoreContentUpdatedAt) <= currentContent.updatedAt.getTime()) {\n          throw new CrudHttpError(409, { error: 'Record changed by another user' })\n        }\n        targetVersion = await loadScopedVersion(em, input)\n        const target = materializeDocumentVersion({\n          yjsSnapshot: targetVersion.yjsSnapshot,\n          contentHtml: targetVersion.contentHtml,\n        })\n        before = captureContentState(currentContent)\n\n        const existingPreRestore = await loadVersionByStableId(em, input, input.preRestoreVersionId)\n        if (existingPreRestore) throw new CrudHttpError(409, { error: 'Record changed by another user' })\n        preRestoreVersion = createVersionSnapshot(em, input, input.preRestoreVersionId, before)\n        await persistRetentionBoundVersion(em, input, preRestoreVersion, [\n          input.versionId,\n          input.preRestoreVersionId,\n        ])\n        advanceDocumentCollaborationGeneration(currentContent)\n        await mutateDocumentContentState(\n          em,\n          input.documentId,\n          scope,\n          {\n            yjsState: target.yjsState,\n            contentHtml: target.contentHtml,\n            contentText: target.contentText,\n          },\n          {\n            existingContent: currentContent,\n            now: new Date(input.restoreContentUpdatedAt),\n          },\n        )\n      },\n      async () => {\n        if (!currentContent) throw new Error('[internal] restored content was not loaded')\n        await pinDocumentContentUpdatedAt(em, currentContent, input, input.restoreContentUpdatedAt)\n      },\n    ], { transaction: true, label: 'documents.version.restore' })\n\n    const finalContent = currentContent as DocumentContent | null\n    const finalTargetVersion = targetVersion as DocumentVersion | null\n    const finalPreRestoreVersion = preRestoreVersion as DocumentVersion | null\n    if (!before || !finalContent || !finalTargetVersion || !finalPreRestoreVersion) {\n      throw new Error('[internal] version restore did not capture content state')\n    }\n    await bufferDocumentIndexRefresh(ctx, finalContent)\n    const restoredDocument = await findOneWithDecryption(\n      em,\n      Document,\n      {\n        id: input.documentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        deletedAt: null,\n      },\n      { fields: ['id', 'title'] },\n      { tenantId: input.tenantId, organizationId: input.organizationId },\n    )\n    const watcherRecipientIds = restoredDocument\n      ? await resolveWatcherRecipients({\n          em,\n          container: ctx.container,\n          scope: { tenantId: input.tenantId, organizationId: input.organizationId },\n          documentId: input.documentId,\n          actorUserId: input.actorUserId,\n        })\n      : []\n    return {\n      contentHtml: finalContent.contentHtml ?? '',\n      contentText: finalContent.contentText ?? '',\n      updatedAt: finalContent.updatedAt.toISOString(),\n      restoredVersionId: input.versionId,\n      preRestoreVersionId: input.preRestoreVersionId,\n      preRestoreSnapshot: captureVersion(finalPreRestoreVersion),\n      restoredSnapshot: captureVersion(finalTargetVersion),\n      projections: [\n        buildVersionRestoredProjection(\n          input,\n          input.versionId,\n          input.preRestoreVersionId,\n          { includeActor: true },\n        ),\n        ...(restoredDocument\n          ? watcherRecipientIds.map((recipientUserId): DocumentsProjectionDescriptor => ({\n              kind: 'watch-notification',\n              recipientUserId,\n              tenantId: input.tenantId,\n              organizationId: input.organizationId,\n              documentId: input.documentId,\n              documentTitle: restoredDocument.title,\n              notificationType: 'documents.watch.changed',\n              bodyKey: 'documents.notifications.watch.changed.restoredBody',\n              sourceEntityType: DOCUMENTS_ENTITY_IDS.document,\n              sourceEntityId: input.documentId,\n              linkHref: `/backend/documents/${encodeURIComponent(input.documentId)}`,\n            }))\n          : []),\n      ],\n    }\n  },\n  async buildLog({ input, result }) {\n    const { translate } = await resolveTranslations()\n    return {\n      actionLabel: translate('documents.audit.versionRestored', 'Restore document version'),\n      resourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,\n      resourceId: input.versionId,\n      parentResourceKind: DOCUMENTS_ENTITY_IDS.document,\n      parentResourceId: input.documentId,\n      relatedResourceKind: DOCUMENTS_ENTITY_IDS.documentVersion,\n      relatedResourceId: input.preRestoreVersionId,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      snapshotBefore: result.preRestoreSnapshot,\n      snapshotAfter: {\n        ...result.restoredSnapshot,\n        contentUpdatedAt: result.updatedAt,\n      },\n      payload: {\n        documentId: input.documentId,\n        restoredVersionId: input.versionId,\n        preRestoreVersionId: input.preRestoreVersionId,\n        restoredContentDigest: result.restoredSnapshot.contentDigest,\n        preRestoreContentDigest: result.preRestoreSnapshot.contentDigest,\n        contentUpdatedAt: result.updatedAt,\n      },\n    }\n  },\n}\n\nregisterCommand(createVersionCommand)\nregisterCommand(restoreVersionCommand)\n\nexport { createVersionCommand, restoreVersionCommand }\n"],
+  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAClB,SAAS,uBAA4C;AACrD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,8CAA8C;AACvD,SAAS,2BAA2B;AACpC,SAAS,UAAU,iBAAiB,uBAAuB;AAC3D,SAAS,gCAAgC;AACzC,SAAS,kCAAkC;AAC3C,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAC3C,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,2BAA2B,iCAAiC;AAErE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAEtC,MAAM,6BAA6B,6BAA6B,OAAO;AAAA,EAC5E,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO;AACT,CAAC;AAID,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO;AAAA,EACtB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAC/C,CAAC;AAoCD,SAAS,oBAAoB,SAAwC;AACnE,sCAAoC;AAAA,IAClC,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,aAAa,QAAQ;AAAA,EACvB,CAAC;AACD,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,UAAU,OAAO,KAAK,QAAQ,YAAY,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,QAAQ;AAAA,IAC5E,aAAa,QAAQ,eAAe;AAAA,IACpC,aAAa,QAAQ,eAAe;AAAA,IACpC,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C;AACF;AAEA,SAAS,eAAe,SAAiD;AACvE,QAAM,cAAc,QAAQ,eAAe;AAC3C,sCAAoC,EAAE,UAAU,QAAQ,aAAa,YAAY,CAAC;AAClF,QAAM,cAAc,OAAO,KAAK,QAAQ,eAAe,OAAO,MAAM,CAAC,CAAC;AACtE,QAAM,gBAAgB,WAAW,QAAQ,EACtC,OAAO,OAAO,YAAY,UAAU,CAAC,EACrC,OAAO,GAAG,EACV,OAAO,WAAW,EAClB,OAAO,OAAO,OAAO,WAAW,WAAW,CAAC,CAAC,EAC7C,OAAO,GAAG,EACV,OAAO,WAAW,EAClB,OAAO,KAAK;AACf,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,YAAY,QAAQ;AAAA,IACpB,OAAO,6BAA6B,QAAQ,KAAK;AAAA,IACjD,eAAe,UAAU,aAAa;AAAA,IACtC,iBAAiB,QAAQ;AAAA,IACzB,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C;AACF;AAEA,eAAe,qBACb,IACA,OACA,OAAO,OAC0B;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,OAAO,EAAE,UAAU,SAAS,kBAAkB,IAAI;AAAA,IAClD,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACF;AASA,eAAsB,4BACpB,IACA,SACA,OACA,cACe;AACf,QAAM,YAAY,IAAI,KAAK,YAAY;AACvC,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,UAAU;AAAA,EACd;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAA,EAC1E;AACA,QAAM,GAAG,QAAQ,OAAO;AACxB,MAAI,QAAQ,UAAU,YAAY,MAAM,UAAU,YAAY,GAAG;AAC/D,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACF;AAEA,eAAe,kBACb,IACA,OAC0B;AAC1B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,IACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAClF,SAAO;AACT;AAEA,eAAe,kBACb,IACA,OAC0B;AAC1B,QAAM,UAAU,MAAM,sBAAsB,IAAI,OAAO,MAAM,SAAS;AACtE,MAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AACnF,SAAO;AACT;AAEA,eAAe,sBACb,IACA,OACA,WACiC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACF;AAEA,SAAS,sBACP,IACA,OACA,IACA,OACA,kBAAkB,MAAM,aACP;AACjB,sCAAoC;AAAA,IAClC,aAAa,MAAM;AAAA,IACnB,aAAa,MAAM;AAAA,EACrB,CAAC;AACD,SAAO,GAAG,OAAO,iBAAiB;AAAA,IAChC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,YAAY,MAAM;AAAA,IAClB,OAAO;AAAA,IACP,aAAa;AAAA,MACX,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AACH;AAEA,eAAe,6BACb,IACA,OACA,SACA,cACe;AACf,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,aAAa,QAAQ,aAAa,aAAa,QAAQ,YAAY;AAAA,IACrE;AAAA,EACF;AACA,KAAG,QAAQ,OAAO;AACpB;AAEA,SAAS,+BACP,OACA,WACA,qBACA,UAAsC,CAAC,GACR;AAC/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,SAAS;AAAA,MACP,IAAI,MAAM;AAAA,MACV,YAAY,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,GAAI,QAAQ,eAAe,EAAE,QAAQ,MAAM,YAAY,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,MAAM,uBAAuF;AAAA,EAC3F,IAAI;AAAA;AAAA;AAAA;AAAA,EAIJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,2BAA2B,MAAM,QAAQ;AACvD,UAAM,QAAQ,6BAA6B,KAAK,KAAK;AACrD,UAAM,cAAc,6BAA6B,GAAG;AACpD,UAAM,KAAK,qCAAqC,GAAG;AACnD,QAAI;AACJ,UAAM,gBAAgB,IAAI,CAAC,YAAY;AACrC,YAAM,0BAA0B,IAAI,MAAM,YAAY,KAAK;AAC3D,YAAM,6BAA6B,KAAK,IAAI,MAAM,YAAY,KAAK;AACnE,YAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO,IAAI;AAC3D,UAAI,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iCAAiC,CAAC;AACtF,YAAM,UAAU,MAAM,0BAA0B,IAAI,MAAM,YAAY,KAAK;AAC3E,0CAAoC;AAAA,QAClC,UAAU,SAAS;AAAA,QACnB,aAAa,SAAS;AAAA,QACtB,aAAa,SAAS;AAAA,MACxB,CAAC;AACD,YAAM,cAAc,SAAS,WAAW,OAAO,KAAK,QAAQ,QAAQ,IAAI,OAAO,MAAM,CAAC;AACtF,YAAM,cAAc,SAAS,eAAe;AAC5C,gBAAU,GAAG,OAAO,iBAAiB;AAAA,QACnC,IAAI,MAAM;AAAA,QACV,GAAG;AAAA,QACH,YAAY,MAAM;AAAA,QAClB,OAAO,MAAM,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA,iBAAiB;AAAA,MACnB,CAAC;AACD,YAAM,6BAA6B,IAAI,OAAO,SAAS,CAAC,MAAM,SAAS,CAAC;AAAA,IAC1E,CAAC,GAAG,EAAE,aAAa,MAAM,OAAO,2BAA2B,CAAC;AAE5D,UAAM,QAAQ,eAAe,OAAO;AACpC,UAAM,+BAA+B,KAAK,OAAO;AACjD,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,OAAO,6BAA6B,QAAQ,KAAK;AAAA,MACjD,iBAAiB,QAAQ;AAAA,MACzB,WAAW,QAAQ,UAAU,YAAY;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,uCAAuC,cAAc;AAAA,MAC5E,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,MACnB,oBAAoB,qBAAqB;AAAA,MACzC,kBAAkB,MAAM;AAAA,MACxB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB;AAAA,MAChB,eAAe,OAAO;AAAA,MACtB,SAAS;AAAA,QACP,WAAW,OAAO;AAAA,QAClB,YAAY,MAAM;AAAA,QAClB,eAAe,OAAO,MAAM;AAAA,QAC5B,WAAW,OAAO;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,wBAA0F;AAAA,EAC9F,IAAI;AAAA;AAAA;AAAA;AAAA,EAIJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,4BAA4B,MAAM,QAAQ;AACxD,UAAM,QAAQ,6BAA6B,KAAK,KAAK;AACrD,UAAM,KAAK,qCAAqC,GAAG;AACnD,QAAI,6BAA6B,GAAG,MAAM,MAAM,aAAa;AAC3D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AAEA,QAAI,iBAAyC;AAC7C,QAAI,SAA8B;AAClC,QAAI,gBAAwC;AAC5C,QAAI,oBAA4C;AAChD,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,0BAA0B,IAAI,MAAM,YAAY,KAAK;AAC3D,cAAM,6BAA6B,KAAK,IAAI,MAAM,YAAY,KAAK;AACnE,yBAAiB,MAAM,kBAAkB,IAAI,KAAK;AAClD,cAAM,uCAAuC,IAAI,WAAW;AAAA,UAC1D,cAAc,qBAAqB;AAAA,UACnC,YAAY,eAAe;AAAA,UAC3B,SAAS,eAAe;AAAA,UACxB,UAAU,MAAM;AAAA,UAChB,SAAS,IAAI,WAAW;AAAA,QAC1B,CAAC;AACD,YAAI,KAAK,MAAM,MAAM,uBAAuB,KAAK,eAAe,UAAU,QAAQ,GAAG;AACnF,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAA,QAC1E;AACA,wBAAgB,MAAM,kBAAkB,IAAI,KAAK;AACjD,cAAM,SAAS,2BAA2B;AAAA,UACxC,aAAa,cAAc;AAAA,UAC3B,aAAa,cAAc;AAAA,QAC7B,CAAC;AACD,iBAAS,oBAAoB,cAAc;AAE3C,cAAM,qBAAqB,MAAM,sBAAsB,IAAI,OAAO,MAAM,mBAAmB;AAC3F,YAAI,mBAAoB,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAChG,4BAAoB,sBAAsB,IAAI,OAAO,MAAM,qBAAqB,MAAM;AACtF,cAAM,6BAA6B,IAAI,OAAO,mBAAmB;AAAA,UAC/D,MAAM;AAAA,UACN,MAAM;AAAA,QACR,CAAC;AACD,+CAAuC,cAAc;AACrD,cAAM;AAAA,UACJ;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA;AAAA,YACE,UAAU,OAAO;AAAA,YACjB,aAAa,OAAO;AAAA,YACpB,aAAa,OAAO;AAAA,UACtB;AAAA,UACA;AAAA,YACE,iBAAiB;AAAA,YACjB,KAAK,IAAI,KAAK,MAAM,uBAAuB;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY;AACV,YAAI,CAAC,eAAgB,OAAM,IAAI,MAAM,4CAA4C;AACjF,cAAM,4BAA4B,IAAI,gBAAgB,OAAO,MAAM,uBAAuB;AAAA,MAC5F;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,4BAA4B,CAAC;AAE5D,UAAM,eAAe;AACrB,UAAM,qBAAqB;AAC3B,UAAM,yBAAyB;AAC/B,QAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,wBAAwB;AAC9E,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,UAAM,2BAA2B,KAAK,YAAY;AAClD,UAAM,mBAAmB,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,OAAO,EAAE;AAAA,MAC1B,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AACA,UAAM,sBAAsB,mBACxB,MAAM,yBAAyB;AAAA,MAC7B;AAAA,MACA,WAAW,IAAI;AAAA,MACf,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACxE,YAAY,MAAM;AAAA,MAClB,aAAa,MAAM;AAAA,IACrB,CAAC,IACD,CAAC;AACL,WAAO;AAAA,MACL,aAAa,aAAa,eAAe;AAAA,MACzC,aAAa,aAAa,eAAe;AAAA,MACzC,WAAW,aAAa,UAAU,YAAY;AAAA,MAC9C,mBAAmB,MAAM;AAAA,MACzB,qBAAqB,MAAM;AAAA,MAC3B,oBAAoB,eAAe,sBAAsB;AAAA,MACzD,kBAAkB,eAAe,kBAAkB;AAAA,MACnD,aAAa;AAAA,QACX;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,EAAE,cAAc,KAAK;AAAA,QACvB;AAAA,QACA,GAAI,mBACA,oBAAoB,IAAI,CAAC,qBAAoD;AAAA,UAC3E,MAAM;AAAA,UACN;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,UACtB,YAAY,MAAM;AAAA,UAClB,eAAe,iBAAiB;AAAA,UAChC,kBAAkB;AAAA,UAClB,SAAS;AAAA,UACT,kBAAkB,qBAAqB;AAAA,UACvC,gBAAgB,MAAM;AAAA,UACtB,UAAU,sBAAsB,mBAAmB,MAAM,UAAU,CAAC;AAAA,QACtE,EAAE,IACF,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,mCAAmC,0BAA0B;AAAA,MACpF,cAAc,qBAAqB;AAAA,MACnC,YAAY,MAAM;AAAA,MAClB,oBAAoB,qBAAqB;AAAA,MACzC,kBAAkB,MAAM;AAAA,MACxB,qBAAqB,qBAAqB;AAAA,MAC1C,mBAAmB,MAAM;AAAA,MACzB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,eAAe;AAAA,QACb,GAAG,OAAO;AAAA,QACV,kBAAkB,OAAO;AAAA,MAC3B;AAAA,MACA,SAAS;AAAA,QACP,YAAY,MAAM;AAAA,QAClB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,OAAO,iBAAiB;AAAA,QAC/C,yBAAyB,OAAO,mBAAmB;AAAA,QACnD,kBAAkB,OAAO;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,oBAAoB;AACpC,gBAAgB,qBAAqB;",
+  "names": []
+}

package/dist/modules/documents/commands/watchers.js

@@ -0,0 +1,164 @@
+import { LockMode } from "@mikro-orm/core";
+import { z } from "zod";
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { DocumentWatcher } from "../data/entities.js";
+import { DOCUMENTS_MAX_ACTIVE_WATCHERS } from "../lib/watchers.js";
+import { lockDocumentAggregateRoot } from "./aggregate.js";
+import {
+  assertCommandFeature,
+  assertDocumentCommandCapability,
+  resolveDocumentsCommandActor,
+  resolveDocumentsCommandEntityManager,
+  resolveDocumentsCommandFeatures,
+  resolveDocumentsCommandScope
+} from "./shared.js";
+const watchCommandSchema = z.object({
+  tenantId: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  documentId: z.string().uuid(),
+  watcherId: z.string().uuid(),
+  actorUserId: z.string().uuid()
+});
+function assertHumanActor(input, ctx) {
+  const auth = ctx.auth;
+  if (!auth || auth.isApiKey === true || auth.sub.startsWith("api_key:")) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+  if (resolveDocumentsCommandActor(ctx) !== input.actorUserId) {
+    throw new CrudHttpError(403, { error: "Forbidden" });
+  }
+}
+async function loadWatcher(em, input) {
+  return findOneWithDecryption(
+    em,
+    DocumentWatcher,
+    {
+      documentId: input.documentId,
+      userId: input.actorUserId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId
+    },
+    {
+      filters: false,
+      lockMode: LockMode.PESSIMISTIC_WRITE,
+      orderBy: { createdAt: "DESC", id: "ASC" }
+    },
+    { tenantId: input.tenantId, organizationId: input.organizationId }
+  );
+}
+async function countActiveWatchers(em, input) {
+  const watchers = await findWithDecryption(
+    em,
+    DocumentWatcher,
+    {
+      documentId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      deletedAt: null
+    },
+    { fields: ["id"], limit: DOCUMENTS_MAX_ACTIVE_WATCHERS },
+    { tenantId: input.tenantId, organizationId: input.organizationId }
+  );
+  return watchers.length;
+}
+const createWatchCommand = {
+  id: "documents.watch.create",
+  isUndoable: false,
+  async execute(rawInput, ctx) {
+    const input = watchCommandSchema.parse(rawInput);
+    const scope = resolveDocumentsCommandScope(ctx, input);
+    const em = resolveDocumentsCommandEntityManager(ctx);
+    let watcher = null;
+    let changed = false;
+    await withAtomicFlush(em, [async () => {
+      await lockDocumentAggregateRoot(em, input.documentId, scope);
+      assertHumanActor(input, ctx);
+      await assertDocumentCommandCapability(ctx, em, input.documentId, scope, "canView");
+      watcher = await loadWatcher(em, input);
+      if (watcher && !watcher.deletedAt) return;
+      if (await countActiveWatchers(em, input) >= DOCUMENTS_MAX_ACTIVE_WATCHERS) {
+        throw new CrudHttpError(422, { error: "documents.errors.watcherLimitReached" });
+      }
+      if (watcher) {
+        watcher.deletedAt = null;
+      } else {
+        watcher = em.create(DocumentWatcher, {
+          id: input.watcherId,
+          documentId: input.documentId,
+          userId: input.actorUserId,
+          tenantId: input.tenantId,
+          organizationId: input.organizationId
+        });
+        em.persist(watcher);
+      }
+      changed = true;
+    }], { transaction: true, label: "documents.watch.create" });
+    const finalWatcher = watcher;
+    if (!finalWatcher) throw new Error("[internal] watcher create produced no row");
+    return { id: finalWatcher.id, active: true, changed };
+  },
+  async buildLog({ input, result }) {
+    if (!result.changed) return { skipLog: true };
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("documents.audit.watchCreated", "Document watch enabled"),
+      resourceKind: "documents:document_watcher",
+      resourceId: result.id,
+      parentResourceKind: "documents:document",
+      parentResourceId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      snapshotBefore: { active: false },
+      snapshotAfter: { active: true }
+    };
+  }
+};
+const deleteWatchCommand = {
+  id: "documents.watch.delete",
+  isUndoable: false,
+  async execute(rawInput, ctx) {
+    const input = watchCommandSchema.parse(rawInput);
+    const scope = resolveDocumentsCommandScope(ctx, input);
+    const em = resolveDocumentsCommandEntityManager(ctx);
+    let watcher = null;
+    let changed = false;
+    await withAtomicFlush(em, [async () => {
+      await lockDocumentAggregateRoot(em, input.documentId, scope);
+      assertHumanActor(input, ctx);
+      const features = await resolveDocumentsCommandFeatures(ctx, scope);
+      assertCommandFeature(features, "documents.view");
+      watcher = await loadWatcher(em, input);
+      if (!watcher || watcher.deletedAt) return;
+      watcher.deletedAt = /* @__PURE__ */ new Date();
+      changed = true;
+    }], { transaction: true, label: "documents.watch.delete" });
+    const finalWatcher = watcher;
+    return { id: finalWatcher?.id ?? input.watcherId, active: false, changed };
+  },
+  async buildLog({ input, result }) {
+    if (!result.changed) return { skipLog: true };
+    const { translate } = await resolveTranslations();
+    return {
+      actionLabel: translate("documents.audit.watchDeleted", "Document watch disabled"),
+      resourceKind: "documents:document_watcher",
+      resourceId: result.id,
+      parentResourceKind: "documents:document",
+      parentResourceId: input.documentId,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      snapshotBefore: { active: true },
+      snapshotAfter: { active: false }
+    };
+  }
+};
+registerCommand(createWatchCommand);
+registerCommand(deleteWatchCommand);
+export {
+  createWatchCommand,
+  deleteWatchCommand
+};
+//# sourceMappingURL=watchers.js.map