texlite 0.7.5 → 0.7.6

package/dist/server/i18n.js

@@ -0,0 +1,276 @@
+const enMessages = {
+    API_NOT_FOUND: "The API endpoint does not exist.",
+    ADMIN_REQUIRED: "Administrator permission is required.",
+    ARTIFACT_PREVIEW_UNSUPPORTED: "This artifact cannot be previewed as text. Download it instead.",
+    AUTH_INVALID: "The username or password is incorrect.",
+    AUTH_RATE_LIMITED: "Too many sign-in attempts. Try again in 15 minutes.",
+    AUTH_REQUIRED: "Authentication is required.",
+    CITATION_CONFLICT: "This citation was changed elsewhere. Refresh the library and try again.",
+    CITATION_KEY_EXISTS: "A citation with this key already exists.",
+    CITATION_LIBRARY_PRIVATE: "Citation libraries are private to their owner.",
+    CITATION_NOT_FOUND: "The citation does not exist.",
+    CITATION_TAG_NOT_FOUND: "The citation tag does not exist.",
+    CITATION_TOO_LARGE: "The BibTeX entry is too large.",
+    COMMENT_DELETE_FORBIDDEN: "You can only delete your own comments.",
+    COMMENT_EDIT_FORBIDDEN: "You can only edit your own comments.",
+    COMMENT_FILE_NOT_FOUND: "The file for this comment does not exist.",
+    COMMENT_NOT_FOUND: "The comment does not exist.",
+    COMMENT_RANGE_INVALID: "The comment source range is invalid.",
+    COMMENT_UPDATE_EMPTY: "There is no comment change to save.",
+    COMPILE_ARTIFACT_NOT_FOUND: "The compiled artifact does not exist.",
+    COMPILE_ARTIFACTS_NOT_FOUND: "No compiled artifacts are available yet.",
+    COMPILE_CLEAN_BUSY: "This root document is compiling. Try recovery again after it finishes.",
+    COMPILE_FORBIDDEN: "You do not have permission to compile this project.",
+    COMPILE_SNAPSHOT_BUSY: "The project source is still being saved. Try compiling again shortly.",
+    CURRENT_PASSWORD_INVALID: "The current password is incorrect.",
+    DICTIONARY_EDIT_FORBIDDEN: "You do not have permission to maintain this project's dictionary.",
+    DIRECTORY_NOT_FOUND: "The destination folder does not exist.",
+    FILE_CONTENT_INVALID: "The file content is invalid.",
+    FILE_EXISTS: "A file with this name already exists.",
+    FILE_NOT_FOUND: "The file does not exist.",
+    FILE_TOO_LARGE: "The file is too large to open or upload.",
+    FORMAT_FAILED: "The source could not be formatted.",
+    GIT_ACCOUNT_INVALID: "GitHub did not return a valid account.",
+    GIT_BRANCH_INVALID: "The local Git branch name is invalid.",
+    GIT_COMMAND_FAILED: "The Git command failed. Check the server log for details.",
+    GIT_COMMIT_MESSAGE_INVALID: "Enter a commit message of 300 characters or fewer.",
+    GIT_DETACHED_HEAD: "The repository is in detached HEAD state. Return to the default branch first.",
+    GIT_REPOSITORY_NAME_INVALID: "Enter a GitHub repository name.",
+    GIT_REPOSITORY_NOT_INITIALIZED: "Git is not initialized for this project.",
+    GIT_REPOSITORY_RESPONSE_INVALID: "GitHub did not return a valid repository.",
+    GIT_REVISION_INVALID: "Choose a Git revision to check out.",
+    GIT_TOKEN_INVALID: "Enter a GitHub token.",
+    GIT_TOKEN_NOT_CONFIGURED: "Configure a GitHub token first.",
+    GIT_TOKEN_REJECTED: "GitHub rejected this token. Check its permissions and try again.",
+    GIT_UNAVAILABLE: "Git is not available on this server.",
+    HARPER_UNAVAILABLE: "Harper spelling and grammar checking is temporarily unavailable.",
+    HISTORY_FILE_NOT_FOUND: "The historical file does not exist.",
+    HISTORY_FILE_PREVIEW_UNSUPPORTED: "This historical file cannot be compared as text.",
+    HISTORY_TARGET_CONFLICT: "The historical version cannot be restored to the requested path.",
+    HISTORY_VERSION_NOT_FOUND: "The history version does not exist.",
+    INVALID_PATH: "The file path is invalid.",
+    LAST_ADMIN: "At least one active administrator must remain.",
+    LATEXMKRC_DISABLED: "Project latexmkrc files are disabled by the administrator.",
+    LATEXMKRC_INVALID: "The selected latexmkrc file is invalid.",
+    LATEXMKRC_NOT_FOUND: "The selected latexmkrc file does not exist.",
+    MAIN_DOCUMENT_CHANGED: "The main document changed while compilation was queued. Compile again.",
+    MAIN_DOCUMENT_INVALID: "The selected file is not a valid LaTeX main document.",
+    MAIN_FILE_DELETE_FORBIDDEN: "The main document cannot be deleted.",
+    MAIN_FILE_INVALID: "The main document must be an existing .tex file.",
+    MAIN_FILE_NOT_FOUND: "The selected main document does not exist.",
+    MEMBERS_MANAGE_FORBIDDEN: "Only the project owner can manage members.",
+    MOVE_INTO_SELF: "A folder cannot be moved into itself.",
+    OWNER_MEMBER_FORBIDDEN: "The project owner cannot be added as a member.",
+    PASSWORD_TOO_SHORT: "The password must contain at least {{minLength}} characters.",
+    PATH_EXISTS: "The destination path is already used by a file or folder.",
+    PATH_NOT_FOUND: "The file or folder does not exist.",
+    PDF_NOT_FOUND: "No PDF has been generated yet.",
+    PROJECT_BUSY: "The project is performing a source-file operation. Try again shortly.",
+    PROJECT_CREATE_FORBIDDEN: "You do not have permission to create projects.",
+    PROJECT_DELETE_FORBIDDEN: "Only the project owner can delete this project.",
+    PROJECT_EDIT_FORBIDDEN: "You do not have edit permission for this project.",
+    PROJECT_NOT_FOUND: "The project does not exist or is no longer accessible.",
+    PROJECT_OWNER_ONLY: "Only the project owner can perform this action.",
+    PROJECT_TRANSFER_FORBIDDEN: "Only the current project owner can transfer ownership.",
+    PROJECT_TRANSFER_SELF: "You already own this project.",
+    PROJECT_TRANSFER_TARGET_INVALID: "Choose a new project owner.",
+    REPLY_DELETE_FORBIDDEN: "You can only delete your own replies.",
+    REPLY_EDIT_FORBIDDEN: "You can only edit your own replies.",
+    REPLY_NOT_FOUND: "The reply does not exist.",
+    REQUEST_INVALID: "The request is invalid.",
+    RESERVED_PATH: "This path is reserved by TexLite.",
+    SEARCH_QUERY_INVALID: "The search or replacement text is invalid.",
+    SELF_DELETE_FORBIDDEN: "You cannot delete the currently signed-in administrator.",
+    SERVER_ERROR: "The server could not complete the request.",
+    SOURCE_FILE_NOT_FOUND: "The source file does not exist.",
+    SOURCE_FLUSH_FAILED: "Some source files could not be saved. The project operation was cancelled.",
+    SPELLCHECK_SOURCE_INVALID: "The source to check is invalid.",
+    SPELLCHECK_SOURCE_TOO_LARGE: "The source to check is too large.",
+    SYNCTEX_EXTERNAL_PATH: "SyncTeX returned a source path outside the project.",
+    SYNCTEX_NOT_AVAILABLE: "No SyncTeX data is available. Compile the project again.",
+    SYMLINK_FORBIDDEN: "Symbolic links are not allowed in project sources.",
+    SYNC_PDF_INVALID: "The PDF location is invalid.",
+    SYNC_SOURCE_INVALID: "The source location is invalid.",
+    TAG_NOT_FOUND: "The selected tag does not exist.",
+    UPLOAD_EMPTY: "No file was selected for upload.",
+    USERNAME_INVALID: "The username may contain only letters, numbers, dots, hyphens, or underscores.",
+    USER_NOT_FOUND: "The user does not exist or is disabled.",
+    ZIP_DUPLICATE_ENTRY: "The ZIP archive contains a duplicate filename: {{path}}.",
+    ZIP_ENTRY_READ_FAILED: "A ZIP archive entry could not be read.",
+    ZIP_ENTRY_TOO_LARGE: "The ZIP archive contains a file that exceeds the permitted size.",
+    ZIP_INVALID: "The ZIP archive could not be imported.",
+    ZIP_INVALID_PATH: "The ZIP archive contains an invalid path.",
+    ZIP_MAIN_DOCUMENT_NOT_FOUND: "No LaTeX main document (.tex) was found in the ZIP archive.",
+    ZIP_ONLY: "Choose a ZIP archive.",
+    ZIP_READ_FAILED: "The ZIP archive could not be read.",
+    ZIP_SYMLINK_FORBIDDEN: "The ZIP archive contains a symbolic link.",
+    ZIP_TOO_MANY_ENTRIES: "The ZIP archive contains too many files.",
+    ZIP_TOTAL_TOO_LARGE: "The ZIP archive is too large after extraction.",
+    SYNCTEX_FAILED: "SyncTeX could not locate this position. Compile the project again.",
+    GIT_INVALID: "The Git request is invalid.",
+    GIT_REVISION_NOT_FOUND: "The requested Git revision does not exist.",
+    GIT_CONFLICT: "Git cannot complete this operation in the current repository state.",
+    GIT_NO_CHANGES: "There are no changes to commit.",
+    GIT_NO_COMMIT: "This project has no commit available for this operation.",
+    GIT_OUTPUT_TOO_LARGE: "Git produced too much output to display safely.",
+    GIT_REMOTE_ALREADY_CONFIGURED: "This project already has a remote repository.",
+    GIT_REMOTE_NOT_CONFIGURED: "Create a GitHub repository first.",
+    GIT_TIMEOUT: "The Git operation timed out.",
+    GIT_OPERATION_FAILED: "The Git operation could not be completed."
+};
+const zhMessages = {
+    API_NOT_FOUND: "接口不存在。",
+    ADMIN_REQUIRED: "需要管理员权限。",
+    ARTIFACT_PREVIEW_UNSUPPORTED: "该产物不能作为文本预览，请下载后查看。",
+    AUTH_INVALID: "用户名或密码错误。",
+    AUTH_RATE_LIMITED: "登录尝试过于频繁，请在 15 分钟后重试。",
+    AUTH_REQUIRED: "需要登录。",
+    CITATION_CONFLICT: "该引用已在其他位置发生修改，请刷新引用库后重试。",
+    CITATION_KEY_EXISTS: "引用 key 已经存在。",
+    CITATION_LIBRARY_PRIVATE: "引用库仅对其所有者可见。",
+    CITATION_NOT_FOUND: "引用条目不存在。",
+    CITATION_TAG_NOT_FOUND: "引用标签不存在。",
+    CITATION_TOO_LARGE: "BibTeX 条目过大。",
+    COMMENT_DELETE_FORBIDDEN: "只能删除自己的批注。",
+    COMMENT_EDIT_FORBIDDEN: "只能编辑自己的批注。",
+    COMMENT_FILE_NOT_FOUND: "批注对应的文件不存在。",
+    COMMENT_NOT_FOUND: "批注不存在。",
+    COMMENT_RANGE_INVALID: "批注的源码区间无效。",
+    COMMENT_UPDATE_EMPTY: "没有可保存的批注修改。",
+    COMPILE_ARTIFACT_NOT_FOUND: "编译产物不存在。",
+    COMPILE_ARTIFACTS_NOT_FOUND: "尚无可用的编译产物。",
+    COMPILE_CLEAN_BUSY: "当前主文档正在编译，请完成后再执行故障恢复。",
+    COMPILE_FORBIDDEN: "你没有编译此项目的权限。",
+    COMPILE_SNAPSHOT_BUSY: "项目源码仍在保存，请稍后重新编译。",
+    CURRENT_PASSWORD_INVALID: "当前密码错误。",
+    DICTIONARY_EDIT_FORBIDDEN: "你没有维护本项目词典的权限。",
+    DIRECTORY_NOT_FOUND: "目标文件夹不存在。",
+    FILE_CONTENT_INVALID: "文件内容格式不正确。",
+    FILE_EXISTS: "同名文件已经存在。",
+    FILE_NOT_FOUND: "文件不存在。",
+    FILE_TOO_LARGE: "文件过大，无法打开或上传。",
+    FORMAT_FAILED: "无法格式化源码。",
+    GIT_ACCOUNT_INVALID: "GitHub 没有返回有效的账户信息。",
+    GIT_BRANCH_INVALID: "本地 Git 分支名称无效。",
+    GIT_COMMAND_FAILED: "Git 命令执行失败，请查看服务器日志了解详情。",
+    GIT_COMMIT_MESSAGE_INVALID: "请输入不超过 300 个字符的提交说明。",
+    GIT_DETACHED_HEAD: "当前处于 detached HEAD，请先返回默认分支。",
+    GIT_REPOSITORY_NAME_INVALID: "请输入 GitHub 仓库名称。",
+    GIT_REPOSITORY_NOT_INITIALIZED: "该项目尚未初始化 Git。",
+    GIT_REPOSITORY_RESPONSE_INVALID: "GitHub 没有返回有效的仓库信息。",
+    GIT_REVISION_INVALID: "请选择要 checkout 的 Git 版本。",
+    GIT_TOKEN_INVALID: "请输入 GitHub token。",
+    GIT_TOKEN_NOT_CONFIGURED: "请先配置 GitHub token。",
+    GIT_TOKEN_REJECTED: "GitHub 拒绝了该 token，请检查权限后重试。",
+    GIT_UNAVAILABLE: "服务器未安装 Git。",
+    HARPER_UNAVAILABLE: "Harper 拼写与语法检查暂不可用。",
+    HISTORY_FILE_NOT_FOUND: "历史文件不存在。",
+    HISTORY_FILE_PREVIEW_UNSUPPORTED: "该历史文件不能作为文本比较。",
+    HISTORY_TARGET_CONFLICT: "无法将历史版本恢复到所请求的路径。",
+    HISTORY_VERSION_NOT_FOUND: "历史版本不存在。",
+    INVALID_PATH: "文件路径无效。",
+    LAST_ADMIN: "系统必须保留至少一名可用管理员。",
+    LATEXMKRC_DISABLED: "管理员已禁用项目级 latexmkrc。",
+    LATEXMKRC_INVALID: "所选 latexmkrc 文件无效。",
+    LATEXMKRC_NOT_FOUND: "所选 latexmkrc 文件不存在。",
+    MAIN_DOCUMENT_CHANGED: "编译排队期间主文档已变化，请重新编译。",
+    MAIN_DOCUMENT_INVALID: "所选文件不是有效的 LaTeX 主文档。",
+    MAIN_FILE_DELETE_FORBIDDEN: "不能删除主文档。",
+    MAIN_FILE_INVALID: "主文档必须是存在的 .tex 文件。",
+    MAIN_FILE_NOT_FOUND: "所选主文档不存在。",
+    MEMBERS_MANAGE_FORBIDDEN: "只有项目所有者可以管理成员。",
+    MOVE_INTO_SELF: "不能把文件夹移动到自身内部。",
+    OWNER_MEMBER_FORBIDDEN: "项目所有者不能作为成员添加。",
+    PASSWORD_TOO_SHORT: "密码至少需要 {{minLength}} 个字符。",
+    PATH_EXISTS: "目标路径已被文件或文件夹占用。",
+    PATH_NOT_FOUND: "文件或文件夹不存在。",
+    PDF_NOT_FOUND: "尚未生成 PDF。",
+    PROJECT_BUSY: "项目正在执行源文件操作，请稍后重试。",
+    PROJECT_CREATE_FORBIDDEN: "管理员尚未授予你创建项目的权限。",
+    PROJECT_DELETE_FORBIDDEN: "只有项目所有者可以删除项目。",
+    PROJECT_EDIT_FORBIDDEN: "你没有此项目的编辑权限。",
+    PROJECT_NOT_FOUND: "项目不存在或你已无法访问。",
+    PROJECT_OWNER_ONLY: "只有项目所有者可以执行此操作。",
+    PROJECT_TRANSFER_FORBIDDEN: "只有当前项目所有者可以转让项目。",
+    PROJECT_TRANSFER_SELF: "你已经是该项目的所有者。",
+    PROJECT_TRANSFER_TARGET_INVALID: "请选择新的项目所有者。",
+    REPLY_DELETE_FORBIDDEN: "只能删除自己的回复。",
+    REPLY_EDIT_FORBIDDEN: "只能编辑自己的回复。",
+    REPLY_NOT_FOUND: "回复不存在。",
+    REQUEST_INVALID: "请求格式无效。",
+    RESERVED_PATH: "此路径由 TexLite 保留。",
+    SEARCH_QUERY_INVALID: "搜索或替换内容格式不正确。",
+    SELF_DELETE_FORBIDDEN: "不能删除当前登录的管理员。",
+    SERVER_ERROR: "服务器内部错误",
+    SOURCE_FILE_NOT_FOUND: "源码文件不存在。",
+    SOURCE_FLUSH_FAILED: "部分源码未能保存至磁盘，项目操作已取消。",
+    SPELLCHECK_SOURCE_INVALID: "待检查源码格式不正确。",
+    SPELLCHECK_SOURCE_TOO_LARGE: "待检查源码过大。",
+    SYNCTEX_EXTERNAL_PATH: "SyncTeX 返回了项目外部的源码路径。",
+    SYNCTEX_NOT_AVAILABLE: "尚无可用的 SyncTeX 数据，请重新编译。",
+    SYMLINK_FORBIDDEN: "项目源码中不允许使用符号链接。",
+    SYNC_PDF_INVALID: "PDF 位置无效。",
+    SYNC_SOURCE_INVALID: "源码位置无效。",
+    TAG_NOT_FOUND: "所选标签不存在。",
+    UPLOAD_EMPTY: "没有选择要上传的文件。",
+    USERNAME_INVALID: "用户名只能包含字母、数字、点、横线或下划线。",
+    USER_NOT_FOUND: "用户不存在或已被禁用。",
+    ZIP_DUPLICATE_ENTRY: "ZIP 压缩包包含重复文件名：{{path}}。",
+    ZIP_ENTRY_READ_FAILED: "无法读取 ZIP 压缩包中的文件。",
+    ZIP_ENTRY_TOO_LARGE: "ZIP 压缩包中存在超过限制的文件。",
+    ZIP_INVALID: "无法导入 ZIP 压缩包。",
+    ZIP_INVALID_PATH: "ZIP 压缩包包含无效路径。",
+    ZIP_MAIN_DOCUMENT_NOT_FOUND: "压缩包中没有找到 LaTeX 主文档（.tex）。",
+    ZIP_ONLY: "请选择 ZIP 压缩包。",
+    ZIP_READ_FAILED: "无法读取 ZIP 压缩包。",
+    ZIP_SYMLINK_FORBIDDEN: "ZIP 压缩包不允许包含符号链接。",
+    ZIP_TOO_MANY_ENTRIES: "ZIP 压缩包中的文件数量超过限制。",
+    ZIP_TOTAL_TOO_LARGE: "ZIP 压缩包解压后的总体积超过限制。",
+    SYNCTEX_FAILED: "SyncTeX 无法定位该位置，请重新编译项目。",
+    GIT_INVALID: "Git 请求格式无效。",
+    GIT_REVISION_NOT_FOUND: "所请求的 Git 版本不存在。",
+    GIT_CONFLICT: "当前仓库状态下无法完成 Git 操作。",
+    GIT_NO_CHANGES: "当前没有可以提交的修改。",
+    GIT_NO_COMMIT: "该项目没有可用于此操作的提交。",
+    GIT_OUTPUT_TOO_LARGE: "Git 输出过大，无法安全显示。",
+    GIT_REMOTE_ALREADY_CONFIGURED: "该项目已经配置远程仓库。",
+    GIT_REMOTE_NOT_CONFIGURED: "请先创建 GitHub 仓库。",
+    GIT_TIMEOUT: "Git 操作超时。",
+    GIT_OPERATION_FAILED: "无法完成 Git 操作。"
+};
+const messages = {
+    en: enMessages,
+    zh: zhMessages
+};
+function headerValue(value) {
+    return Array.isArray(value) ? value[0] ?? "" : value ?? "";
+}
+/** Use the explicit app language first, then a standard Accept-Language header. */
+export function serverLocale(headers) {
+    const requested = headerValue(headers?.["x-texlite-language"])
+        || headerValue(headers?.["accept-language"]);
+    if (/\bzh(?:[-_]|\b)/i.test(requested))
+        return "zh";
+    if (/\ben(?:[-_]|\b)/i.test(requested))
+        return "en";
+    // API clients without a language header follow the same fallback as the web
+    // application: English. Browser clients always send Accept-Language.
+    return "en";
+}
+function stringValue(value) {
+    if (Array.isArray(value))
+        return value.map(stringValue).join(", ");
+    if (value === null || value === undefined)
+        return "";
+    return String(value);
+}
+function isServerErrorCode(code) {
+    return Object.hasOwn(enMessages, code);
+}
+/** Translate a stable API error code without making routing code locale-aware. */
+export function serverErrorMessage(locale, code, params = {}) {
+    const template = isServerErrorCode(code)
+        ? messages[locale][code]
+        : (locale === "zh" ? "请求无法完成。" : "The request could not be completed.");
+    return template.replace(/{{\s*([\w.-]+)\s*}}/g, (_match, key) => stringValue(params[key]));
+}

package/dist/server/latexRoot.js

@@ -0,0 +1,78 @@
+import fs from "node:fs";
+import { listProjectFiles, listProjectFilesAsync, resolveSourcePath } from "./files.js";
+import { hasDocumentClass } from "./zip.js";
+const rootDetectionCache = new Map();
+function texFilePaths(files) {
+    return files
+        .filter((entry) => entry.type === "file" && /\.tex$/i.test(entry.path))
+        .map((entry) => entry.path)
+        .sort((left, right) => left.localeCompare(right));
+}
+async function fileHasDocumentClass(config, projectId, filePath) {
+    try {
+        const absolute = resolveSourcePath(config, projectId, filePath);
+        const stat = await fs.promises.stat(absolute);
+        const cached = rootDetectionCache.get(absolute);
+        if (cached && cached.size === stat.size && cached.mtimeMs === stat.mtimeMs && cached.ctimeMs === stat.ctimeMs) {
+            return cached.result;
+        }
+        const result = hasDocumentClass(await fs.promises.readFile(absolute, "utf8"));
+        cacheRootDetection(absolute, stat, result);
+        return result;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+function cacheRootDetection(absolute, stat, result) {
+    if (rootDetectionCache.size >= 2_000 && !rootDetectionCache.has(absolute))
+        rootDetectionCache.clear();
+    rootDetectionCache.set(absolute, { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs, result });
+}
+/**
+ * Return selectable project roots. A single fragmentary .tex file remains a
+ * compatibility fallback for imported projects; once a project contains more
+ * than one .tex file, every candidate must declare \documentclass itself.
+ */
+export async function mainDocumentCandidates(config, projectId, files) {
+    const texFiles = texFilePaths(files ?? await listProjectFilesAsync(config, projectId));
+    const mainFiles = [];
+    for (const filePath of texFiles) {
+        if (await fileHasDocumentClass(config, projectId, filePath))
+            mainFiles.push(filePath);
+    }
+    return {
+        texFiles,
+        mainFiles: mainFiles.length > 0 ? mainFiles : texFiles.length === 1 ? texFiles : []
+    };
+}
+export async function isMainDocumentCandidate(config, projectId, filePath) {
+    if (await fileHasDocumentClass(config, projectId, filePath))
+        return true;
+    const texFiles = texFilePaths(await listProjectFilesAsync(config, projectId));
+    return texFiles.length === 1 && texFiles[0] === filePath;
+}
+export function isMainDocumentCandidateSync(config, projectId, filePath) {
+    try {
+        const absolute = resolveSourcePath(config, projectId, filePath);
+        const stat = fs.statSync(absolute);
+        const cached = rootDetectionCache.get(absolute);
+        if (cached && cached.size === stat.size && cached.mtimeMs === stat.mtimeMs && cached.ctimeMs === stat.ctimeMs) {
+            if (cached.result)
+                return true;
+        }
+        else {
+            const result = hasDocumentClass(fs.readFileSync(absolute, "utf8"));
+            cacheRootDetection(absolute, stat, result);
+            if (result)
+                return true;
+        }
+    }
+    catch {
+        return false;
+    }
+    const texFiles = texFilePaths(listProjectFiles(config, projectId));
+    return texFiles.length === 1 && texFiles[0] === filePath;
+}

package/dist/server/limits.js

@@ -0,0 +1,9 @@
+/**
+ * Hard server-side limits shared by multiple features.
+ *
+ * These are deliberately not configuration settings: they cap memory used by
+ * text previews and individual citation records independently of the project
+ * upload limit.
+ */
+export const MAX_TEXT_PREVIEW_BYTES = 2 * 1024 * 1024;
+export const MAX_CITATION_BIBTEX_BYTES = 512 * 1024;

package/dist/server/projectSearch.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { listProjectFilesAsync, resolveSourcePath } from "./files.js";
+import { httpError } from "./http.js";
 const textExtension = /(?:\.(?:tex|bib|sty|cls|txt|md)|latexmkrc)$/i;
 const maxFiles = 500;
 const maxFileBytes = 3 * 1024 * 1024;
@@ -77,9 +78,7 @@ export async function replaceProject(config, projectId, options, replacement) {
             continue;
         if (options.maxFileBytes !== undefined && Buffer.byteLength(content, "utf8") > options.maxFileBytes) {
             await Promise.allSettled(staged.map((entry) => fs.promises.rm(entry.temporary, { force: true })));
-            throw Object.assign(new Error(`Replacement would exceed the ${Math.floor(options.maxFileBytes / 1024 / 1024)} MB collaborative text limit`), {
-                code: "FILE_TOO_LARGE", statusCode: 413
-            });
+            throw httpError(413, "FILE_TOO_LARGE", { size: Math.floor(options.maxFileBytes / 1024 / 1024) });
         }
         const temporary = `${absolute}.search-${process.pid}-${Date.now()}-${staged.length}.tmp`;
         await fs.promises.writeFile(temporary, content, { encoding: "utf8", mode: 0o600 });
@@ -108,7 +107,7 @@ export async function replaceProject(config, projectId, options, replacement) {
 function searchPattern(options) {
     const query = options.query.trim();
     if (!query || query.length > 500)
-        throw Object.assign(new Error("搜索内容格式不正确"), { code: "SEARCH_QUERY_INVALID", statusCode: 400 });
+        throw httpError(400, "SEARCH_QUERY_INVALID");
     const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const source = options.wholeWord ? `(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])` : escaped;
     return new RegExp(source, `${options.caseSensitive ? "" : "i"}gu`);

package/dist/server/routes/auth.js

@@ -0,0 +1,77 @@
+import { publicUser, requireUser } from "../auth.js";
+import { createSessionToken, digestToken, hashPassword, verifyPassword } from "../security.js";
+import { apiError, ValidationError } from "../http.js";
+const now = () => new Date().toISOString();
+function text(value, max = 200) {
+    if (typeof value !== "string" || !value.trim() || value.length > max) {
+        throw new ValidationError();
+    }
+    return value.trim();
+}
+/** Register login, logout, session introspection, and password routes. */
+export function registerAuthRoutes(app, context) {
+    const { config, db, loginLimiter } = context;
+    app.post("/api/auth/login", async (request, reply) => {
+        const body = request.body;
+        const username = text(body?.username, 64);
+        const ip = request.ip || "127.0.0.1";
+        const rateLimitKey = `${ip}:${username.toLowerCase()}`;
+        if (loginLimiter.isLocked(rateLimitKey)) {
+            return apiError(reply, 429, "AUTH_RATE_LIMITED");
+        }
+        const password = typeof body?.password === "string" ? body.password : "";
+        const user = db.prepare("SELECT * FROM users WHERE username = ? COLLATE NOCASE").get(username);
+        if (!user || user.disabled || !(await verifyPassword(password, user.password_hash))) {
+            const result = loginLimiter.recordFailure(rateLimitKey);
+            if (result.locked) {
+                return apiError(reply, 429, "AUTH_RATE_LIMITED");
+            }
+            return apiError(reply, 401, "AUTH_INVALID");
+        }
+        loginLimiter.reset(rateLimitKey);
+        const session = createSessionToken();
+        const createdAt = now();
+        const expires = new Date(Date.now() + config.sessionDays * 86_400_000);
+        db.prepare("INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
+            .run(session.digest, user.id, expires.toISOString(), createdAt);
+        const isSecure = request.protocol === "https" || request.headers["x-forwarded-proto"] === "https";
+        reply.setCookie("texlite_session", session.token, {
+            path: "/",
+            httpOnly: true,
+            sameSite: "strict",
+            secure: isSecure,
+            expires
+        });
+        return { user: publicUser(user) };
+    });
+    app.post("/api/auth/logout", async (request, reply) => {
+        const token = request.cookies.texlite_session;
+        if (token)
+            db.prepare("DELETE FROM sessions WHERE id = ?").run(digestToken(token));
+        reply.clearCookie("texlite_session", { path: "/" });
+        return { ok: true };
+    });
+    app.get("/api/me", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        return { user: publicUser(user) };
+    });
+    app.put("/api/me/password", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const body = request.body;
+        const currentPassword = typeof body?.currentPassword === "string" ? body.currentPassword : "";
+        const newPassword = typeof body?.newPassword === "string" ? body.newPassword : "";
+        if (!(await verifyPassword(currentPassword, user.password_hash))) {
+            return apiError(reply, 400, "CURRENT_PASSWORD_INVALID");
+        }
+        const passwordHash = await hashPassword(newPassword);
+        db.prepare("UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?")
+            .run(passwordHash, user.id);
+        db.prepare("DELETE FROM sessions WHERE user_id = ? AND id != ?")
+            .run(user.id, digestToken(request.cookies.texlite_session ?? ""));
+        return { ok: true };
+    });
+}