texlite 0.8.4 → 0.9.1

package/dist/server/routes/comments.js

@@ -1,14 +1,75 @@
 import fs from "node:fs";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { requireUser } from "../auth.js";
 import { createSourceAnchor, offsetToLine } from "../anchors.js";
 import { resolveSourcePath, safeRelativePath } from "../files.js";
 import { apiError, httpError } from "../http.js";
 import { accessibleProject } from "../projects.js";
+import { commentMentionForUser, createCommentMentions, listCommentMentions, markAllCommentMentionsRead, markCommentMentionRead, markCommentMentionsResolved, mentionableUsersForProject } from "../commentMentions.js";
 import { commentsForFile, now, repliesForComment, text } from "./projectShared.js";
 /** Register source-anchored comments and reply routes. */
 export function registerCommentRoutes(app, context) {
     const { config, db, collaboration, projectMutations } = context;
+    app.get("/api/projects/:id/mention-candidates", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        // Mentions are intended to notify another participant. Excluding the
+        // author avoids offering a no-op self notification in every composer.
+        return { users: mentionableUsersForProject(db, id, user.id) };
+    });
+    app.get("/api/projects/:id/mentions", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const requestedLimit = Number.parseInt(query.limit ?? "50", 10);
+        return {
+            mentions: listCommentMentions(db, id, user.id, {
+                unreadOnly: query.unread === "1" || query.unread === "true",
+                limit: Number.isFinite(requestedLimit) ? requestedLimit : 50,
+                filePath: typeof query.path === "string" && query.path ? safeRelativePath(query.path) : undefined
+            })
+        };
+    });
+    app.get("/api/projects/:id/mentions/:mentionId", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, mentionId } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const mention = commentMentionForUser(db, mentionId, id, user.id);
+        if (!mention)
+            return apiError(reply, 404, "MENTION_NOT_FOUND");
+        return { mention };
+    });
+    app.post("/api/projects/:id/mentions/:mentionId/read", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id, mentionId } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        if (!commentMentionForUser(db, mentionId, id, user.id))
+            return apiError(reply, 404, "MENTION_NOT_FOUND");
+        return { ok: true, changed: markCommentMentionRead(db, mentionId, user.id, now(), "manual") };
+    });
+    app.post("/api/projects/:id/mentions/read-all", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        return { ok: true, changed: markAllCommentMentionsRead(db, id, user.id, now()) };
+    });
     app.get("/api/projects/:id/comments", async (request, reply) => {
         const user = requireUser(request, reply, db);
         if (!user)
@@ -45,16 +106,34 @@ export function registerCommentRoutes(app, context) {
             if (!Number.isInteger(body.startOffset) || !Number.isInteger(body.endOffset)) {
                 return apiError(reply, 400, "COMMENT_RANGE_INVALID");
             }
+            // The browser supplies the exact source revision the user selected.
+            // Keep this optional for an already-open client during an upgrade;
+            // current clients never bind an annotation to offsets from a different
+            // revision.
+            if (body.sourceHash !== undefined) {
+                if (typeof body.sourceHash !== "string" || !/^[a-f0-9]{64}$/.test(body.sourceHash)) {
+                    return apiError(reply, 400, "REQUEST_INVALID");
+                }
+                const currentHash = createHash("sha256").update(source, "utf8").digest("hex");
+                if (currentHash !== body.sourceHash)
+                    return apiError(reply, 409, "COMMENT_SOURCE_CHANGED");
+            }
             const anchor = createSourceAnchor(source, Number(body.startOffset), Number(body.endOffset));
             const comment = {
                 id: randomUUID(), filePath,
                 content: text(body.content, 5000)
             };
-            db.prepare(`INSERT INTO comments
-        (id, project_id, file_path, author_id, selected_text, start_offset, end_offset,
-         context_before, context_after, orphaned, start_line, end_line, content, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?, ?)`)
-                .run(comment.id, id, comment.filePath, user.id, anchor.selectedText, anchor.startOffset, anchor.endOffset, anchor.contextBefore, anchor.contextAfter, offsetToLine(source, anchor.startOffset), offsetToLine(source, anchor.endOffset), comment.content, createdAt, createdAt);
+            db.transaction(() => {
+                db.prepare(`INSERT INTO comments
+          (id, project_id, file_path, author_id, selected_text, start_offset, end_offset,
+           context_before, context_after, orphaned, start_line, end_line, content, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?, ?)`)
+                    .run(comment.id, id, comment.filePath, user.id, anchor.selectedText, anchor.startOffset, anchor.endOffset, anchor.contextBefore, anchor.contextAfter, offsetToLine(source, anchor.startOffset), offsetToLine(source, anchor.endOffset), comment.content, createdAt, createdAt);
+                createCommentMentions(db, {
+                    projectId: id, commentId: comment.id, authorId: user.id,
+                    content: comment.content, createdAt
+                });
+            })();
             const created = commentsForFile(db, config, id, filePath).find((item) => item.id === comment.id);
             collaboration.signalComments(id);
             return reply.code(201).send({ comment: created });
@@ -76,9 +155,15 @@ export function registerCommentRoutes(app, context) {
         const body = request.body;
         const createdAt = now();
         const replyId = randomUUID();
-        db.prepare(`INSERT INTO comment_replies (id, comment_id, author_id, content, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?)`)
-            .run(replyId, commentId, user.id, text(body.content, 5000), createdAt, createdAt);
+        const content = text(body.content, 5000);
+        db.transaction(() => {
+            db.prepare(`INSERT INTO comment_replies (id, comment_id, author_id, content, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?)`)
+                .run(replyId, commentId, user.id, content, createdAt, createdAt);
+            createCommentMentions(db, {
+                projectId: id, commentId, replyId, authorId: user.id, content, createdAt
+            });
+        })();
         const created = repliesForComment(db, commentId).find((item) => item.id === replyId);
         collaboration.signalComments(id);
         return reply.code(201).send({ reply: created });
@@ -90,27 +175,39 @@ export function registerCommentRoutes(app, context) {
         const { id, commentId } = request.params;
         if (!accessibleProject(db, id, user))
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
-        const comment = db.prepare("SELECT author_id FROM comments WHERE id = ? AND project_id = ?")
+        const comment = db.prepare("SELECT author_id, resolved, content FROM comments WHERE id = ? AND project_id = ?")
             .get(commentId, id);
         if (!comment)
             return apiError(reply, 404, "COMMENT_NOT_FOUND");
         const body = request.body;
         const changedAt = now();
         let changed = false;
+        const content = typeof body.content === "string" ? text(body.content, 5000) : null;
         if (typeof body.content === "string") {
             if (comment.author_id !== user.id)
                 return apiError(reply, 403, "COMMENT_EDIT_FORBIDDEN");
-            db.prepare("UPDATE comments SET content = ?, updated_at = ?, edited_at = ? WHERE id = ?")
-                .run(text(body.content, 5000), changedAt, changedAt, commentId);
             changed = true;
         }
         if (typeof body.resolved === "boolean") {
-            db.prepare("UPDATE comments SET resolved = ?, updated_at = ? WHERE id = ?")
-                .run(body.resolved ? 1 : 0, changedAt, commentId);
             changed = true;
         }
         if (!changed)
             return apiError(reply, 400, "COMMENT_UPDATE_EMPTY");
+        db.transaction(() => {
+            if (content !== null) {
+                db.prepare("UPDATE comments SET content = ?, updated_at = ?, edited_at = ? WHERE id = ?")
+                    .run(content, changedAt, changedAt, commentId);
+                createCommentMentions(db, {
+                    projectId: id, commentId, authorId: user.id, content, previousContent: comment.content, createdAt: changedAt
+                });
+            }
+            if (typeof body.resolved === "boolean") {
+                db.prepare("UPDATE comments SET resolved = ?, updated_at = ? WHERE id = ?")
+                    .run(body.resolved ? 1 : 0, changedAt, commentId);
+                if (body.resolved && !comment.resolved)
+                    markCommentMentionsResolved(db, commentId, changedAt);
+            }
+        })();
         collaboration.signalComments(id);
         return { ok: true };
     });
@@ -138,7 +235,7 @@ export function registerCommentRoutes(app, context) {
         const { id, commentId, replyId } = request.params;
         if (!accessibleProject(db, id, user))
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
-        const commentReply = db.prepare(`SELECT reply.author_id FROM comment_replies reply
+        const commentReply = db.prepare(`SELECT reply.author_id, reply.content FROM comment_replies reply
       JOIN comments comment ON comment.id = reply.comment_id
       WHERE reply.id = ? AND reply.comment_id = ? AND comment.project_id = ?`)
             .get(replyId, commentId, id);
@@ -148,8 +245,14 @@ export function registerCommentRoutes(app, context) {
             return apiError(reply, 403, "REPLY_EDIT_FORBIDDEN");
         const body = request.body;
         const changedAt = now();
-        db.prepare("UPDATE comment_replies SET content = ?, updated_at = ?, edited_at = ? WHERE id = ?")
-            .run(text(body.content, 5000), changedAt, changedAt, replyId);
+        const content = text(body.content, 5000);
+        db.transaction(() => {
+            db.prepare("UPDATE comment_replies SET content = ?, updated_at = ?, edited_at = ? WHERE id = ?")
+                .run(content, changedAt, changedAt, replyId);
+            createCommentMentions(db, {
+                projectId: id, commentId, replyId, authorId: user.id, content, previousContent: commentReply.content, createdAt: changedAt
+            });
+        })();
         const updated = repliesForComment(db, commentId).find((item) => item.id === replyId);
         collaboration.signalComments(id);
         return { reply: updated };

package/dist/server/routes/projectHistory.js

@@ -1,5 +1,8 @@
 import fs from "node:fs";
 import { requireUser } from "../auth.js";
+import { isCollaborativeTextFile, maxCollaborativeFileBytes } from "../collaboration.js";
+import { hashText } from "../editHistory.js";
+import { HISTORY_RETENTION_DELAY_MS } from "../historyRetention.js";
 import { resolveSourcePath, safeRelativePath } from "../files.js";
 import { apiError, httpError } from "../http.js";
 import { MAX_TEXT_PREVIEW_BYTES } from "../limits.js";
@@ -7,7 +10,75 @@ import { accessibleProject, canEdit } from "../projects.js";
 import { commentsSummaryForProject, projectJson, projectTextSnapshot, reanchorProjectSnapshot, requireEditableProject, requireProjectOwnerPermission, tagsForProject, text, touchProject } from "./projectShared.js";
 /** Register retained project version listing, inspection, restoration, and cleanup routes. */
 export function registerProjectHistoryRoutes(app, context) {
-    const { config, db, history, projectMutations, recordHistory } = context;
+    const { config, db, history, editHistory, projectMutations, recordHistory } = context;
+    app.get("/api/projects/:id/edit-history/stats", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (accessibleProject(db, id, user)?.permission !== "owner")
+            return apiError(reply, 403, "PROJECT_OWNER_ONLY");
+        return editHistory.stats(id);
+    });
+    app.delete("/api/projects/:id/edit-history", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (accessibleProject(db, id, user)?.permission !== "owner")
+            return apiError(reply, 403, "PROJECT_OWNER_ONLY");
+        return await projectMutations.runWrite(id, () => {
+            editHistory.clear(id);
+            context.clearPendingEdits(id);
+            return editHistory.stats(id);
+        }, { preflight: () => { requireProjectOwnerPermission(db, id, user); } });
+    });
+    /**
+     * Return only author-attributed edits that can be mapped to the caller's
+     * current selection. Recovery snapshots live under /history and deliberately
+     * remain a separate concern.
+     */
+    app.get("/api/projects/:id/edit-history", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        if (!accessibleProject(db, id, user))
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        if (typeof query.sourceHash !== "string" || !/^[a-f0-9]{64}$/.test(query.sourceHash))
+            return apiError(reply, 400, "REQUEST_INVALID");
+        let filePath;
+        try {
+            filePath = safeRelativePath(query.path ?? "");
+        }
+        catch {
+            return apiError(reply, 400, "REQUEST_INVALID");
+        }
+        if (!isCollaborativeTextFile(filePath))
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const start = parseOffset(query.start);
+        const end = parseOffset(query.end);
+        if (start === null || end === null || start === end)
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const requestedLimit = parseOffset(query.limit);
+        return await projectMutations.runConsistentRead(id, () => {
+            const source = resolveSourcePath(config, id, filePath);
+            if (!fs.existsSync(source) || !fs.statSync(source).isFile())
+                return apiError(reply, 404, "FILE_NOT_FOUND", { path: filePath });
+            if (fs.statSync(source).size > maxCollaborativeFileBytes(config))
+                return apiError(reply, 413, "FILE_TOO_LARGE", { path: filePath });
+            const content = fs.readFileSync(source, "utf8");
+            if (hashText(content) !== query.sourceHash)
+                return apiError(reply, 409, "SELECTION_HISTORY_SOURCE_CHANGED");
+            if (start > end || end > content.length)
+                return apiError(reply, 400, "REQUEST_INVALID");
+            return editHistory.selectionHistory(id, filePath, content, start, end, requestedLimit ?? undefined);
+        }, { preflight: () => {
+                if (!accessibleProject(db, id, user))
+                    throw httpError(404, "PROJECT_NOT_FOUND");
+            } });
+    });
     app.get("/api/projects/:id/history", async (request, reply) => {
         const user = requireUser(request, reply, db);
         if (!user)
@@ -16,10 +87,14 @@ export function registerProjectHistoryRoutes(app, context) {
         const project = accessibleProject(db, id, user);
         if (!project)
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
-        const { limit: limitInput } = request.query;
-        const limit = Number.parseInt(limitInput ?? "100", 10);
+        const query = request.query;
+        if (query.before !== undefined && typeof query.before !== "string")
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const limit = typeof query.limit === "string" ? Number.parseInt(query.limit, 10) : 100;
+        const page = history.listPage(id, Number.isFinite(limit) ? limit : 100, query.before);
         return {
-            versions: history.list(id, Number.isFinite(limit) ? limit : 100),
+            versions: page.versions,
+            nextCursor: page.nextCursor,
             stats: project.permission === "owner" ? history.stats(id) : null
         };
     });
@@ -54,8 +129,10 @@ export function registerProjectHistoryRoutes(app, context) {
             if (historical === null)
                 return apiError(reply, 415, "HISTORY_FILE_PREVIEW_UNSUPPORTED", { path: filePath });
             let comparison = "";
+            const previousVersion = query.against === "__previous__" ? history.previousVersion(id, versionId) : null;
+            const against = query.against === "__previous__" ? previousVersion?.id ?? "__none__" : query.against;
             if (query.against) {
-                comparison = history.readTextFile(id, query.against, filePath) ?? "";
+                comparison = history.readTextFile(id, against, filePath) ?? "";
             }
             else {
                 const current = resolveSourcePath(config, id, filePath);
@@ -63,7 +140,7 @@ export function registerProjectHistoryRoutes(app, context) {
                     comparison = fs.readFileSync(current, "utf8");
                 }
             }
-            return { path: filePath, historical, comparison, against: query.against ?? "current" };
+            return { path: filePath, historical, comparison, against: against ?? "current", previousVersion };
         }, { preflight: () => {
                 if (!accessibleProject(db, id, user))
                     throw httpError(404, "PROJECT_NOT_FOUND");
@@ -78,11 +155,19 @@ export function registerProjectHistoryRoutes(app, context) {
         if (!project || !canEdit(project))
             return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
         const body = request.body;
-        const label = body.label === null || body.label === "" ? null : text(body.label, 80);
+        if (body?.snapshotHash !== undefined && (typeof body.snapshotHash !== "string" || !/^[a-f0-9]{64}$/.test(body.snapshotHash))) {
+            return apiError(reply, 400, "REQUEST_INVALID");
+        }
+        const snapshotHash = typeof body?.snapshotHash === "string" ? body.snapshotHash : undefined;
+        history.assertSnapshotHash(id, versionId, snapshotHash);
+        const label = body?.label === null || body?.label === "" ? null : text(body?.label, 80);
         const version = history.setLabel(id, versionId, label);
         if (!version)
             return apiError(reply, 404, "HISTORY_VERSION_NOT_FOUND");
-        return { version, stats: project.permission === "owner" ? history.stats(id) : null };
+        if (!label)
+            context.scheduleHistoryRetention(id);
+        return { version, retentionScheduled: !label, retentionRefreshAfterMs: !label ? HISTORY_RETENTION_DELAY_MS + 1_000 : 0,
+            stats: project.permission === "owner" ? history.stats(id) : null };
     });
     app.delete("/api/projects/:id/history/:versionId", async (request, reply) => {
         const user = requireUser(request, reply, db);
@@ -126,8 +211,15 @@ export function registerProjectHistoryRoutes(app, context) {
             return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
         const body = request.body;
         const filePath = typeof body?.path === "string" ? safeRelativePath(body.path) : undefined;
+        // Current clients bind a restore to the snapshot they displayed. Accept
+        // an omitted fingerprint only for already-open clients during an upgrade.
+        if (body?.snapshotHash !== undefined && (typeof body.snapshotHash !== "string" || !/^[a-f0-9]{64}$/.test(body.snapshotHash))) {
+            return apiError(reply, 400, "REQUEST_INVALID");
+        }
+        const snapshotHash = typeof body?.snapshotHash === "string" ? body.snapshotHash : undefined;
         return await projectMutations.runExclusive(id, "history restore", () => {
             const currentProject = requireEditableProject(db, id, user);
+            history.assertSnapshotHash(id, versionId, snapshotHash);
             recordHistory(id, user.id, "checkpoint");
             const before = projectTextSnapshot(config, id);
             const restored = history.restore(id, versionId, filePath);
@@ -148,3 +240,9 @@ export function registerProjectHistoryRoutes(app, context) {
             } });
     });
 }
+function parseOffset(value) {
+    if (value === undefined || !/^\d+$/.test(value))
+        return null;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}

package/dist/server/routes/projectShared.js

@@ -83,7 +83,7 @@ export function commentsSummaryForProject(db, projectId) {
         unresolvedCount: Number(row?.unresolved_count) || 0
     };
 }
-export function projectJson(project, tags = [], commentsSummary) {
+export function projectJson(project, tags = [], commentsSummary, unreadMentionCount = 0) {
     return {
         id: project.id,
         ownerId: project.owner_id,
@@ -101,6 +101,7 @@ export function projectJson(project, tags = [], commentsSummary) {
         tags,
         unresolvedCommentCount: commentsSummary?.unresolvedCount ?? 0,
         commentCount: commentsSummary?.totalCount ?? 0,
+        unreadMentionCount,
         archived: Boolean(project.archived),
         createdAt: project.created_at,
         updatedAt: project.updated_at

package/dist/server/routes/projects.js

@@ -10,8 +10,11 @@ import { lucideIconSvg, resolveLucideIconName } from "../lucideIcons.js";
 import { accessibleProject, canEdit } from "../projects.js";
 import { writeProjectArchive } from "../archive.js";
 import { extractProjectZip, ZipValidationError } from "../zip.js";
-import { HarperUnavailableError } from "../harper.js";
+import { HarperLintSupersededError, HarperUnavailableError } from "../harper.js";
+import { digestToken } from "../security.js";
+import { unreadMentionCountsForProjects } from "../commentMentions.js";
 import { commentsSummaryForProject, commentsSummaryForProjects, dictionaryWord, escapeLikePattern, now, projectJson, requireProjectOwnerPermission, tagColors, tagsForProject, tagsForProjects, text } from "./projectShared.js";
+const clientIdPattern = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;
 /** Register project catalog, metadata, archive, dictionary, tag, export, and deletion routes. */
 export function registerProjectCatalogRoutes(app, context) {
     const { config, db, collaboration, projectMutations, latexCompletions, projectOutlines, harper, recordHistory } = context;
@@ -172,8 +175,9 @@ export function registerProjectCatalogRoutes(app, context) {
         const projectIds = projects.map((project) => project.id);
         const projectTags = tagsForProjects(db, projectIds, user.id);
         const commentsSummaries = commentsSummaryForProjects(db, projectIds);
+        const unreadMentionCounts = unreadMentionCountsForProjects(db, projectIds, user.id);
         return {
-            projects: projects.map((project) => projectJson({ ...project, archived: archivedOnly }, projectTags.get(project.id) ?? [], commentsSummaries.get(project.id))),
+            projects: projects.map((project) => projectJson({ ...project, archived: archivedOnly }, projectTags.get(project.id) ?? [], commentsSummaries.get(project.id), unreadMentionCounts.get(project.id) ?? 0)),
             pagination: { page: currentPage, pageSize, total, totalPages }
         };
     });
@@ -360,15 +364,45 @@ export function registerProjectCatalogRoutes(app, context) {
         if (!accessibleProject(db, id, user))
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
         const body = request.body;
-        if (typeof body?.source !== "string" || typeof body.path !== "string")
+        const source = body?.source;
+        const sourcePath = body?.path;
+        const clientId = body?.clientId;
+        const sequence = body?.sequence;
+        if (typeof source !== "string" || typeof sourcePath !== "string") {
             return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
-        if (Buffer.byteLength(body.source, "utf8") > maxCollaborativeFileBytes(config)) {
+        }
+        // Accept already-open clients during a rolling update. Current clients
+        // pair a page-local UUID with a monotonically increasing sequence so a
+        // delayed HTTP request cannot replace a newer queued check.
+        if (clientId !== undefined && (typeof clientId !== "string" || !clientIdPattern.test(clientId))) {
+            return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
+        }
+        if (sequence !== undefined && (typeof sequence !== "number" || !Number.isSafeInteger(sequence) || sequence <= 0 || clientId === undefined)) {
+            return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
+        }
+        if (Buffer.byteLength(source, "utf8") > maxCollaborativeFileBytes(config)) {
             return apiError(reply, 413, "SPELLCHECK_SOURCE_TOO_LARGE");
         }
+        let filePath;
         try {
-            return { lints: await harper.lint(body.source, body.path) };
+            filePath = safeRelativePath(sourcePath);
+        }
+        catch {
+            return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
+        }
+        // A login session is shared by browser tabs. Pair the authenticated user
+        // with the page-local client ID so each new editor can replace only its
+        // own obsolete waiting work. Legacy clients retain their former session
+        // grouping until their page is refreshed.
+        const laneClientId = clientId ?? `legacy:${digestToken(request.cookies.texlite_session ?? "")}`;
+        const lane = `${id}\0${user.id}\0${laneClientId}\0${filePath}`;
+        try {
+            return { lints: await harper.lint(source, filePath, lane, typeof sequence === "number" ? sequence : undefined) };
         }
         catch (error) {
+            if (error instanceof HarperLintSupersededError) {
+                return apiError(reply, 409, "SPELLCHECK_SUPERSEDED");
+            }
             // A missing optional command is an expected fallback condition. Keep it
             // out of normal logs while preserving diagnostics for an actual failure.
             if (error instanceof HarperUnavailableError)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "texlite",
-  "version": "0.8.4",
+  "version": "0.9.1",
   "description": "A lightweight local-first collaborative LaTeX workspace",
   "license": "AGPL-3.0-only",
   "repository": {

package/texlite.config.example.json

@@ -17,9 +17,12 @@
     "rangeThresholdMB": 5
   },
   "history": {
-    "maxVersions": 200,
+    "maxVersions": 0,
     "maxStorageMB": 128
   },
+  "editHistory": {
+    "maxStorageMB": 32
+  },
   "git": {
     "binary": "git",
     "operationTimeoutSeconds": 120,