@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/lib/pdfRenderer.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/pdfRenderer.ts"],
+  "sourcesContent": ["import puppeteer from 'puppeteer-core'\n\nexport const PDF_RENDER_MAX_CONCURRENCY = 2\nexport const PDF_RENDER_MAX_QUEUE = 4\nexport const PDF_RENDER_ACQUIRE_TIMEOUT_MS = 2_000\nexport const PDF_RENDER_TIMEOUT_MS = 20_000\nexport const PDF_PAGE_CLOSE_TIMEOUT_MS = 1_000\nexport const PDF_MAX_OUTPUT_BYTES = 25 * 1024 * 1024\n\nconst PDF_OVERLOADED_MARKER = Symbol.for('open-mercato.documents.pdfRenderer.overloaded')\nconst PDF_TIMEOUT_MARKER = Symbol.for('open-mercato.documents.pdfRenderer.timeout')\nconst PDF_OUTPUT_TOO_LARGE_MARKER = Symbol.for('open-mercato.documents.pdfRenderer.outputTooLarge')\n\nexport class PdfRenderOverloadedError extends Error {\n  readonly [PDF_OVERLOADED_MARKER] = true\n  constructor() {\n    super('PDF renderer is at capacity')\n    this.name = 'PdfRenderOverloadedError'\n  }\n}\n\nexport class PdfRenderTimeoutError extends Error {\n  readonly [PDF_TIMEOUT_MARKER] = true\n  constructor() {\n    super('PDF renderer timed out')\n    this.name = 'PdfRenderTimeoutError'\n  }\n}\n\nexport class PdfRenderOutputTooLargeError extends Error {\n  readonly [PDF_OUTPUT_TOO_LARGE_MARKER] = true\n  constructor() {\n    super('PDF renderer output exceeded its byte limit')\n    this.name = 'PdfRenderOutputTooLargeError'\n  }\n}\n\nfunction hasErrorMarker(error: unknown, marker: symbol): boolean {\n  return Boolean(error && typeof error === 'object' && (error as Record<symbol, unknown>)[marker] === true)\n}\n\nexport const isPdfRenderOverloadedError = (error: unknown): boolean => (\n  error instanceof PdfRenderOverloadedError || hasErrorMarker(error, PDF_OVERLOADED_MARKER)\n)\nexport const isPdfRenderTimeoutError = (error: unknown): boolean => (\n  error instanceof PdfRenderTimeoutError || hasErrorMarker(error, PDF_TIMEOUT_MARKER)\n)\nexport const isPdfRenderOutputTooLargeError = (error: unknown): boolean => (\n  error instanceof PdfRenderOutputTooLargeError || hasErrorMarker(error, PDF_OUTPUT_TOO_LARGE_MARKER)\n)\n\nexport type PdfAssetRequest = {\n  url: () => string\n  resourceType: () => string\n  isNavigationRequest: () => boolean\n  continue: () => Promise<unknown>\n  abort: () => Promise<unknown>\n}\n\nexport type PdfPage = {\n  setJavaScriptEnabled: (enabled: boolean) => Promise<unknown>\n  setRequestInterception: (enabled: boolean) => Promise<unknown>\n  on: (event: 'request', listener: (request: PdfAssetRequest) => void) => unknown\n  setContent: (html: string, options: { waitUntil: 'load' }) => Promise<unknown>\n  createPDFStream: (options: { format: 'A4'; printBackground: true; preferCSSPageSize: true }) => Promise<ReadableStream<Uint8Array>>\n  close: () => Promise<unknown>\n}\n\nexport type PdfBrowser = {\n  connected?: boolean\n  newPage: () => Promise<PdfPage>\n  close: () => Promise<unknown>\n  on: (event: 'disconnected', listener: () => void) => unknown\n  process?: () => { kill: (signal?: NodeJS.Signals) => unknown } | null\n}\n\nexport type PdfBrowserLauncher = (options: {\n  executablePath: string\n  headless: true\n  args: string[]\n  timeout: number\n  protocolTimeout: number\n}) => Promise<PdfBrowser>\n\ntype PdfRendererOptions = {\n  maxConcurrency?: number\n  maxQueue?: number\n  acquireTimeoutMs?: number\n  renderTimeoutMs?: number\n  pageCloseTimeoutMs?: number\n  maxOutputBytes?: number\n}\n\nclass BoundedSemaphore {\n  private active = 0\n  private readonly waiters: Array<{\n    resolve: (release: () => void) => void\n    reject: (error: Error) => void\n    timer: ReturnType<typeof setTimeout>\n  }> = []\n\n  constructor(\n    private readonly capacity: number,\n    private readonly maxQueue: number,\n    private readonly acquireTimeoutMs: number,\n  ) {}\n\n  async acquire(): Promise<() => void> {\n    if (this.active < this.capacity) return this.grant()\n    if (this.waiters.length >= this.maxQueue) throw new PdfRenderOverloadedError()\n\n    return await new Promise<() => void>((resolve, reject) => {\n      const waiter = {\n        resolve,\n        reject,\n        timer: setTimeout(() => {\n          const index = this.waiters.indexOf(waiter)\n          if (index >= 0) this.waiters.splice(index, 1)\n          reject(new PdfRenderOverloadedError())\n        }, this.acquireTimeoutMs),\n      }\n      this.waiters.push(waiter)\n    })\n  }\n\n  private grant(): () => void {\n    this.active += 1\n    let released = false\n    return () => {\n      if (released) return\n      released = true\n      this.active -= 1\n      const waiter = this.waiters.shift()\n      if (!waiter) return\n      clearTimeout(waiter.timer)\n      waiter.resolve(this.grant())\n    }\n  }\n}\n\nfunction withTimeout<T>(\n  promise: Promise<T>,\n  timeoutMs: number,\n  onTimeout: () => void,\n): Promise<T> {\n  return new Promise<T>((resolve, reject) => {\n    let settled = false\n    const timer = setTimeout(() => {\n      if (settled) return\n      settled = true\n      onTimeout()\n      reject(new PdfRenderTimeoutError())\n    }, timeoutMs)\n    promise.then(\n      (value) => {\n        if (settled) return\n        settled = true\n        clearTimeout(timer)\n        resolve(value)\n      },\n      (error: unknown) => {\n        if (settled) return\n        settled = true\n        clearTimeout(timer)\n        reject(error)\n      },\n    )\n  })\n}\n\nasync function readBoundedPdfStream(\n  stream: ReadableStream<Uint8Array>,\n  maxOutputBytes: number,\n): Promise<Uint8Array> {\n  const reader = stream.getReader()\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      if (!value || value.byteLength === 0) continue\n      if (totalBytes + value.byteLength > maxOutputBytes) {\n        await reader.cancel('PDF output exceeded its byte limit').catch(() => undefined)\n        throw new PdfRenderOutputTooLargeError()\n      }\n      totalBytes += value.byteLength\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n\n  const output = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    output.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return output\n}\n\n/**\n * A process-local, bounded Chromium supervisor. The browser is reused between\n * requests, discarded after a crash/timeout, and never launched with sandbox-\n * disabling flags. Capacity is deliberately small so PDF work cannot starve\n * the application server.\n */\nexport function createPdfRenderer(\n  launch: PdfBrowserLauncher,\n  options: PdfRendererOptions = {},\n) {\n  const renderTimeoutMs = options.renderTimeoutMs ?? PDF_RENDER_TIMEOUT_MS\n  const pageCloseTimeoutMs = options.pageCloseTimeoutMs ?? PDF_PAGE_CLOSE_TIMEOUT_MS\n  const maxOutputBytes = options.maxOutputBytes ?? PDF_MAX_OUTPUT_BYTES\n  const semaphore = new BoundedSemaphore(\n    options.maxConcurrency ?? PDF_RENDER_MAX_CONCURRENCY,\n    options.maxQueue ?? PDF_RENDER_MAX_QUEUE,\n    options.acquireTimeoutMs ?? PDF_RENDER_ACQUIRE_TIMEOUT_MS,\n  )\n  let browserState: {\n    executablePath: string\n    promise: Promise<PdfBrowser>\n    browser?: PdfBrowser\n  } | null = null\n\n  const terminateBrowser = async (browser: PdfBrowser): Promise<void> => {\n    let closed = false\n    const closePromise = browser.close().then(\n      () => { closed = true },\n      () => undefined,\n    )\n    let closeTimer: ReturnType<typeof setTimeout> | undefined\n    const closeTimeout = new Promise<void>((resolve) => {\n      closeTimer = setTimeout(resolve, 1_000)\n    })\n    await Promise.race([\n      closePromise,\n      closeTimeout,\n    ])\n    if (closeTimer) clearTimeout(closeTimer)\n    if (!closed) browser.process?.()?.kill('SIGKILL')\n  }\n\n  const invalidateBrowser = (browser?: PdfBrowser): void => {\n    const state = browserState\n    if (!state) return\n    if (browser && state.browser && state.browser !== browser) return\n    if (browser && !state.browser) {\n      void state.promise.then((resolved) => {\n        if (resolved !== browser) return\n        if (browserState?.promise === state.promise) browserState = null\n        return terminateBrowser(resolved)\n      }).catch(() => undefined)\n      return\n    }\n    browserState = null\n    void state.promise.then((resolved) => {\n      if (!browser || browser === resolved) return terminateBrowser(resolved)\n    }).catch(() => undefined)\n  }\n\n  const getBrowser = async (executablePath: string): Promise<PdfBrowser> => {\n    if (browserState && browserState.executablePath !== executablePath) {\n      invalidateBrowser()\n    }\n    if (!browserState) {\n      const promise = launch({\n        executablePath,\n        headless: true,\n        args: [],\n        timeout: Math.min(renderTimeoutMs, 10_000),\n        protocolTimeout: renderTimeoutMs,\n      })\n      browserState = { executablePath, promise }\n      promise.then((browser) => {\n        if (browserState?.promise === promise) browserState.browser = browser\n        browser.on('disconnected', () => {\n          if (browserState?.promise === promise) browserState = null\n        })\n      }).catch(() => {\n        if (browserState?.promise === promise) browserState = null\n      })\n    }\n    const browser = await browserState.promise\n    if (browser.connected === false) {\n      invalidateBrowser(browser)\n      return getBrowser(executablePath)\n    }\n    return browser\n  }\n\n  const render = async (input: {\n    html: string\n    executablePath: string\n    isAllowedRequest: (request: PdfAssetRequest) => boolean\n  }): Promise<Uint8Array> => {\n    const release = await semaphore.acquire()\n    let browser: PdfBrowser | undefined\n    let page: PdfPage | undefined\n    try {\n      const renderOperation = (async () => {\n        browser = await getBrowser(input.executablePath)\n        page = await browser.newPage()\n        await page.setJavaScriptEnabled(false)\n        await page.setRequestInterception(true)\n        page.on('request', (request) => {\n          // A page can disappear between interception and resolution (timeout,\n          // overflow, browser crash). Never turn that normal teardown race into\n          // an unhandled rejection in the app process.\n          void Promise.resolve()\n            .then(() => (input.isAllowedRequest(request) ? request.continue() : request.abort()))\n            .catch(() => undefined)\n        })\n        await page.setContent(input.html, { waitUntil: 'load' })\n        const pdfStream = await page.createPDFStream({\n          format: 'A4',\n          printBackground: true,\n          preferCSSPageSize: true,\n        })\n        return readBoundedPdfStream(pdfStream, maxOutputBytes)\n      })()\n      try {\n        return await withTimeout(renderOperation, renderTimeoutMs, () => invalidateBrowser(browser))\n      } catch (error) {\n        if (isPdfRenderOutputTooLargeError(error)) invalidateBrowser(browser)\n        throw error\n      }\n    } finally {\n      if (page) {\n        let closeSettled = false\n        let closeTimer: ReturnType<typeof setTimeout> | undefined\n        const closePromise = page.close().then(\n          () => { closeSettled = true },\n          () => { closeSettled = true },\n        )\n        const closeTimeout = new Promise<void>((resolve) => {\n          closeTimer = setTimeout(resolve, pageCloseTimeoutMs)\n        })\n        await Promise.race([closePromise, closeTimeout])\n        if (closeTimer) clearTimeout(closeTimer)\n        if (!closeSettled) invalidateBrowser(browser)\n      }\n      release()\n    }\n  }\n\n  return {\n    render,\n    dispose: async () => {\n      const state = browserState\n      browserState = null\n      if (state) await state.promise.then(terminateBrowser).catch(() => undefined)\n    },\n  }\n}\n\nconst PDF_RENDERER_KEY = Symbol.for('open-mercato.documents.pdfRenderer')\nconst globalStore = globalThis as typeof globalThis & {\n  [PDF_RENDERER_KEY]?: ReturnType<typeof createPdfRenderer>\n}\nconst processPdfRenderer = globalStore[PDF_RENDERER_KEY]\n  ?? (globalStore[PDF_RENDERER_KEY] = createPdfRenderer(\n    (options) => puppeteer.launch(options) as unknown as Promise<PdfBrowser>,\n  ))\n\nexport const renderPdfWithChromium = processPdfRenderer.render\n"],
+  "mappings": "AAAA;AAAA,OAAO,eAAe;AAEf,MAAM,6BAA6B;AACnC,MAAM,uBAAuB;AAC7B,MAAM,gCAAgC;AACtC,MAAM,wBAAwB;AAC9B,MAAM,4BAA4B;AAClC,MAAM,uBAAuB,KAAK,OAAO;AAEhD,MAAM,wBAAwB,uBAAO,IAAI,+CAA+C;AACxF,MAAM,qBAAqB,uBAAO,IAAI,4CAA4C;AAClF,MAAM,8BAA8B,uBAAO,IAAI,mDAAmD;AAE3F,MAAM,kCAAiC,YAClC,4BADkC,IAAM;AAAA,EAElD,cAAc;AACZ,UAAM,6BAA6B;AAFrC,SAAU,MAAyB;AAGjC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,+BAA8B,YAC/B,yBAD+B,IAAM;AAAA,EAE/C,cAAc;AACZ,UAAM,wBAAwB;AAFhC,SAAU,MAAsB;AAG9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,sCAAqC,YACtC,kCADsC,IAAM;AAAA,EAEtD,cAAc;AACZ,UAAM,6CAA6C;AAFrD,SAAU,MAA+B;AAGvC,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,eAAe,OAAgB,QAAyB;AAC/D,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAa,MAAkC,MAAM,MAAM,IAAI;AAC1G;AAEO,MAAM,6BAA6B,CAAC,UACzC,iBAAiB,4BAA4B,eAAe,OAAO,qBAAqB;AAEnF,MAAM,0BAA0B,CAAC,UACtC,iBAAiB,yBAAyB,eAAe,OAAO,kBAAkB;AAE7E,MAAM,iCAAiC,CAAC,UAC7C,iBAAiB,gCAAgC,eAAe,OAAO,2BAA2B;AA6CpG,MAAM,iBAAiB;AAAA,EAQrB,YACmB,UACA,UACA,kBACjB;AAHiB;AACA;AACA;AAVnB,SAAQ,SAAS;AACjB,SAAiB,UAIZ,CAAC;AAAA,EAMH;AAAA,EAEH,MAAM,UAA+B;AACnC,QAAI,KAAK,SAAS,KAAK,SAAU,QAAO,KAAK,MAAM;AACnD,QAAI,KAAK,QAAQ,UAAU,KAAK,SAAU,OAAM,IAAI,yBAAyB;AAE7E,WAAO,MAAM,IAAI,QAAoB,CAAC,SAAS,WAAW;AACxD,YAAM,SAAS;AAAA,QACb;AAAA,QACA;AAAA,QACA,OAAO,WAAW,MAAM;AACtB,gBAAM,QAAQ,KAAK,QAAQ,QAAQ,MAAM;AACzC,cAAI,SAAS,EAAG,MAAK,QAAQ,OAAO,OAAO,CAAC;AAC5C,iBAAO,IAAI,yBAAyB,CAAC;AAAA,QACvC,GAAG,KAAK,gBAAgB;AAAA,MAC1B;AACA,WAAK,QAAQ,KAAK,MAAM;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEQ,QAAoB;AAC1B,SAAK,UAAU;AACf,QAAI,WAAW;AACf,WAAO,MAAM;AACX,UAAI,SAAU;AACd,iBAAW;AACX,WAAK,UAAU;AACf,YAAM,SAAS,KAAK,QAAQ,MAAM;AAClC,UAAI,CAAC,OAAQ;AACb,mBAAa,OAAO,KAAK;AACzB,aAAO,QAAQ,KAAK,MAAM,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAAS,YACP,SACA,WACA,WACY;AACZ,SAAO,IAAI,QAAW,CAAC,SAAS,WAAW;AACzC,QAAI,UAAU;AACd,UAAM,QAAQ,WAAW,MAAM;AAC7B,UAAI,QAAS;AACb,gBAAU;AACV,gBAAU;AACV,aAAO,IAAI,sBAAsB,CAAC;AAAA,IACpC,GAAG,SAAS;AACZ,YAAQ;AAAA,MACN,CAAC,UAAU;AACT,YAAI,QAAS;AACb,kBAAU;AACV,qBAAa,KAAK;AAClB,gBAAQ,KAAK;AAAA,MACf;AAAA,MACA,CAAC,UAAmB;AAClB,YAAI,QAAS;AACb,kBAAU;AACV,qBAAa,KAAK;AAClB,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAe,qBACb,QACA,gBACqB;AACrB,QAAM,SAAS,OAAO,UAAU;AAChC,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AACjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,SAAS,MAAM,eAAe,EAAG;AACtC,UAAI,aAAa,MAAM,aAAa,gBAAgB;AAClD,cAAM,OAAO,OAAO,oCAAoC,EAAE,MAAM,MAAM,MAAS;AAC/E,cAAM,IAAI,6BAA6B;AAAA,MACzC;AACA,oBAAc,MAAM;AACpB,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,SAAS,IAAI,WAAW,UAAU;AACxC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAQO,SAAS,kBACd,QACA,UAA8B,CAAC,GAC/B;AACA,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,YAAY,IAAI;AAAA,IACpB,QAAQ,kBAAkB;AAAA,IAC1B,QAAQ,YAAY;AAAA,IACpB,QAAQ,oBAAoB;AAAA,EAC9B;AACA,MAAI,eAIO;AAEX,QAAM,mBAAmB,OAAO,YAAuC;AACrE,QAAI,SAAS;AACb,UAAM,eAAe,QAAQ,MAAM,EAAE;AAAA,MACnC,MAAM;AAAE,iBAAS;AAAA,MAAK;AAAA,MACtB,MAAM;AAAA,IACR;AACA,QAAI;AACJ,UAAM,eAAe,IAAI,QAAc,CAAC,YAAY;AAClD,mBAAa,WAAW,SAAS,GAAK;AAAA,IACxC,CAAC;AACD,UAAM,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,WAAY,cAAa,UAAU;AACvC,QAAI,CAAC,OAAQ,SAAQ,UAAU,GAAG,KAAK,SAAS;AAAA,EAClD;AAEA,QAAM,oBAAoB,CAAC,YAA+B;AACxD,UAAM,QAAQ;AACd,QAAI,CAAC,MAAO;AACZ,QAAI,WAAW,MAAM,WAAW,MAAM,YAAY,QAAS;AAC3D,QAAI,WAAW,CAAC,MAAM,SAAS;AAC7B,WAAK,MAAM,QAAQ,KAAK,CAAC,aAAa;AACpC,YAAI,aAAa,QAAS;AAC1B,YAAI,cAAc,YAAY,MAAM,QAAS,gBAAe;AAC5D,eAAO,iBAAiB,QAAQ;AAAA,MAClC,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB;AAAA,IACF;AACA,mBAAe;AACf,SAAK,MAAM,QAAQ,KAAK,CAAC,aAAa;AACpC,UAAI,CAAC,WAAW,YAAY,SAAU,QAAO,iBAAiB,QAAQ;AAAA,IACxE,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B;AAEA,QAAM,aAAa,OAAO,mBAAgD;AACxE,QAAI,gBAAgB,aAAa,mBAAmB,gBAAgB;AAClE,wBAAkB;AAAA,IACpB;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,UAAU,OAAO;AAAA,QACrB;AAAA,QACA,UAAU;AAAA,QACV,MAAM,CAAC;AAAA,QACP,SAAS,KAAK,IAAI,iBAAiB,GAAM;AAAA,QACzC,iBAAiB;AAAA,MACnB,CAAC;AACD,qBAAe,EAAE,gBAAgB,QAAQ;AACzC,cAAQ,KAAK,CAACA,aAAY;AACxB,YAAI,cAAc,YAAY,QAAS,cAAa,UAAUA;AAC9D,QAAAA,SAAQ,GAAG,gBAAgB,MAAM;AAC/B,cAAI,cAAc,YAAY,QAAS,gBAAe;AAAA,QACxD,CAAC;AAAA,MACH,CAAC,EAAE,MAAM,MAAM;AACb,YAAI,cAAc,YAAY,QAAS,gBAAe;AAAA,MACxD,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,aAAa;AACnC,QAAI,QAAQ,cAAc,OAAO;AAC/B,wBAAkB,OAAO;AACzB,aAAO,WAAW,cAAc;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,OAAO,UAIK;AACzB,UAAM,UAAU,MAAM,UAAU,QAAQ;AACxC,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,YAAM,mBAAmB,YAAY;AACnC,kBAAU,MAAM,WAAW,MAAM,cAAc;AAC/C,eAAO,MAAM,QAAQ,QAAQ;AAC7B,cAAM,KAAK,qBAAqB,KAAK;AACrC,cAAM,KAAK,uBAAuB,IAAI;AACtC,aAAK,GAAG,WAAW,CAAC,YAAY;AAI9B,eAAK,QAAQ,QAAQ,EAClB,KAAK,MAAO,MAAM,iBAAiB,OAAO,IAAI,QAAQ,SAAS,IAAI,QAAQ,MAAM,CAAE,EACnF,MAAM,MAAM,MAAS;AAAA,QAC1B,CAAC;AACD,cAAM,KAAK,WAAW,MAAM,MAAM,EAAE,WAAW,OAAO,CAAC;AACvD,cAAM,YAAY,MAAM,KAAK,gBAAgB;AAAA,UAC3C,QAAQ;AAAA,UACR,iBAAiB;AAAA,UACjB,mBAAmB;AAAA,QACrB,CAAC;AACD,eAAO,qBAAqB,WAAW,cAAc;AAAA,MACvD,GAAG;AACH,UAAI;AACF,eAAO,MAAM,YAAY,iBAAiB,iBAAiB,MAAM,kBAAkB,OAAO,CAAC;AAAA,MAC7F,SAAS,OAAO;AACd,YAAI,+BAA+B,KAAK,EAAG,mBAAkB,OAAO;AACpE,cAAM;AAAA,MACR;AAAA,IACF,UAAE;AACA,UAAI,MAAM;AACR,YAAI,eAAe;AACnB,YAAI;AACJ,cAAM,eAAe,KAAK,MAAM,EAAE;AAAA,UAChC,MAAM;AAAE,2BAAe;AAAA,UAAK;AAAA,UAC5B,MAAM;AAAE,2BAAe;AAAA,UAAK;AAAA,QAC9B;AACA,cAAM,eAAe,IAAI,QAAc,CAAC,YAAY;AAClD,uBAAa,WAAW,SAAS,kBAAkB;AAAA,QACrD,CAAC;AACD,cAAM,QAAQ,KAAK,CAAC,cAAc,YAAY,CAAC;AAC/C,YAAI,WAAY,cAAa,UAAU;AACvC,YAAI,CAAC,aAAc,mBAAkB,OAAO;AAAA,MAC9C;AACA,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,QAAQ;AACd,qBAAe;AACf,UAAI,MAAO,OAAM,MAAM,QAAQ,KAAK,gBAAgB,EAAE,MAAM,MAAM,MAAS;AAAA,IAC7E;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,uBAAO,IAAI,oCAAoC;AACxE,MAAM,cAAc;AAGpB,MAAM,qBAAqB,YAAY,gBAAgB,MACjD,YAAY,gBAAgB,IAAI;AAAA,EAClC,CAAC,YAAY,UAAU,OAAO,OAAO;AACvC;AAEK,MAAM,wBAAwB,mBAAmB;",
+  "names": ["browser"]
+}

package/dist/modules/documents/lib/permissions.js

@@ -0,0 +1,222 @@
+import { hasAllFeatures } from "@open-mercato/shared/lib/auth/featureMatch";
+import { forbidden } from "@open-mercato/shared/lib/crud/errors";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Document, DocumentShare } from "../data/entities.js";
+import {
+  resolveApiKeyPrincipalService,
+  resolveAuthPrincipalService,
+  resolveDocumentsRbacService
+} from "./platformServices.js";
+const TIER_RANK = {
+  owner: 3,
+  editor: 2,
+  commenter: 1,
+  viewer: 0
+};
+function resolveUserId(ctx) {
+  if (!ctx) return null;
+  if (typeof ctx.userId === "string" && ctx.userId.trim().length > 0) return ctx.userId;
+  if (typeof ctx.sub === "string" && ctx.sub.trim().length > 0 && !ctx.sub.startsWith("api_key:")) return ctx.sub;
+  return null;
+}
+function resolveOrganizationId(ctx) {
+  if (typeof ctx.organizationId === "string" && ctx.organizationId.trim().length > 0) {
+    return ctx.organizationId;
+  }
+  if (typeof ctx.orgId === "string" && ctx.orgId.trim().length > 0) return ctx.orgId;
+  return null;
+}
+function normalizeStrings(values) {
+  if (!Array.isArray(values)) return [];
+  return Array.from(
+    new Set(
+      values.map((value) => typeof value === "string" ? value.trim() : "").filter((value) => value.length > 0)
+    )
+  );
+}
+function hasDocumentsManage(ctx) {
+  if (ctx.isSuperAdmin === true) return true;
+  const features = normalizeStrings(ctx.features);
+  return hasAllFeatures(["documents.manage"], features);
+}
+async function resolveActiveUserRoleIds(container, scope, userId) {
+  const service = resolveAuthPrincipalService(container);
+  if (!service) return [];
+  return normalizeStrings(await service.resolveActiveUserRoleIds(userId, scope));
+}
+async function resolveActiveSubjectRoleIds(container, scope, subject) {
+  if (!subject.startsWith("api_key:")) {
+    return resolveActiveUserRoleIds(container, scope, subject);
+  }
+  const apiKeyId = subject.slice("api_key:".length).trim();
+  if (!apiKeyId) return [];
+  const apiKeyService = resolveApiKeyPrincipalService(container);
+  const authService = resolveAuthPrincipalService(container);
+  if (!apiKeyService || !authService) return [];
+  const assigned = normalizeStrings(await apiKeyService.resolveAssignedRoleIds(apiKeyId, scope));
+  if (assigned.length === 0) return [];
+  return normalizeStrings(await authService.filterActiveRoleIds(assigned, scope));
+}
+function maxShareTier(shares) {
+  let best = null;
+  for (const share of shares) {
+    const permission = share.permission;
+    if (permission !== "viewer" && permission !== "commenter" && permission !== "editor") continue;
+    if (!best || TIER_RANK[permission] > TIER_RANK[best]) best = permission;
+  }
+  return best;
+}
+async function resolvePermission(em, documentId, ctx) {
+  if (!ctx || !ctx.tenantId) return null;
+  const permissionCtx = ctx;
+  const organizationId = resolveOrganizationId(permissionCtx);
+  if (!organizationId) return null;
+  const document = await findOneWithDecryption(
+    em,
+    Document,
+    {
+      id: documentId,
+      tenantId: ctx.tenantId,
+      organizationId,
+      deletedAt: null
+    },
+    void 0,
+    { tenantId: ctx.tenantId, organizationId }
+  );
+  if (!document) return null;
+  const userId = resolveUserId(ctx);
+  if (userId && document.ownerUserId === userId || hasDocumentsManage(permissionCtx)) {
+    return "owner";
+  }
+  if (!userId) return null;
+  const roleIds = normalizeStrings(permissionCtx.resolvedRoleIds);
+  const principals = [
+    { principalType: "user", principalId: userId }
+  ];
+  if (roleIds.length > 0) {
+    principals.push({ principalType: "role", principalId: { $in: roleIds } });
+  }
+  const shares = await findWithDecryption(
+    em,
+    DocumentShare,
+    {
+      documentId,
+      tenantId: ctx.tenantId,
+      organizationId,
+      deletedAt: null,
+      $or: principals
+    },
+    void 0,
+    { tenantId: ctx.tenantId, organizationId }
+  );
+  return maxShareTier(shares);
+}
+async function loadScopedDocument(em, documentId, scope) {
+  return findOneWithDecryption(
+    em,
+    Document,
+    {
+      id: documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    void 0,
+    scope
+  );
+}
+async function resolveLoadedDocumentUserAccess(em, document, scope, userId, container) {
+  if (document.ownerUserId === userId) return "owner";
+  if (await resolveDocumentsRbacService(container)?.userHasAllFeatures(
+    userId,
+    ["documents.manage"],
+    scope
+  )) return "owner";
+  const roleIds = await resolveActiveUserRoleIds(container, scope, userId);
+  const principals = [
+    { principalType: "user", principalId: userId }
+  ];
+  if (roleIds.length > 0) {
+    principals.push({ principalType: "role", principalId: { $in: roleIds } });
+  }
+  const shares = await findWithDecryption(
+    em,
+    DocumentShare,
+    {
+      documentId: document.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+      $or: principals
+    },
+    void 0,
+    scope
+  );
+  return maxShareTier(shares);
+}
+async function resolveUserAccess(em, documentId, scope, userId, container) {
+  const document = await loadScopedDocument(em, documentId, scope);
+  if (!document) return null;
+  return resolveLoadedDocumentUserAccess(em, document, scope, userId, container);
+}
+async function resolveSubjectAccess(em, documentId, scope, identity, container) {
+  const document = await findOneWithDecryption(
+    em,
+    Document,
+    {
+      id: documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    void 0,
+    scope
+  );
+  if (!document) return null;
+  if (document.ownerUserId === identity.userId) return "owner";
+  const roleIds = await resolveActiveSubjectRoleIds(container, scope, identity.subject);
+  const principals = [
+    { principalType: "user", principalId: identity.userId }
+  ];
+  if (roleIds.length > 0) {
+    principals.push({ principalType: "role", principalId: { $in: roleIds } });
+  }
+  const shares = await findWithDecryption(
+    em,
+    DocumentShare,
+    {
+      documentId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+      $or: principals
+    },
+    void 0,
+    scope
+  );
+  return maxShareTier(shares);
+}
+function hasTier(tier, required) {
+  if (!tier) return false;
+  return TIER_RANK[tier] >= TIER_RANK[required];
+}
+async function assertTier(em, documentId, ctx, required) {
+  const tier = await resolvePermission(em, documentId, ctx);
+  if (!tier || !hasTier(tier, required)) {
+    throw forbidden("Forbidden");
+  }
+  return tier;
+}
+export {
+  TIER_RANK,
+  assertTier,
+  hasTier,
+  loadScopedDocument,
+  resolveActiveSubjectRoleIds,
+  resolveActiveUserRoleIds,
+  resolveLoadedDocumentUserAccess,
+  resolvePermission,
+  resolveSubjectAccess,
+  resolveUserAccess
+};
+//# sourceMappingURL=permissions.js.map

package/dist/modules/documents/lib/permissions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/permissions.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'\nimport { forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Document, DocumentShare } from '../data/entities'\nimport {\n  resolveApiKeyPrincipalService,\n  resolveAuthPrincipalService,\n  resolveDocumentsRbacService,\n  type DocumentsServiceContainer,\n} from './platformServices'\n\nexport type DocumentTier = 'owner' | 'editor' | 'commenter' | 'viewer'\n\nexport const TIER_RANK: Record<DocumentTier, number> = {\n  owner: 3,\n  editor: 2,\n  commenter: 1,\n  viewer: 0,\n}\n\ntype DocumentsPermissionContext = NonNullable<AuthContext> & {\n  features?: string[]\n  roleIds?: string[]\n  resolvedRoleIds?: string[]\n  organizationId?: string | null\n}\n\nfunction resolveUserId(ctx: AuthContext): string | null {\n  if (!ctx) return null\n  if (typeof ctx.userId === 'string' && ctx.userId.trim().length > 0) return ctx.userId\n  if (typeof ctx.sub === 'string' && ctx.sub.trim().length > 0 && !ctx.sub.startsWith('api_key:')) return ctx.sub\n  return null\n}\n\nfunction resolveOrganizationId(ctx: DocumentsPermissionContext): string | null {\n  if (typeof ctx.organizationId === 'string' && ctx.organizationId.trim().length > 0) {\n    return ctx.organizationId\n  }\n  if (typeof ctx.orgId === 'string' && ctx.orgId.trim().length > 0) return ctx.orgId\n  return null\n}\n\nfunction normalizeStrings(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  return Array.from(\n    new Set(\n      values\n        .map((value) => (typeof value === 'string' ? value.trim() : ''))\n        .filter((value) => value.length > 0),\n    ),\n  )\n}\n\nfunction hasDocumentsManage(ctx: DocumentsPermissionContext): boolean {\n  if (ctx.isSuperAdmin === true) return true\n  const features = normalizeStrings(ctx.features)\n  return hasAllFeatures(['documents.manage'], features)\n}\n\nexport async function resolveActiveUserRoleIds(\n  container: DocumentsServiceContainer | null | undefined,\n  scope: { tenantId: string; organizationId: string },\n  userId: string,\n): Promise<string[]> {\n  const service = resolveAuthPrincipalService(container)\n  if (!service) return []\n  return normalizeStrings(await service.resolveActiveUserRoleIds(userId, scope))\n}\n\nexport async function resolveActiveSubjectRoleIds(\n  container: DocumentsServiceContainer | null | undefined,\n  scope: { tenantId: string; organizationId: string },\n  subject: string,\n): Promise<string[]> {\n  if (!subject.startsWith('api_key:')) {\n    return resolveActiveUserRoleIds(container, scope, subject)\n  }\n\n  const apiKeyId = subject.slice('api_key:'.length).trim()\n  if (!apiKeyId) return []\n  const apiKeyService = resolveApiKeyPrincipalService(container)\n  const authService = resolveAuthPrincipalService(container)\n  if (!apiKeyService || !authService) return []\n  const assigned = normalizeStrings(await apiKeyService.resolveAssignedRoleIds(apiKeyId, scope))\n  if (assigned.length === 0) return []\n  return normalizeStrings(await authService.filterActiveRoleIds(assigned, scope))\n}\n\nfunction maxShareTier(shares: DocumentShare[]): DocumentTier | null {\n  let best: DocumentTier | null = null\n  for (const share of shares) {\n    const permission = share.permission\n    if (permission !== 'viewer' && permission !== 'commenter' && permission !== 'editor') continue\n    if (!best || TIER_RANK[permission] > TIER_RANK[best]) best = permission\n  }\n  return best\n}\n\nexport async function resolvePermission(\n  em: EntityManager,\n  documentId: string,\n  ctx: AuthContext,\n): Promise<DocumentTier | null> {\n  if (!ctx || !ctx.tenantId) return null\n  const permissionCtx = ctx as DocumentsPermissionContext\n  const organizationId = resolveOrganizationId(permissionCtx)\n  if (!organizationId) return null\n\n  const document = await findOneWithDecryption(\n    em,\n    Document,\n    {\n      id: documentId,\n      tenantId: ctx.tenantId,\n      organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: ctx.tenantId, organizationId },\n  )\n  if (!document) return null\n\n  const userId = resolveUserId(ctx)\n  if ((userId && document.ownerUserId === userId) || hasDocumentsManage(permissionCtx)) {\n    return 'owner'\n  }\n  if (!userId) return null\n\n  // Never trust role ids/names carried by the request token. Role shares are\n  // resolved from active UserRole links to active roles in the current tenant.\n  // Only consume the server-projected role set. Raw token roleIds/roles are\n  // authentication hints and can outlive an assignment revocation.\n  const roleIds = normalizeStrings(permissionCtx.resolvedRoleIds)\n  const principals: Array<FilterQuery<DocumentShare>> = [\n    { principalType: 'user', principalId: userId },\n  ]\n  if (roleIds.length > 0) {\n    principals.push({ principalType: 'role', principalId: { $in: roleIds } } as FilterQuery<DocumentShare>)\n  }\n\n  const shares = await findWithDecryption(\n    em,\n    DocumentShare,\n    {\n      documentId,\n      tenantId: ctx.tenantId,\n      organizationId,\n      deletedAt: null,\n      $or: principals,\n    } as FilterQuery<DocumentShare>,\n    undefined,\n    { tenantId: ctx.tenantId, organizationId },\n  )\n\n  return maxShareTier(shares)\n}\n\nexport async function loadScopedDocument(\n  em: EntityManager,\n  documentId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<Document | null> {\n  return findOneWithDecryption(\n    em,\n    Document,\n    {\n      id: documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n}\n\n/**\n * Resolve one user's tier against an already scoped document. Callers that\n * evaluate many users for the same document load it once and reuse it here\n * instead of re-reading the identical row per user.\n */\nexport async function resolveLoadedDocumentUserAccess(\n  em: EntityManager,\n  document: Document,\n  scope: { tenantId: string; organizationId: string },\n  userId: string,\n  container?: DocumentsServiceContainer | null,\n): Promise<DocumentTier | null> {\n  if (document.ownerUserId === userId) return 'owner'\n  if (await resolveDocumentsRbacService(container)?.userHasAllFeatures(\n    userId,\n    ['documents.manage'],\n    scope,\n  )) return 'owner'\n\n  const roleIds = await resolveActiveUserRoleIds(container, scope, userId)\n\n  const principals: Array<FilterQuery<DocumentShare>> = [\n    { principalType: 'user', principalId: userId },\n  ]\n  if (roleIds.length > 0) {\n    principals.push({ principalType: 'role', principalId: { $in: roleIds } } as FilterQuery<DocumentShare>)\n  }\n\n  const shares = await findWithDecryption(\n    em,\n    DocumentShare,\n    {\n      documentId: document.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n      $or: principals,\n    } as FilterQuery<DocumentShare>,\n    undefined,\n    scope,\n  )\n\n  return maxShareTier(shares)\n}\n\nexport async function resolveUserAccess(\n  em: EntityManager,\n  documentId: string,\n  scope: { tenantId: string; organizationId: string },\n  userId: string,\n  container?: DocumentsServiceContainer | null,\n): Promise<DocumentTier | null> {\n  const document = await loadScopedDocument(em, documentId, scope)\n  if (!document) return null\n  return resolveLoadedDocumentUserAccess(em, document, scope, userId, container)\n}\n\nexport async function resolveSubjectAccess(\n  em: EntityManager,\n  documentId: string,\n  scope: { tenantId: string; organizationId: string },\n  identity: { subject: string; userId: string },\n  container?: DocumentsServiceContainer | null,\n): Promise<DocumentTier | null> {\n  const document = await findOneWithDecryption(\n    em,\n    Document,\n    {\n      id: documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!document) return null\n  if (document.ownerUserId === identity.userId) return 'owner'\n\n  const roleIds = await resolveActiveSubjectRoleIds(container, scope, identity.subject)\n  const principals: Array<FilterQuery<DocumentShare>> = [\n    { principalType: 'user', principalId: identity.userId },\n  ]\n  if (roleIds.length > 0) {\n    principals.push({ principalType: 'role', principalId: { $in: roleIds } } as FilterQuery<DocumentShare>)\n  }\n\n  const shares = await findWithDecryption(\n    em,\n    DocumentShare,\n    {\n      documentId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n      $or: principals,\n    } as FilterQuery<DocumentShare>,\n    undefined,\n    scope,\n  )\n  return maxShareTier(shares)\n}\n\nexport function hasTier(tier: DocumentTier | null, required: DocumentTier): boolean {\n  if (!tier) return false\n  return TIER_RANK[tier] >= TIER_RANK[required]\n}\n\nexport async function assertTier(\n  em: EntityManager,\n  documentId: string,\n  ctx: AuthContext,\n  required: DocumentTier,\n): Promise<DocumentTier> {\n  const tier = await resolvePermission(em, documentId, ctx)\n  if (!tier || !hasTier(tier, required)) {\n    throw forbidden('Forbidden')\n  }\n  return tier\n}\n"],
+  "mappings": "AAGA,SAAS,sBAAsB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,UAAU,qBAAqB;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIA,MAAM,YAA0C;AAAA,EACrD,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AACV;AASA,SAAS,cAAc,KAAiC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,IAAI;AAC/E,MAAI,OAAO,IAAI,QAAQ,YAAY,IAAI,IAAI,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,IAAI,WAAW,UAAU,EAAG,QAAO,IAAI;AAC5G,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAgD;AAC7E,MAAI,OAAO,IAAI,mBAAmB,YAAY,IAAI,eAAe,KAAK,EAAE,SAAS,GAAG;AAClF,WAAO,IAAI;AAAA,EACb;AACA,MAAI,OAAO,IAAI,UAAU,YAAY,IAAI,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,IAAI;AAC7E,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA2B;AACnD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,SAAO,MAAM;AAAA,IACX,IAAI;AAAA,MACF,OACG,IAAI,CAAC,UAAW,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI,EAAG,EAC9D,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,IACvC;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,KAA0C;AACpE,MAAI,IAAI,iBAAiB,KAAM,QAAO;AACtC,QAAM,WAAW,iBAAiB,IAAI,QAAQ;AAC9C,SAAO,eAAe,CAAC,kBAAkB,GAAG,QAAQ;AACtD;AAEA,eAAsB,yBACpB,WACA,OACA,QACmB;AACnB,QAAM,UAAU,4BAA4B,SAAS;AACrD,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,iBAAiB,MAAM,QAAQ,yBAAyB,QAAQ,KAAK,CAAC;AAC/E;AAEA,eAAsB,4BACpB,WACA,OACA,SACmB;AACnB,MAAI,CAAC,QAAQ,WAAW,UAAU,GAAG;AACnC,WAAO,yBAAyB,WAAW,OAAO,OAAO;AAAA,EAC3D;AAEA,QAAM,WAAW,QAAQ,MAAM,WAAW,MAAM,EAAE,KAAK;AACvD,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,gBAAgB,8BAA8B,SAAS;AAC7D,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,iBAAiB,CAAC,YAAa,QAAO,CAAC;AAC5C,QAAM,WAAW,iBAAiB,MAAM,cAAc,uBAAuB,UAAU,KAAK,CAAC;AAC7F,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AACnC,SAAO,iBAAiB,MAAM,YAAY,oBAAoB,UAAU,KAAK,CAAC;AAChF;AAEA,SAAS,aAAa,QAA8C;AAClE,MAAI,OAA4B;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,MAAM;AACzB,QAAI,eAAe,YAAY,eAAe,eAAe,eAAe,SAAU;AACtF,QAAI,CAAC,QAAQ,UAAU,UAAU,IAAI,UAAU,IAAI,EAAG,QAAO;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,eAAsB,kBACpB,IACA,YACA,KAC8B;AAC9B,MAAI,CAAC,OAAO,CAAC,IAAI,SAAU,QAAO;AAClC,QAAM,gBAAgB;AACtB,QAAM,iBAAiB,sBAAsB,aAAa;AAC1D,MAAI,CAAC,eAAgB,QAAO;AAE5B,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,IAAI;AAAA,MACd;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,IAAI,UAAU,eAAe;AAAA,EAC3C;AACA,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,SAAS,cAAc,GAAG;AAChC,MAAK,UAAU,SAAS,gBAAgB,UAAW,mBAAmB,aAAa,GAAG;AACpF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAQ,QAAO;AAMpB,QAAM,UAAU,iBAAiB,cAAc,eAAe;AAC9D,QAAM,aAAgD;AAAA,IACpD,EAAE,eAAe,QAAQ,aAAa,OAAO;AAAA,EAC/C;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,KAAK,EAAE,eAAe,QAAQ,aAAa,EAAE,KAAK,QAAQ,EAAE,CAA+B;AAAA,EACxG;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,IAAI;AAAA,MACd;AAAA,MACA,WAAW;AAAA,MACX,KAAK;AAAA,IACP;AAAA,IACA;AAAA,IACA,EAAE,UAAU,IAAI,UAAU,eAAe;AAAA,EAC3C;AAEA,SAAO,aAAa,MAAM;AAC5B;AAEA,eAAsB,mBACpB,IACA,YACA,OAC0B;AAC1B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,gCACpB,IACA,UACA,OACA,QACA,WAC8B;AAC9B,MAAI,SAAS,gBAAgB,OAAQ,QAAO;AAC5C,MAAI,MAAM,4BAA4B,SAAS,GAAG;AAAA,IAChD;AAAA,IACA,CAAC,kBAAkB;AAAA,IACnB;AAAA,EACF,EAAG,QAAO;AAEV,QAAM,UAAU,MAAM,yBAAyB,WAAW,OAAO,MAAM;AAEvE,QAAM,aAAgD;AAAA,IACpD,EAAE,eAAe,QAAQ,aAAa,OAAO;AAAA,EAC/C;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,KAAK,EAAE,eAAe,QAAQ,aAAa,EAAE,KAAK,QAAQ,EAAE,CAA+B;AAAA,EACxG;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,YAAY,SAAS;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,MACX,KAAK;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAa,MAAM;AAC5B;AAEA,eAAsB,kBACpB,IACA,YACA,OACA,QACA,WAC8B;AAC9B,QAAM,WAAW,MAAM,mBAAmB,IAAI,YAAY,KAAK;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,gCAAgC,IAAI,UAAU,OAAO,QAAQ,SAAS;AAC/E;AAEA,eAAsB,qBACpB,IACA,YACA,OACA,UACA,WAC8B;AAC9B,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,gBAAgB,SAAS,OAAQ,QAAO;AAErD,QAAM,UAAU,MAAM,4BAA4B,WAAW,OAAO,SAAS,OAAO;AACpF,QAAM,aAAgD;AAAA,IACpD,EAAE,eAAe,QAAQ,aAAa,SAAS,OAAO;AAAA,EACxD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,KAAK,EAAE,eAAe,QAAQ,aAAa,EAAE,KAAK,QAAQ,EAAE,CAA+B;AAAA,EACxG;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,MACX,KAAK;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,aAAa,MAAM;AAC5B;AAEO,SAAS,QAAQ,MAA2B,UAAiC;AAClF,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,UAAU,IAAI,KAAK,UAAU,QAAQ;AAC9C;AAEA,eAAsB,WACpB,IACA,YACA,KACA,UACuB;AACvB,QAAM,OAAO,MAAM,kBAAkB,IAAI,YAAY,GAAG;AACxD,MAAI,CAAC,QAAQ,CAAC,QAAQ,MAAM,QAAQ,GAAG;AACrC,UAAM,UAAU,WAAW;AAAA,EAC7B;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/documents/lib/platformServices.js

@@ -0,0 +1,35 @@
+function tryResolve(container, name) {
+  if (!container) return null;
+  try {
+    return container.resolve(name);
+  } catch {
+    return null;
+  }
+}
+function resolveAuthPrincipalService(container) {
+  const service = tryResolve(container, "authPrincipalService");
+  if (!service || typeof service.principalExists !== "function" || typeof service.resolveActiveUserRoleIds !== "function" || typeof service.filterActiveRoleIds !== "function" || typeof service.resolveLabels !== "function" || typeof service.listSuperAdminUserIds !== "function") return null;
+  return service;
+}
+function resolveApiKeyPrincipalService(container) {
+  const service = tryResolve(container, "apiKeyPrincipalService");
+  return service && typeof service.resolveAssignedRoleIds === "function" ? service : null;
+}
+function resolveDocumentsRbacService(container) {
+  const service = tryResolve(container, "rbacService");
+  return service && typeof service.userHasAllFeatures === "function" ? service : null;
+}
+function resolveOrganizationScopeService(container) {
+  const service = tryResolve(container, "organizationScopeService");
+  if (!service || typeof service.resolve !== "function" || typeof service.resolveFresh !== "function" || typeof service.resolveForRequest !== "function") {
+    return null;
+  }
+  return service;
+}
+export {
+  resolveApiKeyPrincipalService,
+  resolveAuthPrincipalService,
+  resolveDocumentsRbacService,
+  resolveOrganizationScopeService
+};
+//# sourceMappingURL=platformServices.js.map

package/dist/modules/documents/lib/platformServices.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/platformServices.ts"],
+  "sourcesContent": ["import type {\n  ApiKeyPrincipalService,\n  AuthPrincipalService,\n  OrganizationScopeService,\n} from '@open-mercato/shared/lib/auth/principal-service'\n\nexport type DocumentsServiceContainer = {\n  resolve(name: string): unknown\n}\n\nexport type DocumentsRbacService = {\n  userHasAllFeatures(\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<boolean>\n}\n\nfunction tryResolve(container: DocumentsServiceContainer | null | undefined, name: string): unknown {\n  if (!container) return null\n  try {\n    return container.resolve(name)\n  } catch {\n    return null\n  }\n}\n\nexport function resolveAuthPrincipalService(\n  container: DocumentsServiceContainer | null | undefined,\n): AuthPrincipalService | null {\n  const service = tryResolve(container, 'authPrincipalService') as Partial<AuthPrincipalService> | null\n  if (!service\n    || typeof service.principalExists !== 'function'\n    || typeof service.resolveActiveUserRoleIds !== 'function'\n    || typeof service.filterActiveRoleIds !== 'function'\n    || typeof service.resolveLabels !== 'function'\n    || typeof service.listSuperAdminUserIds !== 'function') return null\n  return service as AuthPrincipalService\n}\n\nexport function resolveApiKeyPrincipalService(\n  container: DocumentsServiceContainer | null | undefined,\n): ApiKeyPrincipalService | null {\n  const service = tryResolve(container, 'apiKeyPrincipalService') as Partial<ApiKeyPrincipalService> | null\n  return service && typeof service.resolveAssignedRoleIds === 'function'\n    ? service as ApiKeyPrincipalService\n    : null\n}\n\nexport function resolveDocumentsRbacService(\n  container: DocumentsServiceContainer | null | undefined,\n): DocumentsRbacService | null {\n  const service = tryResolve(container, 'rbacService') as Partial<DocumentsRbacService> | null\n  return service && typeof service.userHasAllFeatures === 'function'\n    ? service as DocumentsRbacService\n    : null\n}\n\nexport function resolveOrganizationScopeService(\n  container: DocumentsServiceContainer | null | undefined,\n): OrganizationScopeService | null {\n  const service = tryResolve(container, 'organizationScopeService') as Partial<OrganizationScopeService> | null\n  if (!service\n    || typeof service.resolve !== 'function'\n    || typeof service.resolveFresh !== 'function'\n    || typeof service.resolveForRequest !== 'function') {\n    return null\n  }\n  return service as OrganizationScopeService\n}\n"],
+  "mappings": "AAkBA,SAAS,WAAW,WAAyD,MAAuB;AAClG,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,4BACd,WAC6B;AAC7B,QAAM,UAAU,WAAW,WAAW,sBAAsB;AAC5D,MAAI,CAAC,WACA,OAAO,QAAQ,oBAAoB,cACnC,OAAO,QAAQ,6BAA6B,cAC5C,OAAO,QAAQ,wBAAwB,cACvC,OAAO,QAAQ,kBAAkB,cACjC,OAAO,QAAQ,0BAA0B,WAAY,QAAO;AACjE,SAAO;AACT;AAEO,SAAS,8BACd,WAC+B;AAC/B,QAAM,UAAU,WAAW,WAAW,wBAAwB;AAC9D,SAAO,WAAW,OAAO,QAAQ,2BAA2B,aACxD,UACA;AACN;AAEO,SAAS,4BACd,WAC6B;AAC7B,QAAM,UAAU,WAAW,WAAW,aAAa;AACnD,SAAO,WAAW,OAAO,QAAQ,uBAAuB,aACpD,UACA;AACN;AAEO,SAAS,gCACd,WACiC;AACjC,QAAM,UAAU,WAAW,WAAW,0BAA0B;AAChE,MAAI,CAAC,WACA,OAAO,QAAQ,YAAY,cAC3B,OAAO,QAAQ,iBAAiB,cAChC,OAAO,QAAQ,sBAAsB,YAAY;AACpD,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/documents/lib/recordFieldInsertion.js

@@ -0,0 +1,58 @@
+import { sanitizeDocumentsDisplayLabel } from "./displayLabels.js";
+function normalizeRecordFieldSnapshots(fields) {
+  const normalized = /* @__PURE__ */ new Map();
+  for (const field of fields) {
+    const key = field.field.trim();
+    const label = sanitizeDocumentsDisplayLabel(field.label);
+    const value = sanitizeDocumentsDisplayLabel(field.value);
+    if (!key || !label || !value || normalized.has(key)) continue;
+    normalized.set(key, { field: key, label, value });
+  }
+  return Array.from(normalized.values());
+}
+function text(value, bold = false) {
+  return {
+    type: "text",
+    text: value,
+    ...bold ? { marks: [{ type: "bold" }] } : {}
+  };
+}
+function paragraph(field) {
+  return {
+    type: "paragraph",
+    content: [text(field.label, true), text(`: ${field.value}`)]
+  };
+}
+function tableCell(value, bold = false) {
+  return {
+    type: "tableCell",
+    content: [{ type: "paragraph", content: [text(value, bold)] }]
+  };
+}
+function buildRecordFieldSnapshotContent(input) {
+  const fields = normalizeRecordFieldSnapshots(input);
+  if (fields.length === 0) return [];
+  if (fields.length === 1) return [paragraph(fields[0])];
+  return [
+    {
+      type: "table",
+      content: fields.map((field) => ({
+        type: "tableRow",
+        content: [tableCell(field.label, true), tableCell(field.value)]
+      }))
+    },
+    { type: "paragraph" }
+  ];
+}
+function insertRecordFieldSnapshot(editor, fields) {
+  if (!editor || editor.isDestroyed || !editor.isEditable) return false;
+  const content = buildRecordFieldSnapshotContent(fields);
+  if (content.length === 0) return false;
+  return editor.chain().focus().insertContent(content).run();
+}
+export {
+  buildRecordFieldSnapshotContent,
+  insertRecordFieldSnapshot,
+  normalizeRecordFieldSnapshots
+};
+//# sourceMappingURL=recordFieldInsertion.js.map

package/dist/modules/documents/lib/recordFieldInsertion.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/recordFieldInsertion.ts"],
+  "sourcesContent": ["import type { Editor, JSONContent } from '@tiptap/core'\nimport { sanitizeDocumentsDisplayLabel } from './displayLabels'\n\nexport type RecordFieldSnapshot = {\n  field: string\n  label: string\n  value: string\n}\n\nexport function normalizeRecordFieldSnapshots(\n  fields: readonly RecordFieldSnapshot[],\n): RecordFieldSnapshot[] {\n  const normalized = new Map<string, RecordFieldSnapshot>()\n  for (const field of fields) {\n    const key = field.field.trim()\n    const label = sanitizeDocumentsDisplayLabel(field.label)\n    const value = sanitizeDocumentsDisplayLabel(field.value)\n    if (!key || !label || !value || normalized.has(key)) continue\n    normalized.set(key, { field: key, label, value })\n  }\n  return Array.from(normalized.values())\n}\n\nfunction text(value: string, bold = false): JSONContent {\n  return {\n    type: 'text',\n    text: value,\n    ...(bold ? { marks: [{ type: 'bold' }] } : {}),\n  }\n}\n\nfunction paragraph(field: RecordFieldSnapshot): JSONContent {\n  return {\n    type: 'paragraph',\n    content: [text(field.label, true), text(`: ${field.value}`)],\n  }\n}\n\nfunction tableCell(value: string, bold = false): JSONContent {\n  return {\n    type: 'tableCell',\n    content: [{ type: 'paragraph', content: [text(value, bold)] }],\n  }\n}\n\nexport function buildRecordFieldSnapshotContent(\n  input: readonly RecordFieldSnapshot[],\n): JSONContent[] {\n  const fields = normalizeRecordFieldSnapshots(input)\n  if (fields.length === 0) return []\n  if (fields.length === 1) return [paragraph(fields[0]!)]\n  return [\n    {\n      type: 'table',\n      content: fields.map((field) => ({\n        type: 'tableRow',\n        content: [tableCell(field.label, true), tableCell(field.value)],\n      })),\n    },\n    { type: 'paragraph' },\n  ]\n}\n\nexport function insertRecordFieldSnapshot(\n  editor: Editor | null,\n  fields: readonly RecordFieldSnapshot[],\n): boolean {\n  if (!editor || editor.isDestroyed || !editor.isEditable) return false\n  const content = buildRecordFieldSnapshotContent(fields)\n  if (content.length === 0) return false\n  return editor.chain().focus().insertContent(content).run()\n}\n"],
+  "mappings": "AACA,SAAS,qCAAqC;AAQvC,SAAS,8BACd,QACuB;AACvB,QAAM,aAAa,oBAAI,IAAiC;AACxD,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,MAAM,MAAM,KAAK;AAC7B,UAAM,QAAQ,8BAA8B,MAAM,KAAK;AACvD,UAAM,QAAQ,8BAA8B,MAAM,KAAK;AACvD,QAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,WAAW,IAAI,GAAG,EAAG;AACrD,eAAW,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EAClD;AACA,SAAO,MAAM,KAAK,WAAW,OAAO,CAAC;AACvC;AAEA,SAAS,KAAK,OAAe,OAAO,OAAoB;AACtD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,GAAI,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9C;AACF;AAEA,SAAS,UAAU,OAAyC;AAC1D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,CAAC,KAAK,MAAM,OAAO,IAAI,GAAG,KAAK,KAAK,MAAM,KAAK,EAAE,CAAC;AAAA,EAC7D;AACF;AAEA,SAAS,UAAU,OAAe,OAAO,OAAoB;AAC3D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,CAAC,EAAE,MAAM,aAAa,SAAS,CAAC,KAAK,OAAO,IAAI,CAAC,EAAE,CAAC;AAAA,EAC/D;AACF;AAEO,SAAS,gCACd,OACe;AACf,QAAM,SAAS,8BAA8B,KAAK;AAClD,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC,UAAU,OAAO,CAAC,CAAE,CAAC;AACtD,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,SAAS,OAAO,IAAI,CAAC,WAAW;AAAA,QAC9B,MAAM;AAAA,QACN,SAAS,CAAC,UAAU,MAAM,OAAO,IAAI,GAAG,UAAU,MAAM,KAAK,CAAC;AAAA,MAChE,EAAE;AAAA,IACJ;AAAA,IACA,EAAE,MAAM,YAAY;AAAA,EACtB;AACF;AAEO,SAAS,0BACd,QACA,QACS;AACT,MAAI,CAAC,UAAU,OAAO,eAAe,CAAC,OAAO,WAAY,QAAO;AAChE,QAAM,UAAU,gCAAgC,MAAM;AACtD,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,OAAO,MAAM,EAAE,MAAM,EAAE,cAAc,OAAO,EAAE,IAAI;AAC3D;",
+  "names": []
+}

package/dist/modules/documents/lib/requestBody.js

@@ -0,0 +1,80 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  DOCUMENTS_MAX_CONTENT_HTML_BYTES,
+  DOCUMENTS_MAX_CONTENT_TEXT_BYTES
+} from "./resourceLimits.js";
+const KIBIBYTE = 1024;
+const MEBIBYTE = 1024 * KIBIBYTE;
+const JSON_ESCAPE_EXPANSION = 6;
+const STREAM_INITIAL_CAPACITY = 64 * KIBIBYTE;
+const DOCUMENTS_REQUEST_BODY_TOO_LARGE = "documents.errors.requestBodyTooLarge";
+const DOCUMENTS_JSON_BODY_LIMITS = {
+  standard: 128 * KIBIBYTE,
+  template: 4 * MEBIBYTE,
+  templateRender: 4 * MEBIBYTE,
+  content: JSON_ESCAPE_EXPANSION * (DOCUMENTS_MAX_CONTENT_HTML_BYTES + DOCUMENTS_MAX_CONTENT_TEXT_BYTES) + 256 * KIBIBYTE,
+  exportSnapshot: JSON_ESCAPE_EXPANSION * DOCUMENTS_MAX_CONTENT_HTML_BYTES + 64 * KIBIBYTE
+};
+function payloadTooLarge() {
+  return new CrudHttpError(413, { error: DOCUMENTS_REQUEST_BODY_TOO_LARGE });
+}
+function declaredContentLength(request) {
+  const value = request.headers.get("content-length")?.trim();
+  if (!value || !/^\d+$/.test(value)) return null;
+  const declaredBytes = Number(value);
+  return Number.isSafeInteger(declaredBytes) ? declaredBytes : Number.POSITIVE_INFINITY;
+}
+function growBuffer(current, requiredBytes, maxBytes) {
+  let capacity = Math.max(1, current.byteLength);
+  while (capacity < requiredBytes) capacity = Math.min(maxBytes, capacity * 2);
+  const next = new Uint8Array(capacity);
+  next.set(current);
+  return next;
+}
+async function readBoundedJsonBody(request, maxBytes, fallback = null) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new TypeError("maxBytes must be a positive safe integer");
+  }
+  const contentLength = declaredContentLength(request);
+  if (contentLength !== null && contentLength > maxBytes) {
+    await request.body?.cancel().catch(() => void 0);
+    throw payloadTooLarge();
+  }
+  if (!request.body) return fallback;
+  const reader = request.body.getReader();
+  let buffer = new Uint8Array(
+    Math.min(maxBytes, STREAM_INITIAL_CAPACITY)
+  );
+  let byteLength = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      const nextByteLength = byteLength + chunk.value.byteLength;
+      if (nextByteLength > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw payloadTooLarge();
+      }
+      if (nextByteLength > buffer.byteLength) {
+        buffer = growBuffer(buffer, nextByteLength, maxBytes);
+      }
+      buffer.set(chunk.value, byteLength);
+      byteLength = nextByteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  if (byteLength === 0) return fallback;
+  const raw = new TextDecoder().decode(buffer.subarray(0, byteLength));
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+export {
+  DOCUMENTS_JSON_BODY_LIMITS,
+  DOCUMENTS_REQUEST_BODY_TOO_LARGE,
+  readBoundedJsonBody
+};
+//# sourceMappingURL=requestBody.js.map

package/dist/modules/documents/lib/requestBody.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/requestBody.ts"],
+  "sourcesContent": ["import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  DOCUMENTS_MAX_CONTENT_HTML_BYTES,\n  DOCUMENTS_MAX_CONTENT_TEXT_BYTES,\n} from './resourceLimits'\n\nconst KIBIBYTE = 1024\nconst MEBIBYTE = 1024 * KIBIBYTE\nconst JSON_ESCAPE_EXPANSION = 6\nconst STREAM_INITIAL_CAPACITY = 64 * KIBIBYTE\n\nexport const DOCUMENTS_REQUEST_BODY_TOO_LARGE = 'documents.errors.requestBodyTooLarge'\n\n/**\n * Request-level limits are intentionally larger than the decoded field limits.\n * JSON may encode one input byte as a six-byte `\\uXXXX` escape, so content\n * routes retain every payload accepted by their existing schemas while still\n * bounding buffering before JSON.parse runs.\n */\nexport const DOCUMENTS_JSON_BODY_LIMITS = {\n  standard: 128 * KIBIBYTE,\n  template: 4 * MEBIBYTE,\n  templateRender: 4 * MEBIBYTE,\n  content: (\n    JSON_ESCAPE_EXPANSION\n    * (DOCUMENTS_MAX_CONTENT_HTML_BYTES + DOCUMENTS_MAX_CONTENT_TEXT_BYTES)\n  ) + (256 * KIBIBYTE),\n  exportSnapshot: (JSON_ESCAPE_EXPANSION * DOCUMENTS_MAX_CONTENT_HTML_BYTES) + (64 * KIBIBYTE),\n} as const\n\nfunction payloadTooLarge(): CrudHttpError {\n  return new CrudHttpError(413, { error: DOCUMENTS_REQUEST_BODY_TOO_LARGE })\n}\n\nfunction declaredContentLength(request: Request): number | null {\n  const value = request.headers.get('content-length')?.trim()\n  if (!value || !/^\\d+$/.test(value)) return null\n  const declaredBytes = Number(value)\n  return Number.isSafeInteger(declaredBytes) ? declaredBytes : Number.POSITIVE_INFINITY\n}\n\nfunction growBuffer(current: Uint8Array, requiredBytes: number, maxBytes: number): Uint8Array {\n  let capacity = Math.max(1, current.byteLength)\n  while (capacity < requiredBytes) capacity = Math.min(maxBytes, capacity * 2)\n  const next = new Uint8Array(capacity)\n  next.set(current)\n  return next\n}\n\nexport async function readBoundedJsonBody<T>(\n  request: Request,\n  maxBytes: number,\n  fallback: T | null = null,\n): Promise<T | null> {\n  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {\n    throw new TypeError('maxBytes must be a positive safe integer')\n  }\n  const contentLength = declaredContentLength(request)\n  if (contentLength !== null && contentLength > maxBytes) {\n    await request.body?.cancel().catch(() => undefined)\n    throw payloadTooLarge()\n  }\n  if (!request.body) return fallback\n\n  const reader = request.body.getReader()\n  let buffer: Uint8Array<ArrayBufferLike> = new Uint8Array(\n    Math.min(maxBytes, STREAM_INITIAL_CAPACITY),\n  )\n  let byteLength = 0\n\n  try {\n    while (true) {\n      const chunk = await reader.read()\n      if (chunk.done) break\n      const nextByteLength = byteLength + chunk.value.byteLength\n      if (nextByteLength > maxBytes) {\n        await reader.cancel().catch(() => undefined)\n        throw payloadTooLarge()\n      }\n      if (nextByteLength > buffer.byteLength) {\n        buffer = growBuffer(buffer, nextByteLength, maxBytes)\n      }\n      buffer.set(chunk.value, byteLength)\n      byteLength = nextByteLength\n    }\n  } finally {\n    reader.releaseLock()\n  }\n\n  if (byteLength === 0) return fallback\n  const raw = new TextDecoder().decode(buffer.subarray(0, byteLength))\n  try {\n    return JSON.parse(raw) as T\n  } catch {\n    return fallback\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,WAAW;AACjB,MAAM,WAAW,OAAO;AACxB,MAAM,wBAAwB;AAC9B,MAAM,0BAA0B,KAAK;AAE9B,MAAM,mCAAmC;AAQzC,MAAM,6BAA6B;AAAA,EACxC,UAAU,MAAM;AAAA,EAChB,UAAU,IAAI;AAAA,EACd,gBAAgB,IAAI;AAAA,EACpB,SACE,yBACG,mCAAmC,oCACnC,MAAM;AAAA,EACX,gBAAiB,wBAAwB,mCAAqC,KAAK;AACrF;AAEA,SAAS,kBAAiC;AACxC,SAAO,IAAI,cAAc,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAC3E;AAEA,SAAS,sBAAsB,SAAiC;AAC9D,QAAM,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAC1D,MAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,KAAK,EAAG,QAAO;AAC3C,QAAM,gBAAgB,OAAO,KAAK;AAClC,SAAO,OAAO,cAAc,aAAa,IAAI,gBAAgB,OAAO;AACtE;AAEA,SAAS,WAAW,SAAqB,eAAuB,UAA8B;AAC5F,MAAI,WAAW,KAAK,IAAI,GAAG,QAAQ,UAAU;AAC7C,SAAO,WAAW,cAAe,YAAW,KAAK,IAAI,UAAU,WAAW,CAAC;AAC3E,QAAM,OAAO,IAAI,WAAW,QAAQ;AACpC,OAAK,IAAI,OAAO;AAChB,SAAO;AACT;AAEA,eAAsB,oBACpB,SACA,UACA,WAAqB,MACF;AACnB,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,YAAY,GAAG;AACpD,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACA,QAAM,gBAAgB,sBAAsB,OAAO;AACnD,MAAI,kBAAkB,QAAQ,gBAAgB,UAAU;AACtD,UAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,UAAM,gBAAgB;AAAA,EACxB;AACA,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,MAAI,SAAsC,IAAI;AAAA,IAC5C,KAAK,IAAI,UAAU,uBAAuB;AAAA,EAC5C;AACA,MAAI,aAAa;AAEjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,UAAI,MAAM,KAAM;AAChB,YAAM,iBAAiB,aAAa,MAAM,MAAM;AAChD,UAAI,iBAAiB,UAAU;AAC7B,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,gBAAgB;AAAA,MACxB;AACA,UAAI,iBAAiB,OAAO,YAAY;AACtC,iBAAS,WAAW,QAAQ,gBAAgB,QAAQ;AAAA,MACtD;AACA,aAAO,IAAI,MAAM,OAAO,UAAU;AAClC,mBAAa;AAAA,IACf;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,MAAI,eAAe,EAAG,QAAO;AAC7B,QAAM,MAAM,IAAI,YAAY,EAAE,OAAO,OAAO,SAAS,GAAG,UAAU,CAAC;AACnE,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/modules/documents/lib/resourceLimits.js

@@ -0,0 +1,62 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+const MEBIBYTE = 1024 * 1024;
+const DOCUMENTS_MAX_CONTENT_HTML_BYTES = 2 * MEBIBYTE;
+const DOCUMENTS_MAX_CONTENT_TEXT_BYTES = 2 * MEBIBYTE;
+const DOCUMENTS_MAX_YJS_STATE_BYTES = 8 * MEBIBYTE;
+const DOCUMENTS_MAX_ENTITY_LINKS_PER_DOCUMENT = 100;
+const DOCUMENTS_COLLAB_MAX_PAYLOAD_BYTES = DOCUMENTS_MAX_YJS_STATE_BYTES + 64 * 1024;
+function utf8ByteLength(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function isUtf8WithinLimit(value, maxBytes) {
+  return utf8ByteLength(value) <= maxBytes;
+}
+function maxBase64EncodedLength(maxDecodedBytes) {
+  return Math.ceil(maxDecodedBytes / 3) * 4;
+}
+function decodeBoundedCanonicalBase64(value, maxDecodedBytes, options = {}) {
+  const fail = () => {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? "documents.content.tooLarge"
+    });
+  };
+  if (value.length > maxBase64EncodedLength(maxDecodedBytes) || value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    return fail();
+  }
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.byteLength > maxDecodedBytes || bytes.toString("base64") !== value) return fail();
+  return bytes;
+}
+function assertDocumentYjsStateByteLength(byteLength, options = {}) {
+  if (byteLength <= DOCUMENTS_MAX_YJS_STATE_BYTES) return;
+  throw new CrudHttpError(options.status ?? 413, {
+    error: options.error ?? "documents.content.tooLarge"
+  });
+}
+function assertDocumentContentResourceLimits(input, options = {}) {
+  if (input.yjsState) assertDocumentYjsStateByteLength(input.yjsState.byteLength, options);
+  if (typeof input.contentHtml === "string" && !isUtf8WithinLimit(input.contentHtml, DOCUMENTS_MAX_CONTENT_HTML_BYTES)) {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? "documents.content.tooLarge"
+    });
+  }
+  if (typeof input.contentText === "string" && !isUtf8WithinLimit(input.contentText, DOCUMENTS_MAX_CONTENT_TEXT_BYTES)) {
+    throw new CrudHttpError(options.status ?? 413, {
+      error: options.error ?? "documents.content.tooLarge"
+    });
+  }
+}
+export {
+  DOCUMENTS_COLLAB_MAX_PAYLOAD_BYTES,
+  DOCUMENTS_MAX_CONTENT_HTML_BYTES,
+  DOCUMENTS_MAX_CONTENT_TEXT_BYTES,
+  DOCUMENTS_MAX_ENTITY_LINKS_PER_DOCUMENT,
+  DOCUMENTS_MAX_YJS_STATE_BYTES,
+  assertDocumentContentResourceLimits,
+  assertDocumentYjsStateByteLength,
+  decodeBoundedCanonicalBase64,
+  isUtf8WithinLimit,
+  maxBase64EncodedLength,
+  utf8ByteLength
+};
+//# sourceMappingURL=resourceLimits.js.map

package/dist/modules/documents/lib/resourceLimits.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/resourceLimits.ts"],
+  "sourcesContent": ["import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nconst MEBIBYTE = 1024 * 1024\n\n/** Authoritative UTF-8 bounds for every stored representation of a document body. */\nexport const DOCUMENTS_MAX_CONTENT_HTML_BYTES = 2 * MEBIBYTE\nexport const DOCUMENTS_MAX_CONTENT_TEXT_BYTES = 2 * MEBIBYTE\nexport const DOCUMENTS_MAX_YJS_STATE_BYTES = 8 * MEBIBYTE\n\n/** Bound cross-module verification and reverse-widget work per document. */\nexport const DOCUMENTS_MAX_ENTITY_LINKS_PER_DOCUMENT = 100\n\n/** WebSocket messages include a small Hocuspocus/Yjs protocol envelope. */\nexport const DOCUMENTS_COLLAB_MAX_PAYLOAD_BYTES = DOCUMENTS_MAX_YJS_STATE_BYTES + 64 * 1024\n\nexport function utf8ByteLength(value: string): number {\n  return Buffer.byteLength(value, 'utf8')\n}\n\nexport function isUtf8WithinLimit(value: string, maxBytes: number): boolean {\n  return utf8ByteLength(value) <= maxBytes\n}\n\nexport function maxBase64EncodedLength(maxDecodedBytes: number): number {\n  return Math.ceil(maxDecodedBytes / 3) * 4\n}\n\n/** Validate encoded size before Buffer allocates the decoded payload. */\nexport function decodeBoundedCanonicalBase64(\n  value: string,\n  maxDecodedBytes: number,\n  options: { status?: number; error?: string } = {},\n): Buffer {\n  const fail = () => {\n    throw new CrudHttpError(options.status ?? 413, {\n      error: options.error ?? 'documents.content.tooLarge',\n    })\n  }\n  if (\n    value.length > maxBase64EncodedLength(maxDecodedBytes)\n    || value.length % 4 !== 0\n    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)\n  ) {\n    return fail()\n  }\n  const bytes = Buffer.from(value, 'base64')\n  if (bytes.byteLength > maxDecodedBytes || bytes.toString('base64') !== value) return fail()\n  return bytes\n}\n\nexport type DocumentContentResourceInput = {\n  yjsState?: Buffer | Uint8Array | null\n  contentHtml?: string | null\n  contentText?: string | null\n}\n\nexport function assertDocumentYjsStateByteLength(\n  byteLength: number,\n  options: { status?: number; error?: string } = {},\n): void {\n  if (byteLength <= DOCUMENTS_MAX_YJS_STATE_BYTES) return\n  throw new CrudHttpError(options.status ?? 413, {\n    error: options.error ?? 'documents.content.tooLarge',\n  })\n}\n\n/**\n * Enforce the same bound at API, command, collaboration, and version\n * boundaries. Keeping this check beside persistence prevents an internal or\n * legacy call site from bypassing request validation and creating a snapshot\n * that later exhausts the editor or export worker.\n */\nexport function assertDocumentContentResourceLimits(\n  input: DocumentContentResourceInput,\n  options: { status?: number; error?: string } = {},\n): void {\n  if (input.yjsState) assertDocumentYjsStateByteLength(input.yjsState.byteLength, options)\n  if (\n    typeof input.contentHtml === 'string'\n    && !isUtf8WithinLimit(input.contentHtml, DOCUMENTS_MAX_CONTENT_HTML_BYTES)\n  ) {\n    throw new CrudHttpError(options.status ?? 413, {\n      error: options.error ?? 'documents.content.tooLarge',\n    })\n  }\n  if (\n    typeof input.contentText === 'string'\n    && !isUtf8WithinLimit(input.contentText, DOCUMENTS_MAX_CONTENT_TEXT_BYTES)\n  ) {\n    throw new CrudHttpError(options.status ?? 413, {\n      error: options.error ?? 'documents.content.tooLarge',\n    })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB;AAE9B,MAAM,WAAW,OAAO;AAGjB,MAAM,mCAAmC,IAAI;AAC7C,MAAM,mCAAmC,IAAI;AAC7C,MAAM,gCAAgC,IAAI;AAG1C,MAAM,0CAA0C;AAGhD,MAAM,qCAAqC,gCAAgC,KAAK;AAEhF,SAAS,eAAe,OAAuB;AACpD,SAAO,OAAO,WAAW,OAAO,MAAM;AACxC;AAEO,SAAS,kBAAkB,OAAe,UAA2B;AAC1E,SAAO,eAAe,KAAK,KAAK;AAClC;AAEO,SAAS,uBAAuB,iBAAiC;AACtE,SAAO,KAAK,KAAK,kBAAkB,CAAC,IAAI;AAC1C;AAGO,SAAS,6BACd,OACA,iBACA,UAA+C,CAAC,GACxC;AACR,QAAM,OAAO,MAAM;AACjB,UAAM,IAAI,cAAc,QAAQ,UAAU,KAAK;AAAA,MAC7C,OAAO,QAAQ,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AACA,MACE,MAAM,SAAS,uBAAuB,eAAe,KAClD,MAAM,SAAS,MAAM,KACrB,CAAC,mEAAmE,KAAK,KAAK,GACjF;AACA,WAAO,KAAK;AAAA,EACd;AACA,QAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ;AACzC,MAAI,MAAM,aAAa,mBAAmB,MAAM,SAAS,QAAQ,MAAM,MAAO,QAAO,KAAK;AAC1F,SAAO;AACT;AAQO,SAAS,iCACd,YACA,UAA+C,CAAC,GAC1C;AACN,MAAI,cAAc,8BAA+B;AACjD,QAAM,IAAI,cAAc,QAAQ,UAAU,KAAK;AAAA,IAC7C,OAAO,QAAQ,SAAS;AAAA,EAC1B,CAAC;AACH;AAQO,SAAS,oCACd,OACA,UAA+C,CAAC,GAC1C;AACN,MAAI,MAAM,SAAU,kCAAiC,MAAM,SAAS,YAAY,OAAO;AACvF,MACE,OAAO,MAAM,gBAAgB,YAC1B,CAAC,kBAAkB,MAAM,aAAa,gCAAgC,GACzE;AACA,UAAM,IAAI,cAAc,QAAQ,UAAU,KAAK;AAAA,MAC7C,OAAO,QAAQ,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AACA,MACE,OAAO,MAAM,gBAAgB,YAC1B,CAAC,kBAAkB,MAAM,aAAa,gCAAgC,GACzE;AACA,UAAM,IAAI,cAAc,QAAQ,UAAU,KAAK;AAAA,MAC7C,OAAO,QAAQ,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/modules/documents/lib/shareCounts.js

@@ -0,0 +1,25 @@
+import { raw } from "@mikro-orm/core";
+import { DocumentShare } from "../data/entities.js";
+async function loadDocumentShareCounts(em, scope, documentIds) {
+  const shareCounts = /* @__PURE__ */ new Map();
+  if (documentIds.length === 0) return shareCounts;
+  const groupedShares = await em.createQueryBuilder(DocumentShare, "document_share").select([
+    "document_share.documentId",
+    raw('count(*) as "shareCount"')
+  ]).where({
+    documentId: { $in: [...documentIds] },
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    deletedAt: null
+  }).groupBy("document_share.documentId").execute("all", false);
+  for (const row of groupedShares) {
+    const documentId = row.documentId ?? row.document_id;
+    const count = Number(row.shareCount ?? row.share_count ?? 0);
+    if (typeof documentId === "string" && Number.isFinite(count)) shareCounts.set(documentId, count);
+  }
+  return shareCounts;
+}
+export {
+  loadDocumentShareCounts
+};
+//# sourceMappingURL=shareCounts.js.map

package/dist/modules/documents/lib/shareCounts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/lib/shareCounts.ts"],
+  "sourcesContent": ["import { raw } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { DocumentShare } from '../data/entities'\n\nexport type DocumentShareCountScope = {\n  tenantId: string\n  organizationId: string\n}\n\ntype GroupedShareCountRow = {\n  documentId?: unknown\n  document_id?: unknown\n  shareCount?: unknown\n  share_count?: unknown\n}\n\nexport async function loadDocumentShareCounts(\n  em: EntityManager,\n  scope: DocumentShareCountScope,\n  documentIds: readonly string[],\n): Promise<Map<string, number>> {\n  const shareCounts = new Map<string, number>()\n  if (documentIds.length === 0) return shareCounts\n  const groupedShares = await em\n    .createQueryBuilder(DocumentShare, 'document_share')\n    .select([\n      'document_share.documentId',\n      raw('count(*) as \"shareCount\"'),\n    ])\n    .where({\n      documentId: { $in: [...documentIds] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    })\n    .groupBy('document_share.documentId')\n    .execute<GroupedShareCountRow[]>('all', false)\n  for (const row of groupedShares) {\n    const documentId = row.documentId ?? row.document_id\n    const count = Number(row.shareCount ?? row.share_count ?? 0)\n    if (typeof documentId === 'string' && Number.isFinite(count)) shareCounts.set(documentId, count)\n  }\n  return shareCounts\n}\n"],
+  "mappings": "AAAA,SAAS,WAAW;AAEpB,SAAS,qBAAqB;AAc9B,eAAsB,wBACpB,IACA,OACA,aAC8B;AAC9B,QAAM,cAAc,oBAAI,IAAoB;AAC5C,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,gBAAgB,MAAM,GACzB,mBAAmB,eAAe,gBAAgB,EAClD,OAAO;AAAA,IACN;AAAA,IACA,IAAI,0BAA0B;AAAA,EAChC,CAAC,EACA,MAAM;AAAA,IACL,YAAY,EAAE,KAAK,CAAC,GAAG,WAAW,EAAE;AAAA,IACpC,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC,EACA,QAAQ,2BAA2B,EACnC,QAAgC,OAAO,KAAK;AAC/C,aAAW,OAAO,eAAe;AAC/B,UAAM,aAAa,IAAI,cAAc,IAAI;AACzC,UAAM,QAAQ,OAAO,IAAI,cAAc,IAAI,eAAe,CAAC;AAC3D,QAAI,OAAO,eAAe,YAAY,OAAO,SAAS,KAAK,EAAG,aAAY,IAAI,YAAY,KAAK;AAAA,EACjG;AACA,SAAO;AACT;",
+  "names": []
+}