texlite 0.7.3 → 0.7.6

package/dist/server/routes/projectGit.js

@@ -0,0 +1,145 @@
+import { requireUser } from "../auth.js";
+import { apiError, httpError } from "../http.js";
+import { accessibleProject } from "../projects.js";
+import { projectTextSnapshot, reanchorProjectSnapshot, requireActiveUser, touchProject } from "./projectShared.js";
+/** Register owner-only local Git and GitHub backup routes. */
+export function registerProjectGitRoutes(app, context) {
+    const { config, db, collaboration, projectMutations, projectGit, recordHistory } = context;
+    const requireGitOwner = (projectId, user) => {
+        requireActiveUser(db, user);
+        const project = accessibleProject(db, projectId, user);
+        if (!project)
+            throw httpError(404, "PROJECT_NOT_FOUND");
+        if (project.owner_id !== user.id)
+            throw httpError(403, "PROJECT_OWNER_ONLY");
+        return project;
+    };
+    app.get("/api/projects/:id/git", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        return await projectMutations.runConsistentRead(id, async () => {
+            return { status: await projectGit.status(requireGitOwner(id, user)) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.put("/api/projects/:id/git/token", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const body = request.body;
+        if (typeof body.token !== "string")
+            return apiError(reply, 400, "GIT_TOKEN_INVALID");
+        const token = body.token;
+        return await projectMutations.runSerialized(id, async () => {
+            return { status: await projectGit.configureToken(requireGitOwner(id, user), token) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.delete("/api/projects/:id/git/token", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        return await projectMutations.runSerialized(id, async () => {
+            return { status: await projectGit.removeToken(requireGitOwner(id, user)) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.post("/api/projects/:id/git/repository", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const body = request.body;
+        if (typeof body.name !== "string")
+            return apiError(reply, 400, "GIT_REPOSITORY_NAME_INVALID");
+        const repositoryName = body.name.trim();
+        return await projectMutations.runSerialized(id, async () => {
+            return { status: await projectGit.createGitHubRepository(requireGitOwner(id, user), repositoryName, body.private !== false) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.post("/api/projects/:id/git/commit", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (collaboration.isMaintaining(id))
+            return apiError(reply, 409, "PROJECT_BUSY");
+        const body = request.body;
+        return await projectMutations.runExclusive(id, "Git commit", async () => {
+            const project = requireGitOwner(id, user);
+            const commit = await projectGit.commit(project, user, typeof body.message === "string" ? body.message : "");
+            return reply.code(201).send({ commit, status: await projectGit.status(project) });
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.post("/api/projects/:id/git/push", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (collaboration.isMaintaining(id))
+            return apiError(reply, 409, "PROJECT_BUSY");
+        return await projectMutations.runSerialized(id, async () => {
+            const project = requireGitOwner(id, user);
+            return { status: await projectGit.push(project) };
+        }, { flush: false, preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.get("/api/projects/:id/git/history", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        return await projectMutations.runConsistentRead(id, async () => {
+            return { commits: await projectGit.history(requireGitOwner(id, user)) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.get("/api/projects/:id/git/diff", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const { revision } = request.query;
+        return await projectMutations.runConsistentRead(id, async () => {
+            const project = requireGitOwner(id, user);
+            return projectGit.diff(project, revision);
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.post("/api/projects/:id/git/checkout", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        requireGitOwner(id, user);
+        const body = request.body;
+        if (body.revision !== null && typeof body.revision !== "string")
+            return apiError(reply, 400, "GIT_REVISION_INVALID");
+        const revisionInput = body.revision === null ? null : body.revision;
+        return await projectMutations.runExclusive(id, "Git checkout", async () => {
+            const currentProject = requireGitOwner(id, user);
+            recordHistory(id, user.id, "checkpoint");
+            const before = projectTextSnapshot(config, id);
+            const revision = await projectGit.checkout(currentProject, revisionInput, body.force === true);
+            reanchorProjectSnapshot(db, id, before, projectTextSnapshot(config, id));
+            touchProject(db, id, user.id);
+            recordHistory(id, user.id, "git");
+            return { revision, status: await projectGit.status(currentProject) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+    app.post("/api/projects/:id/git/discard", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        requireGitOwner(id, user);
+        return await projectMutations.runExclusive(id, "Git restore", async () => {
+            const currentProject = requireGitOwner(id, user);
+            recordHistory(id, user.id, "checkpoint");
+            const before = projectTextSnapshot(config, id);
+            await projectGit.discardChanges(currentProject);
+            reanchorProjectSnapshot(db, id, before, projectTextSnapshot(config, id));
+            touchProject(db, id, user.id);
+            recordHistory(id, user.id, "git");
+            return { status: await projectGit.status(currentProject) };
+        }, { preflight: () => { requireGitOwner(id, user); } });
+    });
+}

package/dist/server/routes/projectHistory.js

@@ -0,0 +1,150 @@
+import fs from "node:fs";
+import { requireUser } from "../auth.js";
+import { resolveSourcePath, safeRelativePath } from "../files.js";
+import { apiError, httpError } from "../http.js";
+import { MAX_TEXT_PREVIEW_BYTES } from "../limits.js";
+import { accessibleProject, canEdit } from "../projects.js";
+import { commentsSummaryForProject, projectJson, projectTextSnapshot, reanchorProjectSnapshot, requireEditableProject, requireProjectOwnerPermission, tagsForProject, text, touchProject } from "./projectShared.js";
+/** Register retained project version listing, inspection, restoration, and cleanup routes. */
+export function registerProjectHistoryRoutes(app, context) {
+    const { config, db, history, projectMutations, recordHistory } = context;
+    app.get("/api/projects/:id/history", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project)
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const { limit: limitInput } = request.query;
+        const limit = Number.parseInt(limitInput ?? "100", 10);
+        return {
+            versions: history.list(id, Number.isFinite(limit) ? limit : 100),
+            stats: project.permission === "owner" ? history.stats(id) : null
+        };
+    });
+    app.get("/api/projects/:id/history/:versionId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, versionId } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const version = history.version(versionId, id);
+        const manifest = history.manifest(id, versionId);
+        if (!version || !manifest)
+            return apiError(reply, 404, "HISTORY_VERSION_NOT_FOUND");
+        return {
+            version,
+            settings: manifest.settings,
+            files: Object.entries(manifest.files).map(([filePath, file]) => ({ path: filePath, size: file.size })).sort((left, right) => left.path.localeCompare(right.path))
+        };
+    });
+    app.get("/api/projects/:id/history/:versionId/file", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, versionId } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const filePath = safeRelativePath(query.path ?? "");
+        return await projectMutations.runConsistentRead(id, () => {
+            const historical = history.readTextFile(id, versionId, filePath);
+            if (historical === null)
+                return apiError(reply, 415, "HISTORY_FILE_PREVIEW_UNSUPPORTED", { path: filePath });
+            let comparison = "";
+            if (query.against) {
+                comparison = history.readTextFile(id, query.against, filePath) ?? "";
+            }
+            else {
+                const current = resolveSourcePath(config, id, filePath);
+                if (fs.existsSync(current) && fs.statSync(current).isFile() && fs.statSync(current).size <= MAX_TEXT_PREVIEW_BYTES) {
+                    comparison = fs.readFileSync(current, "utf8");
+                }
+            }
+            return { path: filePath, historical, comparison, against: query.against ?? "current" };
+        }, { preflight: () => {
+                if (!accessibleProject(db, id, user))
+                    throw httpError(404, "PROJECT_NOT_FOUND");
+            } });
+    });
+    app.patch("/api/projects/:id/history/:versionId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, versionId } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || !canEdit(project))
+            return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
+        const body = request.body;
+        const label = body.label === null || body.label === "" ? null : text(body.label, 80);
+        const version = history.setLabel(id, versionId, label);
+        if (!version)
+            return apiError(reply, 404, "HISTORY_VERSION_NOT_FOUND");
+        return { version, stats: project.permission === "owner" ? history.stats(id) : null };
+    });
+    app.delete("/api/projects/:id/history/:versionId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, versionId } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || project.permission !== "owner")
+            return apiError(reply, 403, "PROJECT_OWNER_ONLY");
+        return await projectMutations.runWrite(id, () => {
+            if (!history.deleteVersion(id, versionId))
+                return apiError(reply, 404, "HISTORY_VERSION_NOT_FOUND");
+            return { ok: true, stats: history.stats(id) };
+        }, { preflight: () => {
+                requireProjectOwnerPermission(db, id, user);
+                if (!history.version(versionId, id)) {
+                    throw httpError(404, "HISTORY_VERSION_NOT_FOUND");
+                }
+            } });
+    });
+    app.delete("/api/projects/:id/history", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || project.permission !== "owner")
+            return apiError(reply, 403, "PROJECT_OWNER_ONLY");
+        return await projectMutations.runWrite(id, () => {
+            history.clear(id);
+            return { ok: true, stats: history.stats(id) };
+        }, { preflight: () => { requireProjectOwnerPermission(db, id, user); } });
+    });
+    app.post("/api/projects/:id/history/:versionId/restore", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, versionId } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || !canEdit(project))
+            return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
+        const body = request.body;
+        const filePath = typeof body?.path === "string" ? safeRelativePath(body.path) : undefined;
+        return await projectMutations.runExclusive(id, "history restore", () => {
+            const currentProject = requireEditableProject(db, id, user);
+            recordHistory(id, user.id, "checkpoint");
+            const before = projectTextSnapshot(config, id);
+            const restored = history.restore(id, versionId, filePath);
+            reanchorProjectSnapshot(db, id, before, projectTextSnapshot(config, id));
+            touchProject(db, id, user.id);
+            recordHistory(id, user.id, "restore", filePath ? [filePath] : undefined);
+            return {
+                ok: true,
+                restoredPaths: restored.restoredPaths,
+                project: projectJson(accessibleProject(db, id, user) ?? currentProject, tagsForProject(db, id, user.id), commentsSummaryForProject(db, id))
+            };
+        }, { preflight: () => {
+                requireEditableProject(db, id, user);
+                if (!history.version(versionId, id)) {
+                    throw httpError(404, "HISTORY_VERSION_NOT_FOUND");
+                }
+                history.validateRestoreTarget(id, versionId, filePath);
+            } });
+    });
+}

package/dist/server/routes/projectMembers.js

@@ -0,0 +1,112 @@
+import { requireUser } from "../auth.js";
+import { apiError, httpError } from "../http.js";
+import { accessibleProject } from "../projects.js";
+import { commentsSummaryForProject, now, projectJson, requireActualProjectOwner, tagsForProject, touchProject } from "./projectShared.js";
+/** Register project sharing, member permission, and ownership-transfer routes. */
+export function registerProjectMemberRoutes(app, context) {
+    const { db, collaboration, projectMutations } = context;
+    app.get("/api/projects/:id/members", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const members = db.prepare(`SELECT pm.user_id AS id, u.username, u.display_name AS displayName, pm.permission
+      FROM project_members pm JOIN users u ON u.id = pm.user_id WHERE pm.project_id = ? ORDER BY u.username`).all(id);
+        return { members };
+    });
+    app.put("/api/projects/:id/owner", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || project.owner_id !== user.id) {
+            return apiError(reply, 403, "PROJECT_TRANSFER_FORBIDDEN");
+        }
+        const body = (request.body ?? {});
+        if (typeof body.userId !== "string" || !body.userId) {
+            return apiError(reply, 400, "PROJECT_TRANSFER_TARGET_INVALID");
+        }
+        if (body.userId === user.id) {
+            return apiError(reply, 400, "PROJECT_TRANSFER_SELF");
+        }
+        const target = db.prepare("SELECT id FROM users WHERE id = ? AND disabled = 0").get(body.userId);
+        if (!target)
+            return apiError(reply, 404, "USER_NOT_FOUND");
+        return await projectMutations.runExclusive(id, "project transfer", () => {
+            const currentTarget = db.prepare("SELECT id FROM users WHERE id = ? AND disabled = 0").get(body.userId);
+            // The synchronous preflight immediately precedes maintenance, so this
+            // lookup cannot change before the operation starts.
+            if (!currentTarget)
+                throw httpError(404, "USER_NOT_FOUND");
+            const changedAt = now();
+            db.exec("BEGIN IMMEDIATE");
+            try {
+                // The new owner may already be a shared member. The previous owner keeps
+                // edit access so a transfer does not unexpectedly lock them out.
+                db.prepare("DELETE FROM project_members WHERE project_id = ? AND user_id = ?").run(id, currentTarget.id);
+                db.prepare(`INSERT INTO project_members (project_id, user_id, permission, created_at)
+          VALUES (?, ?, 'edit', ?)
+          ON CONFLICT(project_id, user_id) DO UPDATE SET permission = 'edit'`)
+                    .run(id, user.id, changedAt);
+                db.prepare("UPDATE projects SET owner_id = ?, last_modified_by = ?, updated_at = ? WHERE id = ?")
+                    .run(currentTarget.id, user.id, changedAt, id);
+                // A project token belongs to the account that supplied it. Preserve the
+                // local repository/remote metadata, but require the new owner to add
+                // their own credential before the next GitHub operation.
+                db.prepare("UPDATE project_git_settings SET token_ciphertext = NULL, github_login = NULL, updated_at = ? WHERE project_id = ?")
+                    .run(changedAt, id);
+                db.exec("COMMIT");
+            }
+            catch (error) {
+                db.exec("ROLLBACK");
+                throw error;
+            }
+            return {
+                project: projectJson(accessibleProject(db, id, user), tagsForProject(db, id, user.id), commentsSummaryForProject(db, id))
+            };
+        }, { preflight: () => {
+                requireActualProjectOwner(db, id, user);
+                if (!db.prepare("SELECT 1 FROM users WHERE id = ? AND disabled = 0").get(body.userId)) {
+                    throw httpError(404, "USER_NOT_FOUND");
+                }
+            } });
+    });
+    app.put("/api/projects/:id/members/:userId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, userId } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || project.permission !== "owner")
+            return apiError(reply, 403, "MEMBERS_MANAGE_FORBIDDEN");
+        if (userId === project.owner_id)
+            return apiError(reply, 400, "OWNER_MEMBER_FORBIDDEN");
+        if (!db.prepare("SELECT 1 FROM users WHERE id = ? AND disabled = 0").get(userId)) {
+            return apiError(reply, 404, "USER_NOT_FOUND");
+        }
+        const body = request.body;
+        const permission = body.permission === "edit" ? "edit" : "read";
+        db.prepare(`INSERT INTO project_members (project_id, user_id, permission, created_at) VALUES (?, ?, ?, ?)
+      ON CONFLICT(project_id, user_id) DO UPDATE SET permission = excluded.permission`)
+            .run(id, userId, permission, now());
+        touchProject(db, id, user.id);
+        collaboration.notifyPermissionChanged(id, userId, permission);
+        return { ok: true };
+    });
+    app.delete("/api/projects/:id/members/:userId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, userId } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project || project.permission !== "owner")
+            return apiError(reply, 403, "MEMBERS_MANAGE_FORBIDDEN");
+        db.prepare("DELETE FROM project_members WHERE project_id = ? AND user_id = ?").run(id, userId);
+        touchProject(db, id, user.id);
+        collaboration.notifyPermissionChanged(id, userId, "revoked");
+        return { ok: true };
+    });
+}

package/dist/server/routes/projectShared.js

@@ -0,0 +1,238 @@
+import fs from "node:fs";
+import { reanchorFileComments, offsetToLine } from "../anchors.js";
+import { maxCollaborativeFileBytes } from "../collaboration.js";
+import { listProjectFiles, resolveSourcePath } from "../files.js";
+import { httpError, ValidationError } from "../http.js";
+import { accessibleProject, canEdit } from "../projects.js";
+export const now = () => new Date().toISOString();
+export function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, "\\$&");
+}
+export function escapeGlobPattern(value) {
+    return value.replace(/[*?[]/g, "[$&]");
+}
+export function text(value, max = 200) {
+    if (typeof value !== "string" || !value.trim() || value.length > max) {
+        throw new ValidationError();
+    }
+    return value.trim();
+}
+export function dictionaryWord(value) {
+    if (typeof value !== "string")
+        throw new ValidationError();
+    const word = value.trim();
+    if (!word || word.length > 64 || /[\s\\{}$%]/u.test(word))
+        throw new ValidationError();
+    return word;
+}
+export const tagColors = ["red", "orange", "yellow", "green", "blue", "purple", "gray"];
+export function tagsForProject(db, projectId, userId) {
+    return db.prepare(`SELECT tag.id, tag.name, tag.color
+    FROM user_tags tag JOIN user_project_tag_links link ON link.tag_id = tag.id
+    WHERE link.project_id = ? AND tag.user_id = ? ORDER BY tag.name COLLATE NOCASE`)
+        .all(projectId, userId);
+}
+export function tagsForProjects(db, projectIds, userId) {
+    const result = new Map(projectIds.map((projectId) => [projectId, []]));
+    for (let offset = 0; offset < projectIds.length; offset += 500) {
+        const chunk = projectIds.slice(offset, offset + 500);
+        const placeholders = chunk.map(() => "?").join(", ");
+        const rows = db.prepare(`SELECT link.project_id, tag.id, tag.name, tag.color
+      FROM user_project_tag_links link JOIN user_tags tag ON tag.id = link.tag_id
+      WHERE tag.user_id = ? AND link.project_id IN (${placeholders})
+      ORDER BY tag.name COLLATE NOCASE`).all(userId, ...chunk);
+        for (const row of rows)
+            result.get(row.project_id)?.push({ id: row.id, name: row.name, color: row.color });
+    }
+    return result;
+}
+export function commentsSummaryForProjects(db, projectIds) {
+    const result = new Map();
+    if (!projectIds.length)
+        return result;
+    for (let index = 0; index < projectIds.length; index += 100) {
+        const chunk = projectIds.slice(index, index + 100);
+        const placeholders = chunk.map(() => "?").join(", ");
+        const rows = db.prepare(`
+      SELECT project_id,
+        COUNT(*) AS total_count,
+        SUM(CASE WHEN resolved = 0 THEN 1 ELSE 0 END) AS unresolved_count
+      FROM comments
+      WHERE project_id IN (${placeholders})
+      GROUP BY project_id
+    `).all(...chunk);
+        for (const row of rows) {
+            result.set(row.project_id, {
+                totalCount: Number(row.total_count) || 0,
+                unresolvedCount: Number(row.unresolved_count) || 0
+            });
+        }
+    }
+    return result;
+}
+export function commentsSummaryForProject(db, projectId) {
+    const row = db.prepare(`
+    SELECT
+      COUNT(*) AS total_count,
+      SUM(CASE WHEN resolved = 0 THEN 1 ELSE 0 END) AS unresolved_count
+    FROM comments
+    WHERE project_id = ?
+  `).get(projectId);
+    return {
+        totalCount: Number(row?.total_count) || 0,
+        unresolvedCount: Number(row?.unresolved_count) || 0
+    };
+}
+export function projectJson(project, tags = [], commentsSummary) {
+    return {
+        id: project.id,
+        ownerId: project.owner_id,
+        ownerUsername: project.owner_username,
+        ownerDisplayName: project.owner_display_name,
+        lastModifiedBy: project.last_modified_by,
+        lastModifiedUsername: project.last_modified_username,
+        lastModifiedDisplayName: project.last_modified_display_name,
+        name: project.name,
+        mainFile: project.main_file,
+        latexmkrc: project.latexmkrc,
+        engine: project.engine,
+        permission: project.permission,
+        tags,
+        unresolvedCommentCount: commentsSummary?.unresolvedCount ?? 0,
+        commentCount: commentsSummary?.totalCount ?? 0,
+        archived: Boolean(project.archived),
+        createdAt: project.created_at,
+        updatedAt: project.updated_at
+    };
+}
+export function touchProject(db, projectId, userId) {
+    db.prepare("UPDATE projects SET updated_at = ?, last_modified_by = ? WHERE id = ?")
+        .run(now(), userId, projectId);
+}
+export function requireActiveUser(db, user) {
+    const current = db.prepare("SELECT disabled FROM users WHERE id = ?").get(user.id);
+    if (!current || current.disabled) {
+        throw httpError(401, "AUTH_REQUIRED");
+    }
+}
+/**
+ * Authorization must be checked again after a queued mutation acquires its
+ * project lock.  A member can be revoked, or ownership can be transferred,
+ * while the request is waiting behind another filesystem operation.
+ */
+export function requireEditableProject(db, projectId, user) {
+    requireActiveUser(db, user);
+    const project = accessibleProject(db, projectId, user);
+    if (!project)
+        throw httpError(404, "PROJECT_NOT_FOUND");
+    if (!canEdit(project))
+        throw httpError(403, "PROJECT_EDIT_FORBIDDEN");
+    return project;
+}
+/** Owner permission includes an administrator's effective owner access. */
+export function requireProjectOwnerPermission(db, projectId, user) {
+    requireActiveUser(db, user);
+    const project = accessibleProject(db, projectId, user);
+    if (!project)
+        throw httpError(404, "PROJECT_NOT_FOUND");
+    if (project.permission !== "owner") {
+        throw httpError(403, "PROJECT_OWNER_ONLY");
+    }
+    return project;
+}
+/** Operations such as ownership transfer require the actual stored owner. */
+export function requireActualProjectOwner(db, projectId, user) {
+    requireActiveUser(db, user);
+    const project = accessibleProject(db, projectId, user);
+    if (!project)
+        throw httpError(404, "PROJECT_NOT_FOUND");
+    if (project.owner_id !== user.id) {
+        throw httpError(403, "PROJECT_OWNER_ONLY");
+    }
+    return project;
+}
+export function projectTextSnapshot(config, projectId) {
+    const versionedText = (filePath) => /(?:\.tex|\.bib|\.sty|\.cls|\.txt|\.md|latexmkrc)$/i.test(filePath);
+    return new Map(listProjectFiles(config, projectId).filter((entry) => entry.type === "file" && versionedText(entry.path)).map((entry) => {
+        const absolute = resolveSourcePath(config, projectId, entry.path);
+        return [entry.path, fs.statSync(absolute).size <= maxCollaborativeFileBytes(config) ? fs.readFileSync(absolute, "utf8") : ""];
+    }));
+}
+export function reanchorProjectSnapshot(db, projectId, before, after) {
+    for (const filePath of new Set([...before.keys(), ...after.keys()])) {
+        reanchorFileComments(db, projectId, filePath, before.get(filePath) ?? "", after.get(filePath) ?? "");
+    }
+}
+export function movedProjectPath(value, source, destination) {
+    if (value === null)
+        return null;
+    if (value === source)
+        return destination;
+    return value.startsWith(`${source}/`) ? `${destination}${value.slice(source.length)}` : value;
+}
+export function repliesForComment(db, commentId) {
+    const rows = db.prepare(`SELECT reply.*, user.username AS author_username,
+      user.display_name AS author_display_name
+    FROM comment_replies reply LEFT JOIN users user ON user.id = reply.author_id
+    WHERE reply.comment_id = ? ORDER BY reply.created_at`)
+        .all(commentId);
+    return rows.map((reply) => ({
+        id: reply.id,
+        authorId: reply.author_id,
+        authorUsername: reply.author_username,
+        authorDisplayName: reply.author_display_name,
+        content: reply.content,
+        createdAt: reply.created_at,
+        updatedAt: reply.updated_at,
+        editedAt: reply.edited_at
+    }));
+}
+export function commentsForFile(db, config, projectId, filePath) {
+    const absolute = resolveSourcePath(config, projectId, filePath);
+    const source = fs.existsSync(absolute) ? fs.readFileSync(absolute, "utf8") : "";
+    const rows = db.prepare(`SELECT c.*, u.username AS author_username, u.display_name AS author_display_name FROM comments c
+    LEFT JOIN users u ON u.id = c.author_id WHERE c.project_id = ? AND c.file_path = ? ORDER BY c.created_at`)
+        .all(projectId, filePath);
+    if (!rows.length)
+        return [];
+    const replies = db.prepare(`SELECT reply.*, user.username AS author_username, user.display_name AS author_display_name
+    FROM comment_replies reply
+    JOIN comments c ON c.id = reply.comment_id
+    LEFT JOIN users user ON user.id = reply.author_id
+    WHERE c.project_id = ? AND c.file_path = ?
+    ORDER BY reply.created_at`)
+        .all(projectId, filePath);
+    const replyMap = new Map();
+    for (const reply of replies) {
+        const list = replyMap.get(reply.comment_id) ?? [];
+        list.push({
+            id: reply.id,
+            authorId: reply.author_id,
+            authorUsername: reply.author_username,
+            authorDisplayName: reply.author_display_name,
+            content: reply.content,
+            createdAt: reply.created_at,
+            updatedAt: reply.updated_at,
+            editedAt: reply.edited_at
+        });
+        replyMap.set(reply.comment_id, list);
+    }
+    return rows.map((comment) => ({
+        id: comment.id,
+        authorId: comment.author_id,
+        authorUsername: comment.author_username,
+        authorDisplayName: comment.author_display_name,
+        selectedText: comment.selected_text,
+        startOffset: comment.start_offset,
+        endOffset: comment.end_offset,
+        startLine: offsetToLine(source, comment.start_offset),
+        endLine: offsetToLine(source, comment.end_offset),
+        content: comment.content,
+        resolved: Boolean(comment.resolved),
+        orphaned: Boolean(comment.orphaned),
+        createdAt: comment.created_at,
+        updatedAt: comment.updated_at,
+        editedAt: comment.edited_at,
+        replies: replyMap.get(comment.id) ?? []
+    }));
+}