@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/lib/contentService.js

@@ -0,0 +1,248 @@
+import { LockMode } from "@mikro-orm/core";
+import { randomUUID } from "node:crypto";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { assertOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { OPTIMISTIC_LOCK_CONFLICT_CODE } from "@open-mercato/shared/lib/crud/optimistic-lock-headers";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { DocumentContent } from "../data/entities.js";
+import { DOCUMENTS_ENTITY_IDS } from "./constants.js";
+import { nextDocumentVersion } from "./versioning.js";
+import { assertDocumentContentResourceLimits } from "./resourceLimits.js";
+const logger = createLogger("documents").child({ component: "content-service" });
+function normalizeDocumentCollaborationGeneration(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1 ? value : null;
+}
+function advanceDocumentCollaborationGeneration(content) {
+  const current = normalizeDocumentCollaborationGeneration(content.collaborationGeneration);
+  if (current === null || current >= Number.MAX_SAFE_INTEGER) {
+    throw new Error("[internal] document collaboration generation is invalid");
+  }
+  content.collaborationGeneration = current + 1;
+  return content.collaborationGeneration;
+}
+const ENTITY_MAP = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " "
+};
+function decodeHtmlEntities(value) {
+  return value.replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (match, token) => {
+    const named = ENTITY_MAP[token.toLowerCase()];
+    if (named) return named;
+    if (token.startsWith("#x") || token.startsWith("#X")) {
+      const parsed = Number.parseInt(token.slice(2), 16);
+      return Number.isFinite(parsed) ? String.fromCodePoint(parsed) : match;
+    }
+    if (token.startsWith("#")) {
+      const parsed = Number.parseInt(token.slice(1), 10);
+      return Number.isFinite(parsed) ? String.fromCodePoint(parsed) : match;
+    }
+    return match;
+  });
+}
+function deriveContentTextFromHtml(contentHtml) {
+  return decodeHtmlEntities(
+    contentHtml.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<\/(p|div|section|article|header|footer|li|tr|h[1-6])>/gi, "\n").replace(/<br\s*\/?>/gi, "\n").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim()
+  );
+}
+async function loadDocumentContent(em, documentId, scope) {
+  return findOneWithDecryption(
+    em,
+    DocumentContent,
+    {
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    void 0,
+    scope
+  );
+}
+async function loadDocumentContentForCollaboration(em, documentId, scope) {
+  return em.fork().transactional((transactionalEm) => findOneWithDecryption(
+    transactionalEm,
+    DocumentContent,
+    {
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    { lockMode: LockMode.PESSIMISTIC_READ },
+    scope
+  ));
+}
+async function loadDocumentCollaborationGeneration(em, documentId, scope) {
+  const content = await findOneWithDecryption(
+    em,
+    DocumentContent,
+    {
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    { fields: ["collaborationGeneration"] },
+    scope
+  );
+  if (!content) return null;
+  return normalizeDocumentCollaborationGeneration(content.collaborationGeneration);
+}
+async function mutateDocumentContentState(em, documentId, scope, input, options = {}) {
+  assertDocumentContentResourceLimits(input);
+  let content = options.existingContent !== void 0 ? options.existingContent : await findOneWithDecryption(
+    em,
+    DocumentContent,
+    { documentId, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    { filters: false },
+    scope
+  );
+  const requestedNow = options.now ?? /* @__PURE__ */ new Date();
+  const now = content ? nextDocumentVersion(content.updatedAt, requestedNow) : requestedNow;
+  if (!content) {
+    content = em.create(DocumentContent, {
+      id: options.id ?? randomUUID(),
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      contentHtml: "",
+      contentText: "",
+      collaborationGeneration: 1,
+      updatedAt: now
+    });
+    em.persist(content);
+  } else if (options.id && content.id !== options.id) {
+    throw new Error("[internal] document content identity does not match the prepared aggregate");
+  }
+  const hasContentHtml = Object.prototype.hasOwnProperty.call(input, "contentHtml");
+  const hasContentText = Object.prototype.hasOwnProperty.call(input, "contentText");
+  if (hasContentHtml) content.contentHtml = input.contentHtml ?? "";
+  if (hasContentText) {
+    content.contentText = input.contentText ?? deriveContentTextFromHtml(content.contentHtml ?? "");
+  } else if (hasContentHtml) {
+    content.contentText = deriveContentTextFromHtml(content.contentHtml ?? "");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "yjsState")) {
+    content.yjsState = input.yjsState ?? null;
+  }
+  assertDocumentContentResourceLimits({
+    yjsState: content.yjsState,
+    contentHtml: content.contentHtml,
+    contentText: content.contentText
+  });
+  content.deletedAt = null;
+  content.updatedAt = now;
+  return content;
+}
+async function persistDocumentContent(em, documentId, scope, input, deps) {
+  const persisted = await em.fork().transactional(async (transactionalEm) => {
+    const current = await findOneWithDecryption(
+      transactionalEm,
+      DocumentContent,
+      {
+        documentId,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId
+      },
+      { filters: false, lockMode: LockMode.PESSIMISTIC_WRITE },
+      scope
+    );
+    if (deps.requireExpectedVersion && deps.expectedUpdatedAt === void 0) {
+      throw new Error("[internal] documents content CAS requires an expected version");
+    }
+    if (deps.requireExpectedVersion && normalizeDocumentCollaborationGeneration(deps.expectedCollaborationGeneration) === null) {
+      throw new Error("[internal] documents content CAS requires an expected collaboration generation");
+    }
+    if (deps.expectedCollaborationGeneration !== void 0) {
+      const currentGeneration = normalizeDocumentCollaborationGeneration(
+        current?.collaborationGeneration
+      );
+      if (currentGeneration === null || currentGeneration !== deps.expectedCollaborationGeneration) {
+        throw new CrudHttpError(409, {
+          error: "Record changed by another user",
+          code: OPTIMISTIC_LOCK_CONFLICT_CODE,
+          currentCollaborationGeneration: currentGeneration,
+          expectedCollaborationGeneration: deps.expectedCollaborationGeneration
+        });
+      }
+    }
+    if (deps.expectedUpdatedAt !== void 0) {
+      if (!current) {
+        throw new Error("[internal] documents content changed after the collaboration room loaded");
+      }
+      assertOptimisticLock({
+        resourceKind: DOCUMENTS_ENTITY_IDS.documentContent,
+        resourceId: current.id,
+        current: current.updatedAt,
+        expected: deps.expectedUpdatedAt,
+        ...deps.requireExpectedVersion ? { envValue: "all" } : {}
+      });
+    }
+    const previousUpdatedAt = current?.updatedAt.getTime() ?? null;
+    const content = await mutateDocumentContentState(
+      transactionalEm,
+      documentId,
+      scope,
+      input,
+      { existingContent: current }
+    );
+    await transactionalEm.flush();
+    let persistedUpdatedAt = new Date(content.updatedAt.getTime());
+    if (previousUpdatedAt !== null && persistedUpdatedAt.getTime() <= previousUpdatedAt) {
+      persistedUpdatedAt = new Date(previousUpdatedAt + 1);
+      const affected = await transactionalEm.nativeUpdate(
+        DocumentContent,
+        {
+          id: content.id,
+          documentId,
+          tenantId: scope.tenantId,
+          organizationId: scope.organizationId
+        },
+        { updatedAt: persistedUpdatedAt }
+      );
+      if (affected !== 1) {
+        throw new Error("[internal] documents content version could not be advanced");
+      }
+      content.updatedAt = persistedUpdatedAt;
+    }
+    const collaborationGeneration = normalizeDocumentCollaborationGeneration(
+      content.collaborationGeneration
+    );
+    if (collaborationGeneration === null) {
+      throw new Error("[internal] document collaboration generation is invalid");
+    }
+    return { id: content.id, updatedAt: persistedUpdatedAt, collaborationGeneration };
+  });
+  try {
+    await deps.searchIndexer?.indexRecordById({
+      entityId: DOCUMENTS_ENTITY_IDS.document,
+      recordId: documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId
+    });
+  } catch (error) {
+    logger.error("Content search indexing failed after commit", {
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      err: error
+    });
+  }
+  return persisted;
+}
+export {
+  advanceDocumentCollaborationGeneration,
+  deriveContentTextFromHtml,
+  loadDocumentCollaborationGeneration,
+  loadDocumentContent,
+  loadDocumentContentForCollaboration,
+  mutateDocumentContentState,
+  normalizeDocumentCollaborationGeneration,
+  persistDocumentContent
+};
+//# sourceMappingURL=contentService.js.map

package/dist/modules/documents/lib/contentService.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/contentService.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { randomUUID } from 'node:crypto'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { assertOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { OPTIMISTIC_LOCK_CONFLICT_CODE } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { DocumentContent } from '../data/entities'\nimport { DOCUMENTS_ENTITY_IDS } from './constants'\nimport { nextDocumentVersion } from './versioning'\nimport { assertDocumentContentResourceLimits } from './resourceLimits'\n\nconst logger = createLogger('documents').child({ component: 'content-service' })\n\nexport type DocumentScope = {\n  tenantId: string\n  organizationId: string\n}\n\nexport type DocumentContentSearchIndexer = {\n  indexRecordById: (params: {\n    entityId: string\n    recordId: string\n    tenantId: string\n    organizationId?: string | null\n  }) => Promise<unknown>\n}\n\nexport type PersistDocumentContentDeps = {\n  searchIndexer?: DocumentContentSearchIndexer | null\n  /**\n   * Content version observed by the writer before it prepared this mutation.\n   * When present, the comparison happens while holding the content-row lock.\n   */\n  expectedUpdatedAt?: string | Date\n  /** Server-owned collaborative lineage observed when the room loaded. */\n  expectedCollaborationGeneration?: number\n  /** Sidecar CAS must remain active even if user-facing optimistic locks are disabled. */\n  requireExpectedVersion?: boolean\n}\n\nexport type PersistedDocumentContent = {\n  id: string\n  updatedAt: Date\n  collaborationGeneration: number\n}\n\nexport function normalizeDocumentCollaborationGeneration(value: unknown): number | null {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 1\n    ? value\n    : null\n}\n\nexport function advanceDocumentCollaborationGeneration(content: DocumentContent): number {\n  const current = normalizeDocumentCollaborationGeneration(content.collaborationGeneration)\n  if (current === null || current >= Number.MAX_SAFE_INTEGER) {\n    throw new Error('[internal] document collaboration generation is invalid')\n  }\n  content.collaborationGeneration = current + 1\n  return content.collaborationGeneration\n}\n\nconst ENTITY_MAP: Record<string, string> = {\n  amp: '&',\n  lt: '<',\n  gt: '>',\n  quot: '\"',\n  apos: \"'\",\n  nbsp: ' ',\n}\n\nfunction decodeHtmlEntities(value: string): string {\n  return value.replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (match, token: string) => {\n    const named = ENTITY_MAP[token.toLowerCase()]\n    if (named) return named\n    if (token.startsWith('#x') || token.startsWith('#X')) {\n      const parsed = Number.parseInt(token.slice(2), 16)\n      return Number.isFinite(parsed) ? String.fromCodePoint(parsed) : match\n    }\n    if (token.startsWith('#')) {\n      const parsed = Number.parseInt(token.slice(1), 10)\n      return Number.isFinite(parsed) ? String.fromCodePoint(parsed) : match\n    }\n    return match\n  })\n}\n\nexport function deriveContentTextFromHtml(contentHtml: string): string {\n  return decodeHtmlEntities(\n    contentHtml\n      .replace(/<script[\\s\\S]*?<\\/script>/gi, ' ')\n      .replace(/<style[\\s\\S]*?<\\/style>/gi, ' ')\n      .replace(/<\\/(p|div|section|article|header|footer|li|tr|h[1-6])>/gi, '\\n')\n      .replace(/<br\\s*\\/?>/gi, '\\n')\n      .replace(/<[^>]+>/g, ' ')\n      .replace(/\\s+/g, ' ')\n      .trim(),\n  )\n}\n\nexport async function loadDocumentContent(\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentScope,\n): Promise<DocumentContent | null> {\n  return findOneWithDecryption(\n    em,\n    DocumentContent,\n    {\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n}\n\n/**\n * Read the exact collaboration state/version/generation tuple from an\n * isolated transaction. The short pessimistic read lock prevents observing a\n * partially completed authoritative reset while a room is being loaded or a\n * competing replica is reconciling after a CAS loss.\n */\nexport async function loadDocumentContentForCollaboration(\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentScope,\n): Promise<DocumentContent | null> {\n  return em.fork().transactional((transactionalEm) => findOneWithDecryption(\n    transactionalEm,\n    DocumentContent,\n    {\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    { lockMode: LockMode.PESSIMISTIC_READ },\n    scope,\n  ))\n}\n\n/**\n * Lightweight active-room reconciliation probe. A missing row means the\n * scoped content was deleted; normal collaborative stores retain the same\n * generation while authoritative replacements advance it.\n */\nexport async function loadDocumentCollaborationGeneration(\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentScope,\n): Promise<number | null> {\n  const content = await findOneWithDecryption(\n    em,\n    DocumentContent,\n    {\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    { fields: ['collaborationGeneration'] },\n    scope,\n  )\n  if (!content) return null\n  return normalizeDocumentCollaborationGeneration(content.collaborationGeneration)\n}\n\nexport async function mutateDocumentContentState(\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentScope,\n  input: { yjsState?: Buffer | null; contentHtml?: string | null; contentText?: string | null },\n  options: { id?: string; now?: Date; existingContent?: DocumentContent | null } = {},\n): Promise<DocumentContent> {\n  assertDocumentContentResourceLimits(input)\n  let content = options.existingContent !== undefined\n    ? options.existingContent\n    : await findOneWithDecryption(\n        em,\n        DocumentContent,\n        { documentId, tenantId: scope.tenantId, organizationId: scope.organizationId },\n        { filters: false },\n        scope,\n      )\n  const requestedNow = options.now ?? new Date()\n  const now = content ? nextDocumentVersion(content.updatedAt, requestedNow) : requestedNow\n  if (!content) {\n    content = em.create(DocumentContent, {\n      id: options.id ?? randomUUID(),\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      contentHtml: '',\n      contentText: '',\n      collaborationGeneration: 1,\n      updatedAt: now,\n    })\n    em.persist(content)\n  } else if (options.id && content.id !== options.id) {\n    throw new Error('[internal] document content identity does not match the prepared aggregate')\n  }\n\n  const hasContentHtml = Object.prototype.hasOwnProperty.call(input, 'contentHtml')\n  const hasContentText = Object.prototype.hasOwnProperty.call(input, 'contentText')\n  if (hasContentHtml) content.contentHtml = input.contentHtml ?? ''\n  if (hasContentText) {\n    content.contentText = input.contentText ?? deriveContentTextFromHtml(content.contentHtml ?? '')\n  } else if (hasContentHtml) {\n    content.contentText = deriveContentTextFromHtml(content.contentHtml ?? '')\n  }\n  if (Object.prototype.hasOwnProperty.call(input, 'yjsState')) {\n    content.yjsState = input.yjsState ?? null\n  }\n  assertDocumentContentResourceLimits({\n    yjsState: content.yjsState,\n    contentHtml: content.contentHtml,\n    contentText: content.contentText,\n  })\n  content.deletedAt = null\n  content.updatedAt = now\n  return content\n}\n\nexport async function persistDocumentContent(\n  em: EntityManager,\n  documentId: string,\n  scope: DocumentScope,\n  input: { yjsState?: Buffer | null; contentHtml?: string | null; contentText?: string | null },\n  deps: PersistDocumentContentDeps,\n): Promise<PersistedDocumentContent> {\n  // Collaboration stores must not reuse a request identity map: every attempt\n  // gets a fresh EM, transaction, and row lock before checking both CAS axes.\n  const persisted = await em.fork().transactional(async (transactionalEm) => {\n    const current = await findOneWithDecryption(\n      transactionalEm,\n      DocumentContent,\n      {\n        documentId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n      },\n      { filters: false, lockMode: LockMode.PESSIMISTIC_WRITE },\n      scope,\n    )\n\n    if (deps.requireExpectedVersion && deps.expectedUpdatedAt === undefined) {\n      throw new Error('[internal] documents content CAS requires an expected version')\n    }\n    if (\n      deps.requireExpectedVersion\n      && normalizeDocumentCollaborationGeneration(deps.expectedCollaborationGeneration) === null\n    ) {\n      throw new Error('[internal] documents content CAS requires an expected collaboration generation')\n    }\n    if (deps.expectedCollaborationGeneration !== undefined) {\n      const currentGeneration = normalizeDocumentCollaborationGeneration(\n        current?.collaborationGeneration,\n      )\n      if (currentGeneration === null || currentGeneration !== deps.expectedCollaborationGeneration) {\n        throw new CrudHttpError(409, {\n          error: 'Record changed by another user',\n          code: OPTIMISTIC_LOCK_CONFLICT_CODE,\n          currentCollaborationGeneration: currentGeneration,\n          expectedCollaborationGeneration: deps.expectedCollaborationGeneration,\n        })\n      }\n    }\n    if (deps.expectedUpdatedAt !== undefined) {\n      if (!current) {\n        throw new Error('[internal] documents content changed after the collaboration room loaded')\n      }\n      assertOptimisticLock({\n        resourceKind: DOCUMENTS_ENTITY_IDS.documentContent,\n        resourceId: current.id,\n        current: current.updatedAt,\n        expected: deps.expectedUpdatedAt,\n        ...(deps.requireExpectedVersion ? { envValue: 'all' } : {}),\n      })\n    }\n\n    const previousUpdatedAt = current?.updatedAt.getTime() ?? null\n    const content = await mutateDocumentContentState(\n      transactionalEm,\n      documentId,\n      scope,\n      input,\n      { existingContent: current },\n    )\n    await transactionalEm.flush()\n    let persistedUpdatedAt = new Date(content.updatedAt.getTime())\n    if (previousUpdatedAt !== null && persistedUpdatedAt.getTime() <= previousUpdatedAt) {\n      persistedUpdatedAt = new Date(previousUpdatedAt + 1)\n      const affected = await transactionalEm.nativeUpdate(\n        DocumentContent,\n        {\n          id: content.id,\n          documentId,\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n        },\n        { updatedAt: persistedUpdatedAt },\n      )\n      if (affected !== 1) {\n        throw new Error('[internal] documents content version could not be advanced')\n      }\n      content.updatedAt = persistedUpdatedAt\n    }\n    const collaborationGeneration = normalizeDocumentCollaborationGeneration(\n      content.collaborationGeneration,\n    )\n    if (collaborationGeneration === null) {\n      throw new Error('[internal] document collaboration generation is invalid')\n    }\n    return { id: content.id, updatedAt: persistedUpdatedAt, collaborationGeneration }\n  })\n\n  try {\n    await deps.searchIndexer?.indexRecordById({\n      entityId: DOCUMENTS_ENTITY_IDS.document,\n      recordId: documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    })\n  } catch (error) {\n    // The content transaction is already committed. Search is a retryable\n    // projection and must not make Hocuspocus retain a stale CAS token or tell\n    // an HTTP caller that the canonical write failed.\n    logger.error('Content search indexing failed after commit', {\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      err: error,\n    })\n  }\n  return persisted\n}\n"],
+  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,6BAA6B;AACtC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAmCxE,SAAS,yCAAyC,OAA+B;AACtF,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,IACxE,QACA;AACN;AAEO,SAAS,uCAAuC,SAAkC;AACvF,QAAM,UAAU,yCAAyC,QAAQ,uBAAuB;AACxF,MAAI,YAAY,QAAQ,WAAW,OAAO,kBAAkB;AAC1D,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,UAAQ,0BAA0B,UAAU;AAC5C,SAAO,QAAQ;AACjB;AAEA,MAAM,aAAqC;AAAA,EACzC,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AACR;AAEA,SAAS,mBAAmB,OAAuB;AACjD,SAAO,MAAM,QAAQ,6BAA6B,CAAC,OAAO,UAAkB;AAC1E,UAAM,QAAQ,WAAW,MAAM,YAAY,CAAC;AAC5C,QAAI,MAAO,QAAO;AAClB,QAAI,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG;AACpD,YAAM,SAAS,OAAO,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE;AACjD,aAAO,OAAO,SAAS,MAAM,IAAI,OAAO,cAAc,MAAM,IAAI;AAAA,IAClE;AACA,QAAI,MAAM,WAAW,GAAG,GAAG;AACzB,YAAM,SAAS,OAAO,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE;AACjD,aAAO,OAAO,SAAS,MAAM,IAAI,OAAO,cAAc,MAAM,IAAI;AAAA,IAClE;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,0BAA0B,aAA6B;AACrE,SAAO;AAAA,IACL,YACG,QAAQ,+BAA+B,GAAG,EAC1C,QAAQ,6BAA6B,GAAG,EACxC,QAAQ,4DAA4D,IAAI,EACxE,QAAQ,gBAAgB,IAAI,EAC5B,QAAQ,YAAY,GAAG,EACvB,QAAQ,QAAQ,GAAG,EACnB,KAAK;AAAA,EACV;AACF;AAEA,eAAsB,oBACpB,IACA,YACA,OACiC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAQA,eAAsB,oCACpB,IACA,YACA,OACiC;AACjC,SAAO,GAAG,KAAK,EAAE,cAAc,CAAC,oBAAoB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,UAAU,SAAS,iBAAiB;AAAA,IACtC;AAAA,EACF,CAAC;AACH;AAOA,eAAsB,oCACpB,IACA,YACA,OACwB;AACxB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,QAAQ,CAAC,yBAAyB,EAAE;AAAA,IACtC;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,yCAAyC,QAAQ,uBAAuB;AACjF;AAEA,eAAsB,2BACpB,IACA,YACA,OACA,OACA,UAAiF,CAAC,GACxD;AAC1B,sCAAoC,KAAK;AACzC,MAAI,UAAU,QAAQ,oBAAoB,SACtC,QAAQ,kBACR,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,YAAY,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IAC7E,EAAE,SAAS,MAAM;AAAA,IACjB;AAAA,EACF;AACJ,QAAM,eAAe,QAAQ,OAAO,oBAAI,KAAK;AAC7C,QAAM,MAAM,UAAU,oBAAoB,QAAQ,WAAW,YAAY,IAAI;AAC7E,MAAI,CAAC,SAAS;AACZ,cAAU,GAAG,OAAO,iBAAiB;AAAA,MACnC,IAAI,QAAQ,MAAM,WAAW;AAAA,MAC7B;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,aAAa;AAAA,MACb,aAAa;AAAA,MACb,yBAAyB;AAAA,MACzB,WAAW;AAAA,IACb,CAAC;AACD,OAAG,QAAQ,OAAO;AAAA,EACpB,WAAW,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AAClD,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAEA,QAAM,iBAAiB,OAAO,UAAU,eAAe,KAAK,OAAO,aAAa;AAChF,QAAM,iBAAiB,OAAO,UAAU,eAAe,KAAK,OAAO,aAAa;AAChF,MAAI,eAAgB,SAAQ,cAAc,MAAM,eAAe;AAC/D,MAAI,gBAAgB;AAClB,YAAQ,cAAc,MAAM,eAAe,0BAA0B,QAAQ,eAAe,EAAE;AAAA,EAChG,WAAW,gBAAgB;AACzB,YAAQ,cAAc,0BAA0B,QAAQ,eAAe,EAAE;AAAA,EAC3E;AACA,MAAI,OAAO,UAAU,eAAe,KAAK,OAAO,UAAU,GAAG;AAC3D,YAAQ,WAAW,MAAM,YAAY;AAAA,EACvC;AACA,sCAAoC;AAAA,IAClC,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,aAAa,QAAQ;AAAA,EACvB,CAAC;AACD,UAAQ,YAAY;AACpB,UAAQ,YAAY;AACpB,SAAO;AACT;AAEA,eAAsB,uBACpB,IACA,YACA,OACA,OACA,MACmC;AAGnC,QAAM,YAAY,MAAM,GAAG,KAAK,EAAE,cAAc,OAAO,oBAAoB;AACzE,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA,EAAE,SAAS,OAAO,UAAU,SAAS,kBAAkB;AAAA,MACvD;AAAA,IACF;AAEA,QAAI,KAAK,0BAA0B,KAAK,sBAAsB,QAAW;AACvE,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,QACE,KAAK,0BACF,yCAAyC,KAAK,+BAA+B,MAAM,MACtF;AACA,YAAM,IAAI,MAAM,gFAAgF;AAAA,IAClG;AACA,QAAI,KAAK,oCAAoC,QAAW;AACtD,YAAM,oBAAoB;AAAA,QACxB,SAAS;AAAA,MACX;AACA,UAAI,sBAAsB,QAAQ,sBAAsB,KAAK,iCAAiC;AAC5F,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO;AAAA,UACP,MAAM;AAAA,UACN,gCAAgC;AAAA,UAChC,iCAAiC,KAAK;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,KAAK,sBAAsB,QAAW;AACxC,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,MAAM,0EAA0E;AAAA,MAC5F;AACA,2BAAqB;AAAA,QACnB,cAAc,qBAAqB;AAAA,QACnC,YAAY,QAAQ;AAAA,QACpB,SAAS,QAAQ;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,GAAI,KAAK,yBAAyB,EAAE,UAAU,MAAM,IAAI,CAAC;AAAA,MAC3D,CAAC;AAAA,IACH;AAEA,UAAM,oBAAoB,SAAS,UAAU,QAAQ,KAAK;AAC1D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,QAAQ;AAAA,IAC7B;AACA,UAAM,gBAAgB,MAAM;AAC5B,QAAI,qBAAqB,IAAI,KAAK,QAAQ,UAAU,QAAQ,CAAC;AAC7D,QAAI,sBAAsB,QAAQ,mBAAmB,QAAQ,KAAK,mBAAmB;AACnF,2BAAqB,IAAI,KAAK,oBAAoB,CAAC;AACnD,YAAM,WAAW,MAAM,gBAAgB;AAAA,QACrC;AAAA,QACA;AAAA,UACE,IAAI,QAAQ;AAAA,UACZ;AAAA,UACA,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,QACxB;AAAA,QACA,EAAE,WAAW,mBAAmB;AAAA,MAClC;AACA,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI,MAAM,4DAA4D;AAAA,MAC9E;AACA,cAAQ,YAAY;AAAA,IACtB;AACA,UAAM,0BAA0B;AAAA,MAC9B,QAAQ;AAAA,IACV;AACA,QAAI,4BAA4B,MAAM;AACpC,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,WAAO,EAAE,IAAI,QAAQ,IAAI,WAAW,oBAAoB,wBAAwB;AAAA,EAClF,CAAC;AAED,MAAI;AACF,UAAM,KAAK,eAAe,gBAAgB;AAAA,MACxC,UAAU,qBAAqB;AAAA,MAC/B,UAAU;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,OAAO;AAId,WAAO,MAAM,+CAA+C;AAAA,MAC1D;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,KAAK;AAAA,IACP,CAAC;AAAA,EACH;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/documents/lib/displayLabels.js

@@ -0,0 +1,23 @@
+const CANONICAL_UUID_ANYWHERE_PATTERN = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+function containsCanonicalUuid(value) {
+  return typeof value === "string" && CANONICAL_UUID_ANYWHERE_PATTERN.test(value);
+}
+function sanitizeDocumentsDisplayLabel(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  if (!normalized || containsCanonicalUuid(normalized)) return null;
+  return normalized;
+}
+function firstSafeDocumentsDisplayLabel(...values) {
+  for (const value of values) {
+    const safe = sanitizeDocumentsDisplayLabel(value);
+    if (safe) return safe;
+  }
+  return null;
+}
+export {
+  containsCanonicalUuid,
+  firstSafeDocumentsDisplayLabel,
+  sanitizeDocumentsDisplayLabel
+};
+//# sourceMappingURL=displayLabels.js.map

package/dist/modules/documents/lib/displayLabels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/displayLabels.ts"],
+  "sourcesContent": ["/**\n * Canonical UUIDs are internal identifiers, regardless of their version nibble.\n * A system-owned display label containing one is unsafe because even otherwise\n * readable text can accidentally expose a record id (for example\n * `Customer 123e4567-e89b-12d3-a456-426614174000`).\n */\nconst CANONICAL_UUID_ANYWHERE_PATTERN =\n  /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i\n\nexport function containsCanonicalUuid(value: unknown): boolean {\n  return typeof value === 'string' && CANONICAL_UUID_ANYWHERE_PATTERN.test(value)\n}\n\n/**\n * Normalize a candidate that will be rendered as a system-owned label.\n * Document prose is intentionally outside this boundary and is never censored.\n */\nexport function sanitizeDocumentsDisplayLabel(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const normalized = value.trim()\n  if (!normalized || containsCanonicalUuid(normalized)) return null\n  return normalized\n}\n\nexport function firstSafeDocumentsDisplayLabel(...values: unknown[]): string | null {\n  for (const value of values) {\n    const safe = sanitizeDocumentsDisplayLabel(value)\n    if (safe) return safe\n  }\n  return null\n}\n"],
+  "mappings": "AAMA,MAAM,kCACJ;AAEK,SAAS,sBAAsB,OAAyB;AAC7D,SAAO,OAAO,UAAU,YAAY,gCAAgC,KAAK,KAAK;AAChF;AAMO,SAAS,8BAA8B,OAA+B;AAC3E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,CAAC,cAAc,sBAAsB,UAAU,EAAG,QAAO;AAC7D,SAAO;AACT;AAEO,SAAS,kCAAkC,QAAkC;AAClF,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,8BAA8B,KAAK;AAChD,QAAI,KAAM,QAAO;AAAA,EACnB;AACA,SAAO;AACT;",
+  "names": []
+}