collabmd 0.1.54 → 0.1.55

package/src/server/domain/hosted-workspace.js

@@ -102,6 +102,24 @@ function publicAuditEvent(record = null) {
   };
 }
 
+function parseAuditCursor(cursor) {
+  if (!cursor) return null;
+  try {
+    if (typeof cursor !== 'string' || cursor.length > 256 || !/^[A-Za-z0-9_-]+$/u.test(cursor)) {
+      throw new Error('Invalid cursor');
+    }
+    const value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+    if (!Array.isArray(value) || value.length !== 2
+      || !Number.isSafeInteger(value[0]) || value[0] < 0
+      || typeof value[1] !== 'string' || !value[1] || value[1].length > 128) {
+      throw new Error('Invalid cursor');
+    }
+    return { createdAt: value[0], id: value[1] };
+  } catch {
+    throw createHostedError(400, 'Invalid access history cursor.', 'HOSTED_AUDIT_CURSOR_INVALID');
+  }
+}
+
 function publicVaultSource(record = null) {
   if (!record) {
     return null;
@@ -734,8 +752,17 @@ export class HostedWorkspaceService {
     }));
   }
 
-  async listAuditEvents(user) {
+  async listAuditEvents(user, { cursor = '', limit = 50 } = {}) {
     await this.requireAdmin(user);
-    return (await this.store.listAuditEvents()).map(publicAuditEvent);
+    const pageSize = Math.min(100, Math.max(1, Number.parseInt(limit, 10) || 50));
+    const rows = await this.store.listAuditEvents({ before: parseAuditCursor(cursor), limit: pageSize + 1 });
+    const events = rows.slice(0, pageSize).map(publicAuditEvent);
+    const last = events.at(-1);
+    return {
+      events,
+      nextCursor: rows.length > pageSize
+        ? Buffer.from(JSON.stringify([last.createdAt, last.id])).toString('base64url')
+        : null,
+    };
   }
 }

package/src/server/domain/plantuml-encoder.js

@@ -1,49 +1,13 @@
 import { deflateRawSync } from 'node:zlib';
 
-function encode6bit(value) {
-  if (value < 10) {
-    return String.fromCharCode(48 + value);
-  }
-
-  if (value < 36) {
-    return String.fromCharCode(55 + value);
-  }
-
-  if (value < 62) {
-    return String.fromCharCode(61 + value);
-  }
-
-  if (value === 62) {
-    return '-';
-  }
-
-  if (value === 63) {
-    return '_';
-  }
-
-  return '?';
-}
-
-function append3bytes(byte1, byte2, byte3) {
-  const c1 = byte1 >> 2;
-  const c2 = ((byte1 & 0x03) << 4) | (byte2 >> 4);
-  const c3 = ((byte2 & 0x0f) << 2) | (byte3 >> 6);
-  const c4 = byte3 & 0x3f;
-
-  return `${encode6bit(c1 & 0x3f)}${encode6bit(c2 & 0x3f)}${encode6bit(c3 & 0x3f)}${encode6bit(c4 & 0x3f)}`;
-}
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const PLANTUML_ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_';
 
 export function encodePlantUmlText(source = '') {
   const compressed = deflateRawSync(Buffer.from(String(source), 'utf-8'));
-  let encoded = '';
-
-  for (let index = 0; index < compressed.length; index += 3) {
-    encoded += append3bytes(
-      compressed[index] ?? 0,
-      compressed[index + 1] ?? 0,
-      compressed[index + 2] ?? 0,
-    );
-  }
-
-  return encoded;
+  const padded = Buffer.alloc(Math.ceil(compressed.length / 3) * 3);
+  compressed.copy(padded);
+  return padded.toString('base64url').replace(/./gu, (character) => (
+    PLANTUML_ALPHABET[BASE64URL_ALPHABET.indexOf(character)]
+  ));
 }

package/src/server/infrastructure/git/diff-service.js

@@ -107,7 +107,6 @@ export class GitDiffService {
   }
 
   getScopedFiles(status, scope = 'working-tree', path = null) {
-    const orderedFiles = [];
     const fileMap = new Map();
     const sectionMap = createSectionMap(status.sections);
     const candidateSections = scope === 'staged'
@@ -126,13 +125,10 @@ export class GitDiffService {
         const existing = fileMap.get(file.path) ?? null;
         const merged = mergeScopedFile(existing, file, scope);
         fileMap.set(file.path, merged);
-        if (!existing) {
-          orderedFiles.push(merged);
-        }
       }
     }
 
-    return orderedFiles;
+    return Array.from(fileMap.values());
   }
 
   async getScopeSummary({

package/src/server/infrastructure/git/history-service.js

@@ -1,7 +1,7 @@
 import { createRequestError as createGitRequestError } from '../http/http-errors.js';
 import { getVaultFileKind, isImageAttachmentFilePath } from '../../../domain/file-kind.js';
 import { normalizeRelativeGitPath } from './path-utils.js';
-import { getImageMimeType } from './image-mime.js';
+import { getImageMimeType } from '../../shared/image-mime.js';
 import {
   countPatchLines,
   parseGitLogHeader,
@@ -16,6 +16,8 @@ import {
 const EMPTY_TREE_HASH = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 const DEFAULT_HISTORY_LIMIT = 30;
 const HISTORY_LIMIT_CAP = 50;
+const RESPONSE_CACHE_LIMIT = 50;
+const MAX_CACHED_RESPONSE_BYTES = 256 * 1024;
 
 function clampHistoryLimit(limit) {
   const parsedLimit = Number.parseInt(String(limit ?? DEFAULT_HISTORY_LIMIT), 10);
@@ -77,8 +79,22 @@ function getCachedValue(cache, key) {
 }
 
 function setCachedValue(cache, key, value, ttlMs) {
+  const now = Date.now();
+  for (const [cachedKey, cached] of cache) {
+    if (now >= cached.expiresAt) cache.delete(cachedKey);
+  }
+  cache.delete(key);
+  const payloadBytes = Buffer.isBuffer(value.content)
+    ? value.content.byteLength
+    : Buffer.byteLength(JSON.stringify(value));
+  if (ttlMs <= 0 || payloadBytes + Buffer.byteLength(key) > MAX_CACHED_RESPONSE_BYTES) {
+    return value;
+  }
+  while (cache.size >= RESPONSE_CACHE_LIMIT) {
+    cache.delete(cache.keys().next().value);
+  }
   cache.set(key, {
-    expiresAt: Date.now() + ttlMs,
+    expiresAt: now + ttlMs,
     value,
   });
   return value;

package/src/server/infrastructure/git/untracked-files.js

@@ -7,7 +7,7 @@ import { getVaultFileKind, isImageAttachmentFilePath } from '../../../domain/fil
 import { mapWithConcurrency } from '../../shared/async-utils.js';
 import { createEmptyStats } from './responses.js';
 import { splitContentLines } from './parsers.js';
-import { getImageMimeType } from './image-mime.js';
+import { getImageMimeType } from '../../shared/image-mime.js';
 
 async function countFileLines(filePath) {
   if (isImageAttachmentFilePath(filePath)) {

package/src/server/infrastructure/http/create-git-api-command-handler.js

@@ -41,160 +41,71 @@ export function createGitApiCommandHandler({
   gitService,
   workspaceMutationCoordinator = null,
 }) {
-  return async function handleGitApiCommand(req, res, requestUrl) {
-    if (requestUrl.pathname === '/api/git/stage' && req.method === 'POST') {
-      try {
-        const body = await parseRequiredBody(req, res, 'path');
-        if (!body) {
-          return true;
-        }
-
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'stage',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.stageFile(body.path),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to stage git file:', 'Failed to stage git file');
-      }
-      return true;
-    }
-
-    if (requestUrl.pathname === '/api/git/unstage' && req.method === 'POST') {
-      try {
-        const body = await parseRequiredBody(req, res, 'path');
-        if (!body) {
-          return true;
-        }
-
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'unstage',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.unstageFile(body.path),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to unstage git file:', 'Failed to unstage git file');
-      }
-      return true;
-    }
-
-    if (requestUrl.pathname === '/api/git/stage-all' && req.method === 'POST') {
-      try {
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'stage-all',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.stageAll(),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to stage all git changes:', 'Failed to stage all git changes');
-      }
-      return true;
-    }
-
-    if (requestUrl.pathname === '/api/git/unstage-all' && req.method === 'POST') {
-      try {
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'unstage-all',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.unstageAll(),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to unstage all git changes:', 'Failed to unstage all git changes');
-      }
-      return true;
-    }
-
-    if (requestUrl.pathname === '/api/git/commit' && req.method === 'POST') {
-      try {
-        const body = await parseRequiredBody(req, res, 'message');
-        if (!body) {
-          return true;
-        }
-
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'commit',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.commitStaged({
-              author: authService?.getAuthenticatedUser?.(req) ?? null,
-              message: body.message,
-            }),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to commit staged changes:', 'Failed to commit staged changes');
-      }
-      return true;
-    }
+  const routes = [
+    {
+      action: 'stage', bodyField: 'path', errorMessage: 'Failed to stage git file',
+      run: (body) => gitService.stageFile(body.path),
+    },
+    {
+      action: 'unstage', bodyField: 'path', errorMessage: 'Failed to unstage git file',
+      run: (body) => gitService.unstageFile(body.path),
+    },
+    {
+      action: 'stage-all', errorMessage: 'Failed to stage all git changes',
+      run: () => gitService.stageAll(),
+    },
+    {
+      action: 'unstage-all', errorMessage: 'Failed to unstage all git changes',
+      run: () => gitService.unstageAll(),
+    },
+    {
+      action: 'commit', bodyField: 'message', errorMessage: 'Failed to commit staged changes',
+      run: (body, req) => gitService.commitStaged({
+        author: authService?.getAuthenticatedUser?.(req) ?? null,
+        message: body.message,
+      }),
+    },
+    {
+      action: 'push', errorMessage: 'Failed to push git branch',
+      run: () => gitService.pushBranch(),
+    },
+    {
+      action: 'pull', errorMessage: 'Failed to pull git branch',
+      run: (_body, req) => gitService.pullBranch({
+        author: authService?.getAuthenticatedUser?.(req) ?? null,
+      }),
+    },
+    {
+      action: 'reset-file', bodyField: 'path', errorMessage: 'Failed to reset git file',
+      run: (body) => gitService.resetFileToHead(body.path),
+    },
+  ];
 
-    if (requestUrl.pathname === '/api/git/push' && req.method === 'POST') {
-      try {
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'push',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.pushBranch(),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to push git branch:', 'Failed to push git branch');
-      }
-      return true;
+  return async function handleGitApiCommand(req, res, requestUrl) {
+    const route = req.method === 'POST'
+      ? routes.find(({ action }) => requestUrl.pathname === `/api/git/${action}`)
+      : null;
+    if (!route) {
+      return false;
     }
 
-    if (requestUrl.pathname === '/api/git/pull' && req.method === 'POST') {
-      try {
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'pull',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.pullBranch({
-              author: authService?.getAuthenticatedUser?.(req) ?? null,
-            }),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to pull git branch:', 'Failed to pull git branch');
+    try {
+      const body = route.bodyField ? await parseRequiredBody(req, res, route.bodyField) : {};
+      if (!body) {
+        return true;
       }
-      return true;
-    }
 
-    if (requestUrl.pathname === '/api/git/reset-file' && req.method === 'POST') {
-      try {
-        const body = await parseRequiredBody(req, res, 'path');
-        if (!body) {
-          return true;
-        }
-
-        jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
-          action: 'reset-file',
-          req,
-          responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
-            () => gitService.resetFileToHead(body.path),
-          ),
-          workspaceMutationCoordinator,
-        }));
-      } catch (error) {
-        handleApiError(req, res, error, '[api] Failed to reset git file:', 'Failed to reset git file');
-      }
-      return true;
+      jsonResponse(req, res, 200, await applyWorkspaceMutationEffects({
+        action: route.action,
+        req,
+        responsePayload: await workspaceMutationCoordinator.runManagedWorkspaceMutation(
+          () => route.run(body, req),
+        ),
+        workspaceMutationCoordinator,
+      }));
+    } catch (error) {
+      handleApiError(req, res, error, `[api] ${route.errorMessage}:`, route.errorMessage);
     }
-
-    return false;
+    return true;
   };
 }

package/src/server/infrastructure/http/create-hosted-api-handler.js

@@ -107,8 +107,11 @@ export function createHostedApiHandler({
         membership: await hostedWorkspaceService.acceptInvitation(user),
       });
     }],
-    ['GET /api/hosted/audit', async ({ req, res, user }) => {
-      jsonResponse(req, res, 200, { events: await hostedWorkspaceService.listAuditEvents(user) });
+    ['GET /api/hosted/audit', async ({ req, requestUrl, res, user }) => {
+      jsonResponse(req, res, 200, await hostedWorkspaceService.listAuditEvents(user, {
+        cursor: requestUrl.searchParams.get('cursor') || '',
+        limit: requestUrl.searchParams.get('limit') || 50,
+      }));
     }],
   ]);
 

package/src/server/infrastructure/http/create-vault-api-query-handler.js

@@ -225,9 +225,9 @@ async function handleBaseExport(req, res, _requestUrl, { baseQueryService }) {
   }
 }
 
-async function handleFileTree(req, res, _requestUrl, { vaultFileStore, workspaceMutationCoordinator }) {
+async function handleFileTree(req, res, _requestUrl, { workspaceMutationCoordinator }) {
   try {
-    const tree = workspaceMutationCoordinator?.getWorkspaceTree?.() ?? await vaultFileStore.tree();
+    const tree = workspaceMutationCoordinator.getWorkspaceTree();
     jsonResponse(req, res, 200, { tree });
   } catch (error) {
     console.error('[api] Failed to read file tree:', error.message);

package/src/server/infrastructure/http/http-response.js

@@ -3,6 +3,7 @@ import {
   constants as zlibConstants,
   gzip,
 } from 'node:zlib';
+import { pipeline } from 'node:stream/promises';
 
 const COMPRESSIBLE_CONTENT_TYPE_PATTERN = /^(?:text\/|application\/(?:javascript|json|xml)|image\/svg\+xml)/i;
 const MIN_COMPRESSIBLE_BYTES = 1024;
@@ -212,42 +213,7 @@ export function sendStreamResponse(req, res, {
     return Promise.resolve();
   }
 
-  return new Promise((resolve, reject) => {
-    let settled = false;
-
-    const finish = (error = null) => {
-      if (settled) {
-        return;
-      }
-
-      settled = true;
-      res.off('finish', handleFinish);
-      res.off('error', handleError);
-      res.off('close', handleClose);
-      stream.off('error', handleError);
-
-      if (error) {
-        reject(error);
-        return;
-      }
-
-      resolve();
-    };
-
-    const handleFinish = () => finish();
-    const handleError = (error) => finish(error);
-    const handleClose = () => {
-      if (!res.writableEnded) {
-        finish(new Error('Response stream closed before completion'));
-      }
-    };
-
-    res.on('finish', handleFinish);
-    res.on('error', handleError);
-    res.on('close', handleClose);
-    stream.on('error', handleError);
-    stream.pipe(res);
-  });
+  return pipeline(stream, res);
 }
 
 export function jsonResponse(req, res, statusCode, data) {

package/src/server/infrastructure/http/request-body.js

@@ -3,56 +3,21 @@ import { createRequestError } from './http-errors.js';
 export const REQUEST_BODY_LIMIT_BYTES = 8_388_608;
 
 async function readRequestBuffer(req, maxBytes = REQUEST_BODY_LIMIT_BYTES) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    let done = false;
-    let limitError = null;
-
-    const finish = (callback, value) => {
-      if (done) {
-        return;
-      }
-
-      done = true;
-      req.off('data', onData);
-      req.off('end', onEnd);
-      req.off('error', onError);
-      callback(value);
-    };
-
-    const onData = (chunk) => {
-      if (limitError) {
-        return;
-      }
-
-      size += chunk.length;
-      if (size > maxBytes) {
-        chunks.length = 0;
-        limitError = createRequestError(413, 'Request body too large');
-        return;
-      }
-
+  const chunks = [];
+  let size = 0;
+  let tooLarge = false;
+  for await (const chunk of req) {
+    if (tooLarge) continue;
+    size += chunk.length;
+    if (size > maxBytes) {
+      chunks.length = 0;
+      tooLarge = true;
+    } else {
       chunks.push(chunk);
-    };
-
-    const onEnd = () => {
-      if (limitError) {
-        finish(reject, limitError);
-        return;
-      }
-
-      finish(resolve, Buffer.concat(chunks));
-    };
-
-    const onError = (error) => {
-      finish(reject, error);
-    };
-
-    req.on('data', onData);
-    req.on('end', onEnd);
-    req.on('error', onError);
-  });
+    }
+  }
+  if (tooLarge) throw createRequestError(413, 'Request body too large');
+  return Buffer.concat(chunks);
 }
 
 export async function readRequestBody(req, maxBytes = REQUEST_BODY_LIMIT_BYTES) {

package/src/server/infrastructure/persistence/hosted-metadata-store.js

@@ -174,6 +174,8 @@ export class HostedMetadataStore {
         metadata_json TEXT NOT NULL,
         created_at INTEGER NOT NULL
       );
+      CREATE INDEX IF NOT EXISTS audit_events_created_id_idx
+        ON audit_events(created_at DESC, id DESC);
 
       CREATE TABLE IF NOT EXISTS operational_security_events (
         id TEXT PRIMARY KEY,
@@ -514,11 +516,18 @@ export class HostedMetadataStore {
     );
   }
 
-  async listAuditEvents() {
+  async listAuditEvents({ before = null, limit = 51 } = {}) {
+    if (before) {
+      return this.prepare(
+        'listAuditEventsBefore',
+        `SELECT * FROM audit_events WHERE (created_at, id) < (?, ?)
+         ORDER BY created_at DESC, id DESC LIMIT ?`,
+      ).all(before.createdAt, before.id, limit).map(rowToAuditEvent);
+    }
     return this.prepare(
       'listAuditEvents',
-      'SELECT * FROM audit_events ORDER BY created_at DESC',
-    ).all().map(rowToAuditEvent);
+      'SELECT * FROM audit_events ORDER BY created_at DESC, id DESC LIMIT ?',
+    ).all(limit).map(rowToAuditEvent);
   }
 
   async createOperationalSecurityEvent(event) {

package/src/server/infrastructure/persistence/path-utils.js

@@ -1,10 +1,10 @@
 import { lstatSync } from 'node:fs';
 import { isAbsolute, join, normalize, relative, resolve } from 'path';
 
-import { isVaultFilePath } from '../../../domain/file-kind.js';
+import { getVaultFileKind, isVaultFilePath } from '../../../domain/file-kind.js';
 
 export const IGNORED_DIRECTORIES = new Set(['.git', '.obsidian', '.trash', 'node_modules', '.DS_Store']);
-export const VAULT_FILE_PATH_REQUIREMENT = '.md, .markdown, .mdx, .html, .htm, .base, .excalidraw, .drawio, .mmd, .mermaid, .puml, .plantuml, .dsl, .pdf, .png, .jpg, .jpeg, .webp, .gif, or .svg';
+export const VAULT_FILE_PATH_REQUIREMENT = '.md, .markdown, .mdx, .html, .htm, .base, .canvas, .excalidraw, .drawio, .mmd, .mermaid, .puml, .plantuml, .dsl, .pdf, .png, .jpg, .jpeg, .webp, .gif, or .svg';
 export const INVALID_VAULT_FILE_PATH_ERROR = `Invalid file path — must end in ${VAULT_FILE_PATH_REQUIREMENT}`;
 export const INVALID_DIRECTORY_PATH_ERROR = 'Invalid directory path';
 
@@ -119,6 +119,12 @@ export function resolveVaultRenamePaths(vaultDir, oldPath, newPath) {
     };
   }
 
+  const oldKind = getVaultFileKind(absoluteOld);
+  const newKind = getVaultFileKind(absoluteNew);
+  if (oldKind !== newKind && [oldKind, newKind].includes('canvas')) {
+    return { absoluteNew: null, absoluteOld: null, error: 'Canvas files must keep the .canvas extension' };
+  }
+
   return { absoluteNew, absoluteOld, error: null };
 }