texlite 0.8.3 → 0.9.0

package/dist/server/config.js

@@ -22,8 +22,9 @@ export const CONFIG_DEFAULTS = {
     maxFileSizeMB: 50,
     pdfLoadingStrategy: "auto",
     pdfRangeThresholdMB: 5,
-    historyMaxVersions: 200,
+    historyMaxVersions: 0,
     historyMaxStorageMB: 128,
+    editHistoryMaxStorageMB: 32,
     git: "git",
     gitOperationTimeoutSeconds: 120,
     githubApiBaseUrl: "https://api.github.com"
@@ -35,8 +36,9 @@ const CONFIG_LIMITS = {
     maxCompileJobs: [1, 32],
     maxFileSizeMB: [1, 2_048],
     pdfRangeThresholdMB: [1, 2_048],
-    historyMaxVersions: [10, 5_000],
+    historyMaxVersions: [0, 50_000],
     historyMaxStorageMB: [16, 102_400],
+    editHistoryMaxStorageMB: [4, 102_400],
     gitOperationTimeoutSeconds: [1, 3_600]
 };
 export function loadConfig(configPathOverride) {
@@ -70,6 +72,7 @@ export function loadConfig(configPathOverride) {
     const pdfRangeThresholdMB = integerSetting("pdf.rangeThresholdMB", process.env.TEXLITE_PDF_RANGE_THRESHOLD_MB, fileConfig.pdf?.rangeThresholdMB, CONFIG_DEFAULTS.pdfRangeThresholdMB, CONFIG_LIMITS.pdfRangeThresholdMB);
     const historyMaxVersions = integerSetting("history.maxVersions", process.env.TEXLITE_HISTORY_MAX_VERSIONS, fileConfig.history?.maxVersions, CONFIG_DEFAULTS.historyMaxVersions, CONFIG_LIMITS.historyMaxVersions);
     const historyMaxStorageMB = integerSetting("history.maxStorageMB", process.env.TEXLITE_HISTORY_MAX_STORAGE_MB, fileConfig.history?.maxStorageMB, CONFIG_DEFAULTS.historyMaxStorageMB, CONFIG_LIMITS.historyMaxStorageMB);
+    const editHistoryMaxStorageMB = integerSetting("editHistory.maxStorageMB", process.env.TEXLITE_EDIT_HISTORY_MAX_STORAGE_MB, fileConfig.editHistory?.maxStorageMB, CONFIG_DEFAULTS.editHistoryMaxStorageMB, CONFIG_LIMITS.editHistoryMaxStorageMB);
     const gitOperationTimeoutSeconds = integerSetting("git.operationTimeoutSeconds", process.env.TEXLITE_GIT_TIMEOUT, fileConfig.git?.operationTimeoutSeconds, CONFIG_DEFAULTS.gitOperationTimeoutSeconds, CONFIG_LIMITS.gitOperationTimeoutSeconds);
     const config = {
         configPath,
@@ -94,6 +97,7 @@ export function loadConfig(configPathOverride) {
         pdfRangeThresholdBytes: pdfRangeThresholdMB * 1024 * 1024,
         historyMaxVersions,
         historyMaxStorageBytes: historyMaxStorageMB * 1024 * 1024,
+        editHistoryMaxStorageBytes: editHistoryMaxStorageMB * 1024 * 1024,
         git: stringSetting("git.binary", process.env.TEXLITE_GIT, fileConfig.git?.binary, CONFIG_DEFAULTS.git, { min: 1, max: 256 }),
         gitOperationTimeoutMs: gitOperationTimeoutSeconds * 1000,
         githubApiBaseUrl: stringSetting("git.githubApiBaseUrl", process.env.TEXLITE_GITHUB_API_URL, fileConfig.git?.githubApiBaseUrl, CONFIG_DEFAULTS.githubApiBaseUrl, { min: 1, max: 2_048 }).replace(/\/+$/, "")
@@ -132,6 +136,7 @@ export function validateConfig(config) {
     validateInteger("pdf.rangeThresholdMB", config.pdfRangeThresholdBytes / (1024 * 1024), CONFIG_LIMITS.pdfRangeThresholdMB);
     validateInteger("history.maxVersions", config.historyMaxVersions, CONFIG_LIMITS.historyMaxVersions);
     validateInteger("history.maxStorageMB", config.historyMaxStorageBytes / (1024 * 1024), CONFIG_LIMITS.historyMaxStorageMB);
+    validateInteger("editHistory.maxStorageMB", config.editHistoryMaxStorageBytes / (1024 * 1024), CONFIG_LIMITS.editHistoryMaxStorageMB);
     validateInteger("git.operationTimeoutSeconds", config.gitOperationTimeoutMs / 1000, CONFIG_LIMITS.gitOperationTimeoutSeconds);
 }
 function isEngine(value) {
@@ -176,6 +181,8 @@ function validateFileConfig(config) {
     const history = optionalSection(config.history, "history");
     optionalInteger(history?.maxVersions, "history.maxVersions", CONFIG_LIMITS.historyMaxVersions);
     optionalInteger(history?.maxStorageMB, "history.maxStorageMB", CONFIG_LIMITS.historyMaxStorageMB);
+    const editHistory = optionalSection(config.editHistory, "editHistory");
+    optionalInteger(editHistory?.maxStorageMB, "editHistory.maxStorageMB", CONFIG_LIMITS.editHistoryMaxStorageMB);
     const latex = optionalSection(config.latex, "latex");
     optionalString(latex?.latexmk, "latex.latexmk", { min: 1, max: 256 });
     if (latex && Object.prototype.hasOwnProperty.call(latex, "defaultEngine") && !isEngine(latex.defaultEngine)) {

package/dist/server/db.js

@@ -4,7 +4,10 @@ export function openDatabase(config) {
     fs.mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
     fs.mkdirSync(config.projectsDir, { recursive: true, mode: 0o700 });
     const db = new Database(config.databasePath, { timeout: 5000 });
-    db.exec("PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 5000;");
+    // WAL allows readers to proceed while writes are committed. NORMAL avoids a
+    // per-transaction WAL fsync: a sudden host failure can lose the most recent
+    // acknowledged transaction, but the database remains consistent.
+    db.exec("PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA busy_timeout = 5000;");
     migrate(db);
     return db;
 }
@@ -140,6 +143,27 @@ function migrate(db) {
     );
     CREATE INDEX IF NOT EXISTS comment_replies_comment_id ON comment_replies(comment_id, created_at);
 
+    -- Mentions are personal notification records, rather than a mutable
+    -- counter on comments or projects.  This makes unread state naturally
+    -- per user and lets resolving one thread clear its existing notifications.
+    CREATE TABLE IF NOT EXISTS comment_mentions (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      comment_id TEXT NOT NULL REFERENCES comments(id) ON DELETE CASCADE,
+      reply_id TEXT REFERENCES comment_replies(id) ON DELETE CASCADE,
+      mentioned_user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      mentioned_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+      read_at TEXT,
+      read_reason TEXT CHECK (read_reason IN ('opened', 'resolved', 'manual')),
+      created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS comment_mentions_receiver_unread
+      ON comment_mentions(mentioned_user_id, project_id, created_at DESC)
+      WHERE read_at IS NULL;
+    CREATE INDEX IF NOT EXISTS comment_mentions_comment_id ON comment_mentions(comment_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS comment_mentions_source_recipient
+      ON comment_mentions(comment_id, IFNULL(reply_id, ''), mentioned_user_id);
+
     CREATE TABLE IF NOT EXISTS compile_runs (
       id TEXT PRIMARY KEY,
       project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
@@ -171,6 +195,37 @@ function migrate(db) {
       updated_at TEXT NOT NULL
     );
 
+    -- Recovery snapshots and collaborative edit records serve different
+    -- purposes. Snapshots are content-addressed restore points; these rows
+    -- retain the ordered, author-attributed text changes that led to the
+    -- current source, so a selected range can show who changed it.
+    CREATE TABLE IF NOT EXISTS project_edit_segments (
+      id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      file_path TEXT NOT NULL,
+      author_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+      kind TEXT NOT NULL CHECK (kind IN ('edit', 'format')),
+      before_hash TEXT NOT NULL,
+      after_hash TEXT NOT NULL,
+      steps_json TEXT NOT NULL,
+      steps_bytes INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS project_edit_segments_project_file_updated
+      ON project_edit_segments(project_id, file_path, updated_at DESC);
+
+    -- Records the newest missing delta per file after retention drops an edit
+    -- segment. Selection history uses it to stop at a known boundary instead
+    -- of presenting an incomplete attribution as a full edit trail.
+    CREATE TABLE IF NOT EXISTS project_edit_history_boundaries (
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      file_path TEXT NOT NULL,
+      after_hash TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (project_id, file_path)
+    );
+
     CREATE TABLE IF NOT EXISTS project_dictionary_words (
       project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
       word TEXT NOT NULL COLLATE NOCASE,
@@ -225,6 +280,13 @@ function migrate(db) {
       updated_at TEXT NOT NULL
     );
   `);
+    const editColumns = db.prepare("PRAGMA table_info(project_edit_segments)").all();
+    if (!editColumns.some((column) => column.name === "steps_bytes")) {
+        db.transaction(() => {
+            db.exec("ALTER TABLE project_edit_segments ADD COLUMN steps_bytes INTEGER NOT NULL DEFAULT 0");
+            db.exec("UPDATE project_edit_segments SET steps_bytes = LENGTH(CAST(steps_json AS BLOB))");
+        })();
+    }
     const projectColumns = db.prepare("PRAGMA table_info(projects)").all();
     if (!projectColumns.some((column) => column.name === "latexmkrc")) {
         db.exec("ALTER TABLE projects ADD COLUMN latexmkrc TEXT");

package/dist/server/editHistory.js

@@ -0,0 +1,411 @@
+import { createHash, randomUUID } from "node:crypto";
+import { safeRelativePath } from "./files.js";
+const MAX_SEGMENTS_PER_PROJECT = 5_000;
+const MAX_SEGMENTS_TO_SCAN = MAX_SEGMENTS_PER_PROJECT;
+const DEFAULT_RESULT_LIMIT = 60;
+const EDIT_SESSION_GAP_MS = 2 * 60 * 1_000;
+const MAX_PASSAGE_PREVIEW_CHARS = 6_000;
+export const DEFAULT_EDIT_HISTORY_MAX_STORAGE_BYTES = 32 * 1024 * 1024;
+/**
+ * Stores author-isolated collaboration edits independently from retained
+ * project snapshots. A segment is a short, contiguous run from one user and
+ * one file; its steps remain ordered so selection mapping remains exact.
+ */
+export class ProjectEditHistoryService {
+    db;
+    maxStorageBytes;
+    constructor(db, maxStorageBytes = DEFAULT_EDIT_HISTORY_MAX_STORAGE_BYTES) {
+        this.db = db;
+        this.maxStorageBytes = normalizeStorageLimit(maxStorageBytes);
+    }
+    record(projectId, inputs) {
+        const normalized = inputs
+            .map(normalizeSegment)
+            .filter((segment) => segment !== null);
+        if (!normalized.length)
+            return;
+        const segments = [];
+        const skipped = [];
+        for (const segment of normalized) {
+            const stepsJson = JSON.stringify(segment.steps);
+            const stepsBytes = Buffer.byteLength(stepsJson, "utf8");
+            // A single oversized burst would make the quota ineffective. Dropping it
+            // creates an explicit, safe history boundary rather than retaining a
+            // partial delta that could misattribute an older selection.
+            if (stepsBytes > this.maxStorageBytes)
+                skipped.push(segment);
+            else
+                segments.push({ segment, stepsJson, stepsBytes });
+        }
+        const insert = this.db.prepare(`INSERT INTO project_edit_segments
+      (id, project_id, file_path, author_id, kind, before_hash, after_hash, steps_json, created_at, updated_at, steps_bytes)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        this.db.transaction(() => {
+            for (const { segment, stepsJson, stepsBytes } of segments) {
+                insert.run(randomUUID(), projectId, segment.filePath, segment.authorId, segment.kind, segment.beforeHash, segment.afterHash, stepsJson, segment.createdAt, segment.updatedAt, stepsBytes);
+            }
+            for (const segment of skipped)
+                this.recordRetentionBoundary(projectId, segment.filePath, segment.afterHash, segment.updatedAt);
+            this.prune(projectId);
+        })();
+    }
+    /** Logical edit payload; shared SQLite pages and indexes are not included. */
+    stats(projectId) {
+        const row = this.db.prepare(`SELECT COUNT(*) AS segmentCount,
+      COALESCE(SUM(steps_bytes), 0) AS payloadBytes
+      FROM project_edit_segments WHERE project_id = ?`).get(projectId);
+        return { ...row, maxStorageBytes: this.maxStorageBytes };
+    }
+    clear(projectId) {
+        this.db.transaction(() => {
+            this.db.prepare("DELETE FROM project_edit_segments WHERE project_id = ?").run(projectId);
+            this.db.prepare("DELETE FROM project_edit_history_boundaries WHERE project_id = ?").run(projectId);
+        })();
+    }
+    /** Apply a changed storage setting to retained records during startup. */
+    enforceRetention(projectId) {
+        this.db.transaction(() => this.prune(projectId))();
+    }
+    /** Keep the newest contiguous suffix within both record and payload limits. */
+    prune(projectId) {
+        const rows = this.db.prepare(`SELECT id, file_path, after_hash, updated_at, steps_bytes
+      FROM project_edit_segments WHERE project_id = ?
+      ORDER BY updated_at DESC, rowid DESC`).all(projectId);
+        let retainedBytes = 0;
+        let retainedCount = 0;
+        let firstDiscard = rows.length;
+        for (let index = 0; index < rows.length; index += 1) {
+            const size = Math.max(0, Number(rows[index].steps_bytes) || 0);
+            if (retainedCount >= MAX_SEGMENTS_PER_PROJECT || retainedBytes + size > this.maxStorageBytes) {
+                firstDiscard = index;
+                break;
+            }
+            retainedBytes += size;
+            retainedCount += 1;
+        }
+        if (firstDiscard === rows.length)
+            return;
+        const remove = this.db.prepare("DELETE FROM project_edit_segments WHERE id = ?");
+        const boundaryFiles = new Set();
+        for (const row of rows.slice(firstDiscard)) {
+            // Rows are newest first. The first discarded row for a source file is
+            // precisely where a backward selection map must stop.
+            if (!boundaryFiles.has(row.file_path)) {
+                boundaryFiles.add(row.file_path);
+                this.recordRetentionBoundary(projectId, row.file_path, row.after_hash, row.updated_at);
+            }
+            remove.run(row.id);
+        }
+    }
+    recordRetentionBoundary(projectId, filePath, afterHash, updatedAt) {
+        this.db.prepare(`INSERT INTO project_edit_history_boundaries (project_id, file_path, after_hash, updated_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(project_id, file_path) DO UPDATE SET after_hash = excluded.after_hash, updated_at = excluded.updated_at`)
+            .run(projectId, filePath, afterHash, updatedAt);
+    }
+    selectionHistory(projectId, filePathInput, currentSource, startInput, endInput, resultLimit = DEFAULT_RESULT_LIMIT) {
+        const filePath = safeRelativePath(filePathInput);
+        const start = clamp(Math.min(startInput, endInput), 0, currentSource.length);
+        const end = clamp(Math.max(startInput, endInput), start, currentSource.length);
+        const rows = this.db.prepare(`SELECT segment.*, user.username AS author_username, user.display_name AS author_name
+      FROM project_edit_segments segment LEFT JOIN users user ON user.id = segment.author_id
+      WHERE segment.project_id = ? AND segment.file_path = ?
+      ORDER BY segment.updated_at DESC, segment.rowid DESC LIMIT ?`)
+            .all(projectId, filePath, MAX_SEGMENTS_TO_SCAN);
+        const entries = [];
+        let passage = {
+            range: { start, end },
+            text: currentSource.slice(start, end),
+            exact: true
+        };
+        let openEntry = null;
+        let expectedHash = hashText(currentSource);
+        let chainComplete = true;
+        let exhaustedRows = true;
+        let baseline = null;
+        const limit = clamp(resultLimit, 1, DEFAULT_RESULT_LIMIT);
+        for (const row of rows) {
+            // A direct file replacement, restoration, import, or retained-history
+            // pruning can intentionally create a gap. Never guess across it: doing
+            // so would attribute someone else's text to the wrong user.
+            if (row.after_hash !== expectedHash) {
+                chainComplete = false;
+                break;
+            }
+            const steps = parseSteps(row.steps_json);
+            if (!steps.length) {
+                chainComplete = false;
+                break;
+            }
+            let relevant = false;
+            let valid = true;
+            const afterPassage = passage;
+            const afterHash = expectedHash;
+            for (let index = steps.length - 1; index >= 0; index -= 1) {
+                const step = steps[index];
+                if (step.afterHash !== expectedHash) {
+                    valid = false;
+                    break;
+                }
+                const beforeRange = mapRangeBackward(passage.range, step.spans);
+                const relevantSpans = step.spans.filter((span) => spanIntersectsRange(span, passage.range, beforeRange));
+                if (relevantSpans.length)
+                    relevant = true;
+                passage = undoPassage(passage, beforeRange, relevantSpans);
+                expectedHash = step.beforeHash;
+            }
+            if (!valid || expectedHash !== row.before_hash) {
+                passage = afterPassage;
+                expectedHash = afterHash;
+                chainComplete = false;
+                break;
+            }
+            if (relevant) {
+                if (openEntry && (canMergeIntoEntry(openEntry, row) || hasSameSelectionContent(openEntry, afterPassage))) {
+                    mergeSelectionHistoryEntry(openEntry, row);
+                }
+                else {
+                    if (openEntry) {
+                        entries.push(stripEntryMetadata(openEntry));
+                        if (entries.length >= limit) {
+                            const preview = previewPassage(afterPassage.exact ? afterPassage.text : null);
+                            baseline = { content: preview.text, contentTruncated: preview.truncated };
+                            exhaustedRows = false;
+                            break;
+                        }
+                    }
+                    openEntry = createSelectionHistoryEntry(row, afterPassage);
+                }
+            }
+        }
+        if (openEntry && entries.length < limit)
+            entries.push(stripEntryMetadata(openEntry));
+        if (chainComplete && exhaustedRows && this.reachedRetentionBoundary(projectId, filePath, expectedHash)) {
+            chainComplete = false;
+        }
+        if (exhaustedRows && entries.length) {
+            const preview = previewPassage(passage.exact ? passage.text : null);
+            baseline = { content: preview.text, contentTruncated: preview.truncated };
+        }
+        return { entries, baseline, hasMore: !exhaustedRows, chainComplete };
+    }
+    reachedRetentionBoundary(projectId, filePath, expectedHash) {
+        const row = this.db.prepare(`SELECT after_hash FROM project_edit_history_boundaries
+      WHERE project_id = ? AND file_path = ?`).get(projectId, filePath);
+        return row?.after_hash === expectedHash;
+    }
+}
+function createSelectionHistoryEntry(row, afterPassage) {
+    const content = previewPassage(afterPassage.exact ? afterPassage.text : null);
+    return {
+        id: row.id,
+        filePath: row.file_path,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        authorKeys: new Set([authorKey(row)]),
+        authors: [authorFromRow(row)],
+        content: content.text,
+        contentTruncated: content.truncated
+    };
+}
+function canMergeIntoEntry(entry, row) {
+    const latest = Date.parse(entry.updatedAt);
+    const current = Date.parse(row.updated_at);
+    return Number.isFinite(latest) && Number.isFinite(current)
+        && latest >= current && latest - current <= EDIT_SESSION_GAP_MS;
+}
+/**
+ * A history row can be relevant because it moved a selection boundary even
+ * when the reconstructed selected text did not change. Do not make users
+ * page through duplicate states: retain one block, but aggregate its time and
+ * contributors. Truncated or inexact text is deliberately never treated as
+ * equal.
+ */
+function hasSameSelectionContent(entry, passage) {
+    const candidate = previewPassage(passage.exact ? passage.text : null);
+    return entry.content !== null && !entry.contentTruncated
+        && candidate.text !== null && !candidate.truncated
+        && entry.content === candidate.text;
+}
+function mergeSelectionHistoryEntry(entry, row) {
+    entry.createdAt = row.created_at;
+    if (!entry.authorKeys.has(authorKey(row))) {
+        entry.authorKeys.add(authorKey(row));
+        entry.authors.push(authorFromRow(row));
+    }
+}
+function stripEntryMetadata(entry) {
+    const { authorKeys: _authorKeys, ...result } = entry;
+    return result;
+}
+function authorFromRow(row) {
+    return row.author_id && row.author_username && row.author_name
+        ? { id: row.author_id, username: row.author_username, name: row.author_name }
+        : { id: null, username: null, name: null };
+}
+function authorKey(row) {
+    return row.author_id ?? "<deleted>";
+}
+/**
+ * Reconstruct just the selected passage while walking a Yjs step backwards.
+ * We avoid rebuilding the full source tree and abandon the exact passage only
+ * when a deliberately truncated stored preview makes reconstruction unsafe.
+ */
+function undoPassage(current, beforeRange, spans) {
+    if (!spans.length)
+        return { ...current, range: beforeRange, exact: current.exact && current.text.length === beforeRange.end - beforeRange.start };
+    let text = current.text;
+    let exact = current.exact;
+    for (const span of [...spans].sort((left, right) => right.afterStart - left.afterStart || right.afterEnd - left.afterEnd)) {
+        if (span.truncated || span.deletedPreview.length !== span.deletedLength || span.insertedPreview.length !== span.insertedLength) {
+            exact = false;
+            continue;
+        }
+        if (span.insertedLength === 0) {
+            const position = clamp(span.afterStart - current.range.start, 0, text.length);
+            text = `${text.slice(0, position)}${span.deletedPreview}${text.slice(position)}`;
+            continue;
+        }
+        const start = clamp(Math.max(span.afterStart, current.range.start) - current.range.start, 0, text.length);
+        const end = clamp(Math.min(span.afterEnd, current.range.end) - current.range.start, start, text.length);
+        text = `${text.slice(0, start)}${span.deletedPreview}${text.slice(end)}`;
+    }
+    if (exact && text.length !== beforeRange.end - beforeRange.start)
+        exact = false;
+    return { range: beforeRange, text, exact };
+}
+function previewPassage(value) {
+    if (value === null)
+        return { text: null, truncated: false };
+    if (value.length <= MAX_PASSAGE_PREVIEW_CHARS)
+        return { text: value, truncated: false };
+    const edge = Math.floor((MAX_PASSAGE_PREVIEW_CHARS - 1) / 2);
+    return { text: `${value.slice(0, edge)}…${value.slice(value.length - edge)}`, truncated: true };
+}
+export function hashText(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+function normalizeSegment(input) {
+    if (!input.authorId || !input.steps.length)
+        return null;
+    let filePath;
+    try {
+        filePath = safeRelativePath(input.filePath);
+    }
+    catch {
+        return null;
+    }
+    const steps = input.steps.map(normalizeStep).filter((step) => step !== null);
+    if (!steps.length)
+        return null;
+    const first = steps[0];
+    const last = steps.at(-1);
+    if (input.beforeHash !== first.beforeHash || input.afterHash !== last.afterHash)
+        return null;
+    for (let index = 1; index < steps.length; index += 1) {
+        if (steps[index - 1].afterHash !== steps[index].beforeHash)
+            return null;
+    }
+    return {
+        filePath,
+        authorId: input.authorId,
+        kind: input.kind === "format" ? "format" : "edit",
+        beforeHash: input.beforeHash,
+        afterHash: input.afterHash,
+        createdAt: safeTimestamp(input.createdAt),
+        updatedAt: safeTimestamp(input.updatedAt),
+        steps
+    };
+}
+function normalizeStep(step) {
+    if (!isHash(step.beforeHash) || !isHash(step.afterHash))
+        return null;
+    const spans = step.spans.map(normalizeSpan).filter((span) => span !== null);
+    return spans.length ? { beforeHash: step.beforeHash, afterHash: step.afterHash, createdAt: safeTimestamp(step.createdAt), spans } : null;
+}
+function normalizeSpan(span) {
+    const numeric = [span.beforeStart, span.beforeEnd, span.afterStart, span.afterEnd, span.deletedLength, span.insertedLength];
+    if (numeric.some((value) => !Number.isInteger(value) || value < 0)
+        || span.beforeEnd < span.beforeStart || span.afterEnd < span.afterStart
+        || span.deletedLength !== span.beforeEnd - span.beforeStart
+        || span.insertedLength !== span.afterEnd - span.afterStart)
+        return null;
+    return {
+        beforeStart: span.beforeStart,
+        beforeEnd: span.beforeEnd,
+        afterStart: span.afterStart,
+        afterEnd: span.afterEnd,
+        deletedLength: span.deletedLength,
+        insertedLength: span.insertedLength,
+        deletedPreview: typeof span.deletedPreview === "string" ? span.deletedPreview.slice(0, 4_096) : "",
+        insertedPreview: typeof span.insertedPreview === "string" ? span.insertedPreview.slice(0, 4_096) : "",
+        truncated: Boolean(span.truncated)
+    };
+}
+function parseSteps(input) {
+    try {
+        const parsed = JSON.parse(input);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.map(normalizeStep).filter((step) => step !== null);
+    }
+    catch {
+        return [];
+    }
+}
+function mapRangeBackward(range, spans) {
+    return {
+        start: mapPositionBackward(range.start, spans, -1),
+        end: mapPositionBackward(range.end, spans, 1)
+    };
+}
+/** Map a position from a step's post-edit document back to its pre-edit document. */
+function mapPositionBackward(position, spans, association) {
+    let delta = 0;
+    for (const span of spans) {
+        // Nonempty replacements have unambiguous endpoints. Association only
+        // chooses a side inside a replacement or at a collapsed deletion.
+        if (span.insertedLength > 0 && position === span.afterStart)
+            return span.beforeStart;
+        if (span.insertedLength > 0 && position === span.afterEnd)
+            return span.beforeEnd;
+        if (position < span.afterStart || (position === span.afterStart && association < 0))
+            return position + delta;
+        if (position > span.afterEnd || (position === span.afterEnd && association > 0)) {
+            delta += span.deletedLength - span.insertedLength;
+            continue;
+        }
+        return span.beforeStart + (association < 0 ? 0 : span.deletedLength);
+    }
+    return position + delta;
+}
+function spanIntersectsRange(span, after, before) {
+    if (rangesIntersect(after.start, after.end, span.afterStart, span.afterEnd))
+        return true;
+    // A deletion has no surviving post-edit range, so the mapped pre-edit
+    // selection is its only reliable signal. For replacements and insertions,
+    // checking the pre-edit range as well would falsely include a change that
+    // merely touches the selection's right boundary.
+    return span.insertedLength === 0 && rangesIntersect(before.start, before.end, span.beforeStart, span.beforeEnd);
+}
+function rangesIntersect(leftStart, leftEnd, rightStart, rightEnd) {
+    if (leftStart === leftEnd)
+        return leftStart >= rightStart && leftStart <= rightEnd;
+    if (rightStart === rightEnd)
+        return rightStart >= leftStart && rightStart <= leftEnd;
+    return leftStart < rightEnd && rightStart < leftEnd;
+}
+function safeTimestamp(value) {
+    return Number.isNaN(Date.parse(value)) ? new Date().toISOString() : value;
+}
+function isHash(value) {
+    return typeof value === "string" && /^[a-f0-9]{64}$/i.test(value);
+}
+function normalizeStorageLimit(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return DEFAULT_EDIT_HISTORY_MAX_STORAGE_BYTES;
+    return Math.floor(value);
+}
+function clamp(value, min, max) {
+    return Math.max(min, Math.min(max, Number.isFinite(value) ? Math.floor(value) : min));
+}

package/dist/server/editHistoryRetry.js

@@ -0,0 +1,90 @@
+const RETRY_DELAY_MS = 5_000;
+const MAX_RETRIES = 3;
+const MAX_PENDING_PROJECT_BYTES = 4 * 1024 * 1024;
+const MAX_PENDING_BYTES = 16 * 1024 * 1024;
+/** Preserve failed durable-source edits in order, without unbounded memory or retries. */
+export class EditHistoryRetry {
+    record;
+    exists;
+    report;
+    pending = new Map();
+    timer;
+    constructor(record, exists, report) {
+        this.record = record;
+        this.exists = exists;
+        this.report = report;
+    }
+    save(id, edits) {
+        if (!edits.length)
+            return;
+        const old = this.pending.get(id);
+        if (!old) {
+            // The queue limits protect only a failed retry buffer. A valid large
+            // edit must always get its normal transactional write attempt first.
+            try {
+                this.record(id, edits);
+            }
+            catch (error) {
+                this.enqueue(id, [...edits], 0, error);
+            }
+            return;
+        }
+        // Preserve the exact order of a previously failed batch. Trying a new
+        // write before it has succeeded would be wasteful during an outage and
+        // makes the retry path harder to reason about.
+        this.enqueue(id, [...old.edits, ...edits], old.attempts);
+    }
+    clear(id) { this.pending.delete(id); }
+    dispose() { clearTimeout(this.timer); this.pending.clear(); }
+    enqueue(id, edits, attempts, error) {
+        let bytes;
+        try {
+            bytes = Buffer.byteLength(JSON.stringify(edits));
+        }
+        catch (serializationError) {
+            this.pending.delete(id);
+            this.report(id, "incomplete", serializationError);
+            return;
+        }
+        const previousBytes = this.pending.get(id)?.bytes ?? 0;
+        const total = [...this.pending.values()].reduce((sum, item) => sum + item.bytes, 0) - previousBytes;
+        if (bytes > MAX_PENDING_PROJECT_BYTES || total + bytes > MAX_PENDING_BYTES) {
+            this.pending.delete(id);
+            this.report(id, "incomplete", new Error("Edit-history retry queue reached its memory limit"));
+            return;
+        }
+        this.pending.set(id, { edits, bytes, attempts });
+        this.report(id, "retrying", error);
+        this.schedule();
+    }
+    schedule() {
+        if (this.timer)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            for (const [id, batch] of this.pending) {
+                if (!this.exists(id)) {
+                    this.pending.delete(id);
+                    this.report(id, "discarded");
+                    continue;
+                }
+                try {
+                    this.record(id, batch.edits);
+                    this.pending.delete(id);
+                    this.report(id, "ok");
+                }
+                catch (error) {
+                    if (++batch.attempts >= MAX_RETRIES) {
+                        this.pending.delete(id);
+                        this.report(id, "incomplete", error);
+                    }
+                    else
+                        this.report(id, "retrying", error);
+                }
+            }
+            if (this.pending.size)
+                this.schedule();
+        }, RETRY_DELAY_MS);
+        this.timer.unref?.();
+    }
+}