texlite 0.2.0

package/dist/server/config.js

@@ -0,0 +1,336 @@
+import fs from "node:fs";
+import path from "node:path";
+import { defaultDataDirectory, packageClientDirectory, resolveConfigPath } from "./runtimePaths.js";
+export const LATEX_ENGINES = ["pdflatex", "xelatex", "lualatex"];
+/** Effective values used when the corresponding file/env setting is omitted. */
+export const CONFIG_DEFAULTS = {
+    siteName: "TexLite",
+    adminEmail: "",
+    host: "127.0.0.1",
+    port: 3000,
+    dataDir: defaultDataDirectory(),
+    clientDir: packageClientDirectory(),
+    sessionDays: 14,
+    compileTimeoutSeconds: 600,
+    maxCompileJobs: 10,
+    latexmk: "latexmk",
+    defaultEngine: "xelatex",
+    allowedEngines: [...LATEX_ENGINES],
+    extraArgs: [],
+    allowProjectLatexmkrc: true,
+    maxFileSizeMB: 50,
+    historyMaxVersions: 200,
+    historyMaxStorageMB: 512,
+    git: "git",
+    gitOperationTimeoutSeconds: 120,
+    githubApiBaseUrl: "https://api.github.com"
+};
+const CONFIG_LIMITS = {
+    port: [1, 65_535],
+    sessionDays: [1, 3_650],
+    compileTimeoutSeconds: [1, 3_600],
+    maxCompileJobs: [1, 32],
+    maxFileSizeMB: [1, 2_048],
+    historyMaxVersions: [10, 5_000],
+    historyMaxStorageMB: [16, 102_400],
+    gitOperationTimeoutSeconds: [1, 3_600]
+};
+export function loadConfig(configPathOverride) {
+    const configPath = resolveConfigPath(configPathOverride);
+    const fileConfig = readConfigFile(configPath);
+    validateFileConfig(fileConfig);
+    const configDirectory = path.dirname(configPath);
+    const configuredDataDir = setting("storage.dataDir", process.env.TEXLITE_DATA_DIR, fileConfig.storage?.dataDir, CONFIG_DEFAULTS.dataDir);
+    const dataDir = resolveConfiguredPath("storage.dataDir", configuredDataDir, configDirectory);
+    const configuredClientDir = setting("TEXLITE_CLIENT_DIR", process.env.TEXLITE_CLIENT_DIR, undefined, CONFIG_DEFAULTS.clientDir);
+    const clientDir = resolveConfiguredPath("TEXLITE_CLIENT_DIR", configuredClientDir, configDirectory);
+    const configuredEngine = setting("latex.defaultEngine", process.env.TEXLITE_DEFAULT_ENGINE, fileConfig.latex?.defaultEngine, CONFIG_DEFAULTS.defaultEngine);
+    if (!isEngine(configuredEngine)) {
+        throw configurationError("latex.defaultEngine", `must be one of ${LATEX_ENGINES.join(", ")}; received ${displayValue(configuredEngine)}`);
+    }
+    const defaultEngine = configuredEngine;
+    const configuredAllowed = fileConfig.latex?.allowedEngines;
+    const allowedEngines = configuredAllowed === undefined
+        ? [...LATEX_ENGINES]
+        : configuredAllowed.map((engine) => engine);
+    if (!allowedEngines.includes(defaultEngine)) {
+        throw configurationError("latex.allowedEngines", `must include the configured default engine “${defaultEngine}”`);
+    }
+    const compileTimeoutSeconds = integerSetting("latex.compileTimeoutSeconds", process.env.TEXLITE_COMPILE_TIMEOUT, fileConfig.latex?.compileTimeoutSeconds, CONFIG_DEFAULTS.compileTimeoutSeconds, CONFIG_LIMITS.compileTimeoutSeconds);
+    const maxCompileJobs = integerSetting("latex.maxCompileJobs", process.env.TEXLITE_MAX_COMPILE_JOBS, fileConfig.latex?.maxCompileJobs, CONFIG_DEFAULTS.maxCompileJobs, CONFIG_LIMITS.maxCompileJobs);
+    const maxFileSizeMB = integerSetting("uploads.maxFileSizeMB", process.env.TEXLITE_MAX_UPLOAD_SIZE_MB, fileConfig.uploads?.maxFileSizeMB, CONFIG_DEFAULTS.maxFileSizeMB, CONFIG_LIMITS.maxFileSizeMB);
+    const historyMaxVersions = integerSetting("history.maxVersions", process.env.TEXLITE_HISTORY_MAX_VERSIONS, fileConfig.history?.maxVersions, CONFIG_DEFAULTS.historyMaxVersions, CONFIG_LIMITS.historyMaxVersions);
+    const historyMaxStorageMB = integerSetting("history.maxStorageMB", process.env.TEXLITE_HISTORY_MAX_STORAGE_MB, fileConfig.history?.maxStorageMB, CONFIG_DEFAULTS.historyMaxStorageMB, CONFIG_LIMITS.historyMaxStorageMB);
+    const gitOperationTimeoutSeconds = integerSetting("git.operationTimeoutSeconds", process.env.TEXLITE_GIT_TIMEOUT, fileConfig.git?.operationTimeoutSeconds, CONFIG_DEFAULTS.gitOperationTimeoutSeconds, CONFIG_LIMITS.gitOperationTimeoutSeconds);
+    const config = {
+        configPath,
+        siteName: stringSetting("siteName", process.env.TEXLITE_SITE_NAME, fileConfig.siteName, CONFIG_DEFAULTS.siteName, { min: 1, max: 120 }),
+        adminEmail: stringSetting("adminEmail", process.env.TEXLITE_ADMIN_EMAIL, fileConfig.adminEmail, CONFIG_DEFAULTS.adminEmail, { min: 0, max: 320 }),
+        host: stringSetting("server.host", process.env.TEXLITE_HOST, fileConfig.server?.host, CONFIG_DEFAULTS.host, { min: 1, max: 255 }),
+        port: integerSetting("server.port", process.env.TEXLITE_PORT, fileConfig.server?.port, CONFIG_DEFAULTS.port, CONFIG_LIMITS.port),
+        dataDir,
+        databasePath: path.join(dataDir, "texlite.db"),
+        projectsDir: path.join(dataDir, "projects"),
+        clientDir,
+        sessionDays: integerSetting("sessionDays", process.env.TEXLITE_SESSION_DAYS, fileConfig.sessionDays, CONFIG_DEFAULTS.sessionDays, CONFIG_LIMITS.sessionDays),
+        compileTimeoutMs: compileTimeoutSeconds * 1000,
+        maxCompileJobs,
+        latexmk: stringSetting("latex.latexmk", process.env.TEXLITE_LATEXMK, fileConfig.latex?.latexmk, CONFIG_DEFAULTS.latexmk, { min: 1, max: 256 }),
+        defaultEngine,
+        allowedEngines,
+        extraArgs: fileConfig.latex?.extraArgs === undefined ? [] : [...fileConfig.latex.extraArgs],
+        allowProjectLatexmkrc: fileConfig.latex?.allowProjectLatexmkrc ?? CONFIG_DEFAULTS.allowProjectLatexmkrc,
+        maxUploadBytes: maxFileSizeMB * 1024 * 1024,
+        historyMaxVersions,
+        historyMaxStorageBytes: historyMaxStorageMB * 1024 * 1024,
+        git: stringSetting("git.binary", process.env.TEXLITE_GIT, fileConfig.git?.binary, CONFIG_DEFAULTS.git, { min: 1, max: 256 }),
+        gitOperationTimeoutMs: gitOperationTimeoutSeconds * 1000,
+        githubApiBaseUrl: stringSetting("git.githubApiBaseUrl", process.env.TEXLITE_GITHUB_API_URL, fileConfig.git?.githubApiBaseUrl, CONFIG_DEFAULTS.githubApiBaseUrl, { min: 1, max: 2_048 }).replace(/\/+$/, "")
+    };
+    validateConfig(config);
+    return config;
+}
+/** Validate an already materialized configuration (useful for startup/tests). */
+export function validateConfig(config) {
+    if (!config.dataDir || path.parse(config.dataDir).root === config.dataDir) {
+        throw configurationError("storage.dataDir", "must be a non-root directory where TexLite can store data");
+    }
+    validateDirectoryTarget("storage.dataDir", config.dataDir, true);
+    validateDirectoryTarget("projects directory", config.projectsDir, true);
+    validateFileTarget("database path", config.databasePath);
+    validateDirectoryTarget("client directory", config.clientDir, false);
+    validateUrl("git.githubApiBaseUrl", config.githubApiBaseUrl);
+    if (!config.allowedEngines.length || new Set(config.allowedEngines).size !== config.allowedEngines.length) {
+        throw configurationError("latex.allowedEngines", "must contain at least one unique engine");
+    }
+    for (const engine of config.allowedEngines) {
+        if (!isEngine(engine))
+            throw configurationError("latex.allowedEngines", `contains unsupported engine ${displayValue(engine)}`);
+    }
+    if (!isEngine(config.defaultEngine) || !config.allowedEngines.includes(config.defaultEngine)) {
+        throw configurationError("latex.defaultEngine", "must be one of the engines listed in latex.allowedEngines");
+    }
+    validateInteger("server.port", config.port, CONFIG_LIMITS.port);
+    validateInteger("sessionDays", config.sessionDays, CONFIG_LIMITS.sessionDays);
+    validateInteger("latex.compileTimeoutSeconds", config.compileTimeoutMs / 1000, CONFIG_LIMITS.compileTimeoutSeconds);
+    validateInteger("latex.maxCompileJobs", config.maxCompileJobs, CONFIG_LIMITS.maxCompileJobs);
+    validateInteger("uploads.maxFileSizeMB", config.maxUploadBytes / (1024 * 1024), CONFIG_LIMITS.maxFileSizeMB);
+    validateInteger("history.maxVersions", config.historyMaxVersions, CONFIG_LIMITS.historyMaxVersions);
+    validateInteger("history.maxStorageMB", config.historyMaxStorageBytes / (1024 * 1024), CONFIG_LIMITS.historyMaxStorageMB);
+    validateInteger("git.operationTimeoutSeconds", config.gitOperationTimeoutMs / 1000, CONFIG_LIMITS.gitOperationTimeoutSeconds);
+}
+function isEngine(value) {
+    return typeof value === "string" && LATEX_ENGINES.includes(value);
+}
+function readConfigFile(configPath) {
+    if (!fs.existsSync(configPath))
+        return {};
+    try {
+        const parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        if (!isRecord(parsed) || Array.isArray(parsed)) {
+            throw configurationError("configuration file", "must contain a JSON object at the top level");
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Invalid configuration"))
+            throw error;
+        throw new Error(`Unable to read configuration file ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function validateFileConfig(config) {
+    optionalString(config.siteName, "siteName", { min: 1, max: 120 });
+    optionalString(config.adminEmail, "adminEmail", { min: 0, max: 320 });
+    optionalInteger(config.sessionDays, "sessionDays", CONFIG_LIMITS.sessionDays);
+    const server = optionalSection(config.server, "server");
+    optionalString(server?.host, "server.host", { min: 1, max: 255 });
+    optionalInteger(server?.port, "server.port", CONFIG_LIMITS.port);
+    const storage = optionalSection(config.storage, "storage");
+    optionalString(storage?.dataDir, "storage.dataDir", { min: 1, max: 4_096 });
+    const uploads = optionalSection(config.uploads, "uploads");
+    optionalInteger(uploads?.maxFileSizeMB, "uploads.maxFileSizeMB", CONFIG_LIMITS.maxFileSizeMB);
+    const history = optionalSection(config.history, "history");
+    optionalInteger(history?.maxVersions, "history.maxVersions", CONFIG_LIMITS.historyMaxVersions);
+    optionalInteger(history?.maxStorageMB, "history.maxStorageMB", CONFIG_LIMITS.historyMaxStorageMB);
+    const latex = optionalSection(config.latex, "latex");
+    optionalString(latex?.latexmk, "latex.latexmk", { min: 1, max: 256 });
+    if (latex && Object.prototype.hasOwnProperty.call(latex, "defaultEngine") && !isEngine(latex.defaultEngine)) {
+        throw configurationError("latex.defaultEngine", `must be one of ${LATEX_ENGINES.join(", ")}; received ${displayValue(latex.defaultEngine)}`);
+    }
+    optionalInteger(latex?.compileTimeoutSeconds, "latex.compileTimeoutSeconds", CONFIG_LIMITS.compileTimeoutSeconds);
+    optionalInteger(latex?.maxCompileJobs, "latex.maxCompileJobs", CONFIG_LIMITS.maxCompileJobs);
+    if (latex && Object.prototype.hasOwnProperty.call(latex, "allowedEngines")) {
+        if (!Array.isArray(latex.allowedEngines) || latex.allowedEngines.length === 0) {
+            throw configurationError("latex.allowedEngines", `must be a non-empty list containing only ${LATEX_ENGINES.join(", ")}`);
+        }
+        const engines = latex.allowedEngines;
+        if (engines.some((engine) => !isEngine(engine))) {
+            throw configurationError("latex.allowedEngines", `must contain only ${LATEX_ENGINES.join(", ")}`);
+        }
+        if (new Set(engines).size !== engines.length) {
+            throw configurationError("latex.allowedEngines", "must not contain duplicate engines");
+        }
+    }
+    if (latex && Object.prototype.hasOwnProperty.call(latex, "extraArgs")) {
+        if (!Array.isArray(latex.extraArgs) || latex.extraArgs.some((item) => typeof item !== "string" || item.length > 512)) {
+            throw configurationError("latex.extraArgs", "must be an array of strings, each no longer than 512 characters");
+        }
+    }
+    if (latex && Object.prototype.hasOwnProperty.call(latex, "allowProjectLatexmkrc") && typeof latex.allowProjectLatexmkrc !== "boolean") {
+        throw configurationError("latex.allowProjectLatexmkrc", "must be true or false");
+    }
+    const git = optionalSection(config.git, "git");
+    optionalString(git?.binary, "git.binary", { min: 1, max: 256 });
+    optionalInteger(git?.operationTimeoutSeconds, "git.operationTimeoutSeconds", CONFIG_LIMITS.gitOperationTimeoutSeconds);
+    if (git && Object.prototype.hasOwnProperty.call(git, "githubApiBaseUrl")) {
+        optionalString(git.githubApiBaseUrl, "git.githubApiBaseUrl", { min: 1, max: 2_048 });
+        if (typeof git.githubApiBaseUrl === "string")
+            validateUrl("git.githubApiBaseUrl", git.githubApiBaseUrl);
+    }
+}
+function optionalSection(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value) || Array.isArray(value))
+        throw configurationError(name, "must be a JSON object");
+    return value;
+}
+function optionalString(value, name, limits) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "string" || value.length < limits.min || value.length > limits.max || (limits.min > 0 && !value.trim())) {
+        throw configurationError(name, `must be a ${limits.min === 0 ? "string" : `non-empty string`} of at most ${limits.max} characters`);
+    }
+}
+function optionalInteger(value, name, limits) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "number" || !Number.isInteger(value)) {
+        throw configurationError(name, `must be an integer from ${limits[0]} to ${limits[1]}; received ${displayValue(value)}`);
+    }
+    validateInteger(name, value, limits);
+}
+function integerSetting(name, envValue, fileValue, fallback, limits) {
+    if (envValue !== undefined) {
+        if (!/^\d+$/.test(envValue)) {
+            throw configurationError(name, `must be an integer from ${limits[0]} to ${limits[1]}; received ${displayValue(envValue)}`);
+        }
+        const value = Number(envValue);
+        validateInteger(name, value, limits);
+        return value;
+    }
+    if (fileValue === undefined)
+        return fallback;
+    validateInteger(name, fileValue, limits);
+    return fileValue;
+}
+function stringSetting(name, envValue, fileValue, fallback, limits) {
+    const value = envValue ?? fileValue ?? fallback;
+    optionalString(value, name, limits);
+    return value;
+}
+function setting(name, envValue, fileValue, fallback) {
+    if (envValue !== undefined) {
+        if (typeof envValue === "string" && !envValue.trim())
+            throw configurationError(name, "must not be empty");
+        return envValue;
+    }
+    return fileValue ?? fallback;
+}
+function resolveConfiguredPath(name, value, baseDirectory) {
+    if (typeof value !== "string" || !value.trim() || value.includes("\0")) {
+        throw configurationError(name, "must be a non-empty path without NUL characters");
+    }
+    try {
+        return path.resolve(baseDirectory, value);
+    }
+    catch (error) {
+        throw configurationError(name, `is not a valid path: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function validateDirectoryTarget(name, target, checkWritableParent) {
+    if (fs.existsSync(target)) {
+        let stat;
+        try {
+            stat = fs.statSync(target);
+        }
+        catch (error) {
+            throw configurationError(name, `cannot be inspected: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!stat.isDirectory())
+            throw configurationError(name, `points to a file, not a directory: ${target}`);
+        if (checkWritableParent) {
+            try {
+                fs.accessSync(target, fs.constants.W_OK);
+            }
+            catch {
+                throw configurationError(name, `is not writable: ${target}`);
+            }
+        }
+        return;
+    }
+    const parent = nearestExistingParent(target);
+    if (!parent)
+        throw configurationError(name, `has no existing parent directory; create one before starting: ${target}`);
+    if (checkWritableParent) {
+        try {
+            fs.accessSync(parent, fs.constants.W_OK);
+        }
+        catch {
+            throw configurationError(name, `cannot be created because its parent is not writable: ${parent}`);
+        }
+    }
+}
+function validateFileTarget(name, target) {
+    if (!fs.existsSync(target))
+        return;
+    try {
+        if (fs.statSync(target).isDirectory())
+            throw configurationError(name, `points to a directory, but must be a file: ${target}`);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Invalid configuration"))
+            throw error;
+        throw configurationError(name, `cannot be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function nearestExistingParent(target) {
+    let current = path.dirname(target);
+    while (current !== path.dirname(current)) {
+        if (fs.existsSync(current))
+            return current;
+        current = path.dirname(current);
+    }
+    return fs.existsSync(current) ? current : null;
+}
+function validateUrl(name, value) {
+    try {
+        const parsed = new URL(value);
+        if (!["http:", "https:"].includes(parsed.protocol))
+            throw new Error("only http:// and https:// are supported");
+    }
+    catch (error) {
+        throw configurationError(name, `must be a valid http(s) URL: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function validateInteger(name, value, limits) {
+    if (!Number.isInteger(value) || value < limits[0] || value > limits[1]) {
+        throw configurationError(name, `must be an integer from ${limits[0]} to ${limits[1]}; received ${displayValue(value)}`);
+    }
+}
+function displayValue(value) {
+    if (typeof value === "string")
+        return `“${value}”`;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function configurationError(name, detail) {
+    return new Error(`Invalid configuration (${name}): ${detail}. Update texlite.config.json or the corresponding TEXLITE_* environment variable and try again.`);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}

package/dist/server/db.js

@@ -0,0 +1,280 @@
+import fs from "node:fs";
+import Database from "better-sqlite3";
+export function openDatabase(config) {
+    fs.mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(config.projectsDir, { recursive: true, mode: 0o700 });
+    const db = new Database(config.databasePath, { timeout: 5000 });
+    db.exec("PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 5000;");
+    migrate(db);
+    return db;
+}
+function migrate(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS users (
+      id TEXT PRIMARY KEY,
+      username TEXT NOT NULL UNIQUE COLLATE NOCASE,
+      display_name TEXT NOT NULL,
+      password_hash TEXT NOT NULL,
+      role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
+      disabled INTEGER NOT NULL DEFAULT 0 CHECK (disabled IN (0, 1)),
+      must_change_password INTEGER NOT NULL DEFAULT 0 CHECK (must_change_password IN (0, 1)),
+      can_create_projects INTEGER NOT NULL DEFAULT 0 CHECK (can_create_projects IN (0, 1)),
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS sessions (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      expires_at TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS sessions_user_id ON sessions(user_id);
+
+    CREATE TABLE IF NOT EXISTS projects (
+      id TEXT PRIMARY KEY,
+      owner_id TEXT NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+      last_modified_by TEXT REFERENCES users(id) ON DELETE SET NULL,
+      name TEXT NOT NULL,
+      main_file TEXT NOT NULL DEFAULT 'main.tex',
+      latexmkrc TEXT,
+      engine TEXT NOT NULL DEFAULT 'xelatex' CHECK (engine IN ('pdflatex', 'xelatex', 'lualatex')),
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS projects_owner_id ON projects(owner_id);
+
+    CREATE TABLE IF NOT EXISTS project_tags (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL COLLATE NOCASE,
+      color TEXT NOT NULL CHECK (color IN ('red', 'orange', 'yellow', 'green', 'blue', 'purple', 'gray')),
+      created_at TEXT NOT NULL,
+      UNIQUE (project_id, name)
+    );
+    CREATE INDEX IF NOT EXISTS project_tags_project_id ON project_tags(project_id);
+
+    CREATE TABLE IF NOT EXISTS tags (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+      color TEXT NOT NULL CHECK (color IN ('red', 'orange', 'yellow', 'green', 'blue', 'purple', 'gray')),
+      created_by TEXT REFERENCES users(id) ON DELETE SET NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS project_tag_links (
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      tag_id TEXT NOT NULL REFERENCES tags(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (project_id, tag_id)
+    );
+    CREATE INDEX IF NOT EXISTS project_tag_links_tag_id ON project_tag_links(tag_id);
+
+    CREATE TABLE IF NOT EXISTS user_tags (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      name TEXT NOT NULL COLLATE NOCASE,
+      color TEXT NOT NULL CHECK (color IN ('red', 'orange', 'yellow', 'green', 'blue', 'purple', 'gray')),
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      UNIQUE (user_id, name)
+    );
+    CREATE INDEX IF NOT EXISTS user_tags_user_id ON user_tags(user_id);
+
+    CREATE TABLE IF NOT EXISTS user_project_tag_links (
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      tag_id TEXT NOT NULL REFERENCES user_tags(id) ON DELETE CASCADE,
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (project_id, tag_id)
+    );
+    CREATE INDEX IF NOT EXISTS user_project_tag_links_tag_id ON user_project_tag_links(tag_id);
+
+    CREATE TABLE IF NOT EXISTS user_project_archives (
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      archived_at TEXT NOT NULL,
+      PRIMARY KEY (user_id, project_id)
+    );
+    CREATE INDEX IF NOT EXISTS user_project_archives_project_id ON user_project_archives(project_id);
+
+    CREATE TABLE IF NOT EXISTS project_members (
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      permission TEXT NOT NULL CHECK (permission IN ('read', 'edit')),
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (project_id, user_id)
+    );
+
+    CREATE TABLE IF NOT EXISTS comments (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      file_path TEXT NOT NULL,
+      author_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+      selected_text TEXT NOT NULL DEFAULT '',
+      start_offset INTEGER NOT NULL DEFAULT 0,
+      end_offset INTEGER NOT NULL DEFAULT 0,
+      context_before TEXT NOT NULL DEFAULT '',
+      context_after TEXT NOT NULL DEFAULT '',
+      orphaned INTEGER NOT NULL DEFAULT 0 CHECK (orphaned IN (0, 1)),
+      start_line INTEGER NOT NULL DEFAULT 1,
+      end_line INTEGER NOT NULL DEFAULT 1,
+      content TEXT NOT NULL,
+      resolved INTEGER NOT NULL DEFAULT 0 CHECK (resolved IN (0, 1)),
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      edited_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS comments_project_file ON comments(project_id, file_path);
+
+    CREATE TABLE IF NOT EXISTS comment_replies (
+      id TEXT PRIMARY KEY,
+      comment_id TEXT NOT NULL REFERENCES comments(id) ON DELETE CASCADE,
+      author_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+      content TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      edited_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS comment_replies_comment_id ON comment_replies(comment_id, created_at);
+
+    CREATE TABLE IF NOT EXISTS compile_runs (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      requested_by TEXT REFERENCES users(id) ON DELETE SET NULL,
+      main_file TEXT NOT NULL DEFAULT '',
+      status TEXT NOT NULL CHECK (status IN ('queued', 'running', 'succeeded', 'failed')),
+      log TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL,
+      finished_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS compile_runs_project_created ON compile_runs(project_id, created_at DESC);
+
+    CREATE TABLE IF NOT EXISTS project_history_versions (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      author_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+      reason TEXT NOT NULL CHECK (reason IN ('initial', 'autosave', 'file', 'settings', 'git', 'restore', 'checkpoint')),
+      label TEXT,
+      manifest_json TEXT NOT NULL,
+      changed_paths_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS project_history_versions_project_created
+      ON project_history_versions(project_id, created_at DESC);
+
+    CREATE TABLE IF NOT EXISTS project_history_state (
+      project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+      manifest_json TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS project_dictionary_words (
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      word TEXT NOT NULL COLLATE NOCASE,
+      created_by TEXT REFERENCES users(id) ON DELETE SET NULL,
+      created_at TEXT NOT NULL,
+      PRIMARY KEY (project_id, word)
+    );
+    CREATE INDEX IF NOT EXISTS project_dictionary_words_project_id ON project_dictionary_words(project_id);
+
+    CREATE TABLE IF NOT EXISTS project_git_settings (
+      project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+      token_ciphertext TEXT,
+      github_login TEXT,
+      remote_url TEXT,
+      repository_name TEXT,
+      repository_html_url TEXT,
+      default_branch TEXT NOT NULL DEFAULT 'main',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+  `);
+    const projectColumns = db.prepare("PRAGMA table_info(projects)").all();
+    if (!projectColumns.some((column) => column.name === "latexmkrc")) {
+        db.exec("ALTER TABLE projects ADD COLUMN latexmkrc TEXT");
+    }
+    if (!projectColumns.some((column) => column.name === "last_modified_by")) {
+        db.exec("ALTER TABLE projects ADD COLUMN last_modified_by TEXT REFERENCES users(id) ON DELETE SET NULL");
+    }
+    const commentColumns = db.prepare("PRAGMA table_info(comments)").all();
+    const additions = [
+        ["start_offset", "INTEGER NOT NULL DEFAULT 0"],
+        ["end_offset", "INTEGER NOT NULL DEFAULT 0"],
+        ["context_before", "TEXT NOT NULL DEFAULT ''"],
+        ["context_after", "TEXT NOT NULL DEFAULT ''"],
+        ["orphaned", "INTEGER NOT NULL DEFAULT 0"],
+        ["edited_at", "TEXT"]
+    ];
+    for (const [name, definition] of additions) {
+        if (!commentColumns.some((column) => column.name === name)) {
+            db.exec(`ALTER TABLE comments ADD COLUMN ${name} ${definition}`);
+        }
+    }
+    const replyColumns = db.prepare("PRAGMA table_info(comment_replies)").all();
+    if (!replyColumns.some((column) => column.name === "edited_at")) {
+        db.exec("ALTER TABLE comment_replies ADD COLUMN edited_at TEXT");
+    }
+    const userColumns = db.prepare("PRAGMA table_info(users)").all();
+    if (!userColumns.some((column) => column.name === "can_create_projects")) {
+        db.exec("ALTER TABLE users ADD COLUMN can_create_projects INTEGER NOT NULL DEFAULT 0");
+    }
+    const compileRunColumns = db.prepare("PRAGMA table_info(compile_runs)").all();
+    if (!compileRunColumns.some((column) => column.name === "main_file")) {
+        db.exec("ALTER TABLE compile_runs ADD COLUMN main_file TEXT NOT NULL DEFAULT ''");
+    }
+    db.exec(`
+    UPDATE users SET can_create_projects = 1 WHERE role = 'admin';
+    UPDATE projects SET last_modified_by = owner_id WHERE last_modified_by IS NULL;
+    UPDATE compile_runs SET main_file = COALESCE(
+      (SELECT project.main_file FROM projects project WHERE project.id = compile_runs.project_id), ''
+    ) WHERE main_file = '';
+    CREATE INDEX IF NOT EXISTS compile_runs_project_main_created
+      ON compile_runs(project_id, main_file, created_at DESC);
+
+    INSERT OR IGNORE INTO tags (id, name, color, created_by, created_at, updated_at)
+    SELECT legacy.id, legacy.name, legacy.color, p.owner_id, legacy.created_at, legacy.created_at
+    FROM project_tags legacy
+    JOIN projects p ON p.id = legacy.project_id
+    WHERE legacy.id = (
+      SELECT first_tag.id FROM project_tags first_tag
+      WHERE first_tag.name = legacy.name COLLATE NOCASE
+      ORDER BY first_tag.created_at, first_tag.id LIMIT 1
+    );
+
+    INSERT OR IGNORE INTO project_tag_links (project_id, tag_id, created_at)
+    SELECT legacy.project_id, tag.id, legacy.created_at
+    FROM project_tags legacy
+    JOIN tags tag ON tag.name = legacy.name COLLATE NOCASE;
+
+    INSERT OR IGNORE INTO user_tags (id, user_id, name, color, created_at, updated_at)
+    SELECT legacy.id, project.owner_id, legacy.name, legacy.color, legacy.created_at, legacy.created_at
+    FROM project_tags legacy
+    JOIN projects project ON project.id = legacy.project_id
+    WHERE legacy.id = (
+      SELECT first_tag.id FROM project_tags first_tag
+      JOIN projects first_project ON first_project.id = first_tag.project_id
+      WHERE first_project.owner_id = project.owner_id
+        AND first_tag.name = legacy.name COLLATE NOCASE
+      ORDER BY first_tag.created_at, first_tag.id LIMIT 1
+    );
+
+    INSERT OR IGNORE INTO user_project_tag_links (project_id, tag_id, created_at)
+    SELECT legacy.project_id, user_tag.id, legacy.created_at
+    FROM project_tags legacy
+    JOIN projects project ON project.id = legacy.project_id
+    JOIN user_tags user_tag ON user_tag.user_id = project.owner_id
+      AND user_tag.name = legacy.name COLLATE NOCASE;
+
+    INSERT OR IGNORE INTO user_tags (id, user_id, name, color, created_at, updated_at)
+    SELECT tag.id, tag.created_by, tag.name, tag.color, tag.created_at, tag.updated_at
+    FROM tags tag WHERE tag.created_by IS NOT NULL;
+
+    INSERT OR IGNORE INTO user_project_tag_links (project_id, tag_id, created_at)
+    SELECT link.project_id, link.tag_id, link.created_at
+    FROM project_tag_links link JOIN user_tags user_tag ON user_tag.id = link.tag_id;
+  `);
+}
+export function activeAdminCount(db) {
+    const row = db.prepare("SELECT COUNT(*) AS count FROM users WHERE role = 'admin' AND disabled = 0").get();
+    return Number(row.count);
+}

package/dist/server/environment.js

@@ -0,0 +1,57 @@
+import { spawn } from "node:child_process";
+export async function assertEnvironment(config) {
+    const commands = [
+        { name: "latexmk", command: config.latexmk },
+        ...config.allowedEngines.map((command) => ({ name: command, command }))
+    ];
+    const checked = [];
+    const seen = new Set();
+    for (const item of commands) {
+        if (seen.has(item.command))
+            continue;
+        seen.add(item.command);
+        const result = await commandVersion(item.command, 10_000);
+        if (result.error || result.status !== 0) {
+            const detail = result.error || result.stderr.trim() || `exit ${result.status ?? "unknown"}`;
+            throw new Error(`Environment check failed: could not run the ${item.name} command "${item.command}" (${detail}). Initialization/startup has been stopped.`);
+        }
+        const version = `${result.stdout || result.stderr}`.trim().split("\n")[0]?.slice(0, 160) || "available";
+        checked.push({ ...item, version });
+    }
+    return checked;
+}
+export async function assertGitAvailable(config) {
+    const item = { name: "Git", command: config.git };
+    const result = await commandVersion(item.command, Math.min(config.gitOperationTimeoutMs, 10_000));
+    if (result.error || result.status !== 0) {
+        const detail = result.error || result.stderr.trim() || `exit ${result.status ?? "unknown"}`;
+        throw Object.assign(new Error(`Git integration is unavailable: could not run the configured command "${item.command}" (${detail}). Install Git or correct git.binary and try again.`), { statusCode: 503, code: "GIT_UNAVAILABLE" });
+    }
+    const version = `${result.stdout || result.stderr}`.trim().split("\n")[0]?.slice(0, 160) || "available";
+    return { ...item, version };
+}
+function commandVersion(command, timeoutMs) {
+    return new Promise((resolve) => {
+        const child = spawn(command, ["--version"], {
+            env: { ...process.env, LC_ALL: "C" }, shell: false, stdio: ["ignore", "pipe", "pipe"]
+        });
+        const stdout = [];
+        const stderr = [];
+        let settled = false;
+        let timedOut = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ ...result, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8") });
+        };
+        const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); }, timeoutMs);
+        child.stdout.on("data", (chunk) => { if (Buffer.concat(stdout).length < 64 * 1024)
+            stdout.push(chunk); });
+        child.stderr.on("data", (chunk) => { if (Buffer.concat(stderr).length < 64 * 1024)
+            stderr.push(chunk); });
+        child.once("error", (error) => finish({ status: null, error: error.message }));
+        child.once("close", (status) => finish({ status, error: timedOut ? "command timed out" : null }));
+    });
+}