texlite 0.9.0 → 0.9.2

package/dist/server/latexSpellMask.js

@@ -1,16 +1,33 @@
+import { literalEnvironmentNames } from "../shared/latexLiterals.js";
 // This intentionally recognizes only the parts of LaTeX that are clearly not
 // prose. It is a single-pass lexer, not a parser: malformed delimiters remain
 // narrow, so they never hide the rest of a document or cause backtracking.
+const literalEnvironments = new Set(literalEnvironmentNames.map((name) => name.toLowerCase()));
 const nonProseEnvironments = new Set([
-    "math", "displaymath", "equation", "equation*", "align", "align*", "alignat", "alignat*", "gather", "gather*", "multline", "multline*", "flalign", "flalign*",
-    "tikzpicture", "axis", "scope", "pgfonlayer", "pgfpicture",
-    "tabular", "tabularx", "tabulary", "longtable", "array", "matrix", "pmatrix", "bmatrix", "vmatrix",
-    "verbatim", "lstlisting", "minted", "comment", "algorithmic"
+    ...literalEnvironments,
+    // Display and helper math environments commonly used by amsmath/mathtools.
+    "math", "displaymath", "equation", "equation*", "align", "align*", "alignat", "alignat*", "aligned", "alignedat", "gather", "gather*", "gathered", "multline", "multline*", "multlined", "flalign", "flalign*", "split", "cases", "dcases", "rcases", "drcases",
+    "array", "matrix", "pmatrix", "bmatrix", "vmatrix", "smallmatrix", "psmallmatrix", "bsmallmatrix", "vsmallmatrix",
+    // Diagram, table, and literal/code environments. Keep prose containers such
+    // as figure, table, theorem, and caption outside this list.
+    "tikzpicture", "tikzcd", "axis", "scope", "pgfonlayer", "pgfpicture",
+    "tabular", "tabularx", "tabulary", "longtable",
+    "verbatim", "verbatim*", "bverbatim", "bverbatim*", "lverbatim", "lverbatim*", "saveverbatim", "saveverbatim*", "verbatimout",
+    "lstlisting", "minted", "minted*", "filecontents", "filecontents*", "luacode", "luacodestar", "comment", "algorithmic"
 ]);
 const opaqueArgumentCommands = new Set([
     "documentclass", "usepackage", "requirepackage", "includegraphics", "tikzset", "pgfplotsset", "hypersetup", "lstset",
     "label", "hypertarget", "ref", "pageref", "autoref", "nameref", "hyperref", "index", "gls", "glspl",
-    "bibliography", "addbibresource", "input", "include", "url", "path", "setlength", "setcounter", "color", "textcolor", "colorbox", "pagecolor"
+    "bibliography", "addbibresource", "input", "include", "url", "path", "setlength", "setcounter", "color", "textcolor", "colorbox", "pagecolor",
+    // These arguments are code, identifiers, or paths rather than prose.
+    "texttt", "detokenize", "lstinputlisting"
+]);
+/** Number of brace arguments after a macro/environment target. */
+const macroDefinitionArgumentCounts = new Map([
+    ["newcommand", 1], ["renewcommand", 1], ["providecommand", 1], ["declarerobustcommand", 1],
+    ["newenvironment", 2], ["renewenvironment", 2],
+    ["newdocumentcommand", 2], ["renewdocumentcommand", 2], ["providedocumentcommand", 2], ["declaredocumentcommand", 2],
+    ["declaremathoperator", 1], ["declarepaireddelimiter", 2]
 ]);
 function addRange(ranges, from, to) {
     if (to > from)
@@ -26,7 +43,7 @@ function isCommandNameCharacter(character) {
     return (code >= 65 && code <= 90) || (code >= 97 && code <= 122) || (code >= 48 && code <= 57)
         || character === "@" || character === ":" || character === "_";
 }
-function balancedArgument(source, start, open, close) {
+function balancedArgument(source, start, open, close, literal = false) {
     if (source[start] !== open)
         return null;
     let depth = 1;
@@ -35,6 +52,13 @@ function balancedArgument(source, start, open, close) {
             index += 1;
             continue;
         }
+        if (!literal && source[index] === "%") {
+            const lineEnd = source.indexOf("\n", index);
+            if (lineEnd < 0)
+                return null;
+            index = lineEnd;
+            continue;
+        }
         if (source[index] === open)
             depth += 1;
         else if (source[index] === close && --depth === 0)
@@ -48,6 +72,17 @@ function skipWhitespace(source, start) {
         index += 1;
     return index;
 }
+/** Skip whitespace and TeX comments between arguments while masking comments. */
+function skipTrivia(source, start, ranges) {
+    let index = skipWhitespace(source, start);
+    while (source[index] === "%") {
+        const lineEnd = source.indexOf("\n", index);
+        const end = lineEnd < 0 ? source.length : lineEnd;
+        addRange(ranges, index, end);
+        index = skipWhitespace(source, lineEnd < 0 ? source.length : lineEnd + 1);
+    }
+    return index;
+}
 function readCommand(source, start) {
     let end = start + 1;
     if (isCommandNameCharacter(source[end]))
@@ -64,23 +99,103 @@ function isCitationCommand(name) {
     const normalized = name.toLocaleLowerCase("en-US");
     return normalized === "cite" || normalized.startsWith("cite") || normalized.endsWith("cite");
 }
-function masksOpaqueArguments(name) {
+function opaqueArgumentCount(name) {
     const normalized = name.toLocaleLowerCase("en-US");
-    return opaqueArgumentCommands.has(normalized) || isCitationCommand(normalized) || normalized === "definecolor" || normalized === "colorlet" || normalized === "href";
+    if (normalized === "definecolor" || normalized === "colorlet")
+        return 3;
+    if (normalized === "mint" || normalized === "inputminted")
+        return 2;
+    return opaqueArgumentCommands.has(normalized) || isCitationCommand(normalized) || normalized === "href" ? 1 : 0;
 }
-function maskOpaqueArguments(source, start, name, ranges) {
+function maskBraceArguments(source, start, count, ranges) {
     let cursor = start;
-    const normalized = name.toLocaleLowerCase("en-US");
-    const count = normalized === "definecolor" || normalized === "colorlet" ? 3 : 1;
     for (let index = 0; index < count; index += 1) {
         const argument = balancedArgument(source, cursor, "{", "}");
         if (!argument)
             break;
         addRange(ranges, argument.from, argument.to);
-        cursor = skipWhitespace(source, argument.to);
+        cursor = skipTrivia(source, argument.to, ranges);
     }
     return cursor;
 }
+function maskMacroTarget(source, start, ranges) {
+    const bracedTarget = balancedArgument(source, start, "{", "}");
+    if (bracedTarget) {
+        addRange(ranges, bracedTarget.from, bracedTarget.to);
+        return skipTrivia(source, bracedTarget.to, ranges);
+    }
+    if (source[start] === "\\") {
+        const target = readCommand(source, start);
+        addRange(ranges, start, target.end);
+        return skipTrivia(source, target.end, ranges);
+    }
+    return start;
+}
+function maskMacroDefinition(source, start, definitionArgumentCount, ranges) {
+    let cursor = maskMacroTarget(source, start, ranges);
+    if (cursor === start)
+        return cursor;
+    // newcommand-style macros may have both an argument-count option and a
+    // default-argument option. Mask every immediately following option before
+    // their definition bodies, while keeping malformed input narrow.
+    for (;;) {
+        const option = balancedArgument(source, cursor, "[", "]");
+        if (!option)
+            break;
+        addRange(ranges, option.from, option.to);
+        cursor = skipTrivia(source, option.to, ranges);
+    }
+    return maskBraceArguments(source, cursor, definitionArgumentCount, ranges);
+}
+function maskDelimitedCode(source, start, ranges) {
+    const delimiter = source[start];
+    if (!delimiter || isWhitespace(delimiter))
+        return start;
+    // TeX's delimiter-based inline literal commands cannot span a line. If a
+    // user is still typing the closing delimiter, hide only the incomplete
+    // current line rather than accidentally suppressing all later prose until a
+    // matching character happens to occur.
+    for (let cursor = start + 1; cursor < source.length; cursor += 1) {
+        const character = source[cursor];
+        if (character === delimiter) {
+            addRange(ranges, start, cursor + 1);
+            return skipTrivia(source, cursor + 1, ranges);
+        }
+        if (character === "\r" || character === "\n") {
+            addRange(ranges, start, cursor);
+            return cursor;
+        }
+    }
+    addRange(ranges, start, source.length);
+    return source.length;
+}
+function maskDelimitedOrBracedCode(source, start, ranges) {
+    if (source[start] !== "{")
+        return maskDelimitedCode(source, start, ranges);
+    // The brace form is also inline literal code. Preserve nested braces and
+    // escaped characters, but never let an unfinished argument conceal a later
+    // source line from the writing checker.
+    let depth = 1;
+    for (let cursor = start + 1; cursor < source.length; cursor += 1) {
+        const character = source[cursor];
+        if (character === "\\" && source[cursor + 1] !== "\r" && source[cursor + 1] !== "\n") {
+            cursor += 1;
+            continue;
+        }
+        if (character === "\r" || character === "\n") {
+            addRange(ranges, start, cursor);
+            return cursor;
+        }
+        if (character === "{")
+            depth += 1;
+        else if (character === "}" && --depth === 0) {
+            addRange(ranges, start, cursor + 1);
+            return cursor + 1;
+        }
+    }
+    addRange(ranges, start, source.length);
+    return source.length;
+}
 function rawUrlEnd(source, start) {
     const first = source[start];
     if (first !== "h" && first !== "H" && first !== "f" && first !== "F")
@@ -115,6 +230,33 @@ export function ignoredLatexRanges(source) {
     // The same technique keeps unmatched $ / \[ delimiters cheap and local.
     let pendingMath = null;
     for (let index = 0; index < source.length;) {
+        // An open literal environment owns its full body. Do not parse
+        // dollars, comments, or nested commands within it: literal code often
+        // contains all of those. Only look for its matching \end marker.
+        const activeNonProse = nonProseStack.at(-1);
+        if (activeNonProse && literalEnvironments.has(activeNonProse.name)) {
+            if (source[index] === "\\") {
+                const command = readCommand(source, index);
+                if (command.name === "end") {
+                    const cursor = skipTrivia(source, command.end, ranges);
+                    const environment = balancedArgument(source, cursor, "{", "}");
+                    const environmentName = environment
+                        ? source.slice(environment.from + 1, environment.to - 1).trim().toLocaleLowerCase("en-US")
+                        : "";
+                    if (environment && environmentName === activeNonProse.name) {
+                        activeNonProse.range.to = skipTrivia(source, environment.to, ranges);
+                        nonProseStack.pop();
+                        index = activeNonProse.range.to;
+                        continue;
+                    }
+                }
+                index = Math.max(index + 1, command.end);
+            }
+            else {
+                index += 1;
+            }
+            continue;
+        }
         if (pendingMath?.close.startsWith("\\") && source.startsWith(pendingMath.close, index)) {
             pendingMath.range.to = index + pendingMath.close.length;
             index += pendingMath.close.length;
@@ -171,44 +313,41 @@ export function ignoredLatexRanges(source) {
             continue;
         }
         const command = readCommand(source, commandStart);
-        let cursor = skipWhitespace(source, command.end);
-        if (command.name === "verb") {
-            addRange(ranges, commandStart, command.end);
-            const delimiter = source[cursor];
-            if (delimiter && !isWhitespace(delimiter)) {
-                const end = source.indexOf(delimiter, cursor + 1);
-                if (end >= 0) {
-                    addRange(ranges, cursor, end + 1);
-                    cursor = end + 1;
-                }
+        const commandName = command.name.toLocaleLowerCase("en-US");
+        // Reserve the command span before scanning trivia, which may append spans.
+        const commandRange = { from: commandStart, to: command.end };
+        ranges.push(commandRange);
+        let cursor = commandName === "verb" || commandName === "lstinline"
+            ? command.end : skipTrivia(source, command.end, ranges);
+        if (commandName === "verb") {
+            const options = command.name === "Verb" ? balancedArgument(source, cursor, "[", "]") : null;
+            if (options) {
+                addRange(ranges, options.from, options.to);
+                cursor = skipWhitespace(source, options.to);
             }
+            cursor = maskDelimitedOrBracedCode(source, cursor, ranges);
             index = Math.max(command.end, cursor);
             continue;
         }
         if (command.name === "begin" || command.name === "end") {
             const environment = balancedArgument(source, cursor, "{", "}");
             if (!environment) {
-                addRange(ranges, commandStart, command.end);
                 index = command.end;
                 continue;
             }
             const environmentName = source.slice(environment.from + 1, environment.to - 1).trim().toLocaleLowerCase("en-US");
-            cursor = skipWhitespace(source, environment.to);
+            addRange(ranges, environment.from, environment.to);
+            cursor = skipTrivia(source, environment.to, ranges);
             let options = null;
             if (command.name === "begin") {
                 options = balancedArgument(source, cursor, "[", "]");
-                if (options)
-                    cursor = skipWhitespace(source, options.to);
-                if (nonProseEnvironments.has(environmentName)) {
-                    const range = { from: commandStart, to: cursor };
-                    ranges.push(range);
-                    nonProseStack.push({ name: environmentName, range });
+                if (options) {
+                    addRange(ranges, options.from, options.to);
+                    cursor = skipTrivia(source, options.to, ranges);
                 }
-                else {
-                    addRange(ranges, commandStart, command.end);
-                    addRange(ranges, environment.from, environment.to);
-                    if (options)
-                        addRange(ranges, options.from, options.to);
+                if (nonProseEnvironments.has(environmentName)) {
+                    commandRange.to = cursor;
+                    nonProseStack.push({ name: environmentName, range: commandRange });
                 }
             }
             else {
@@ -217,22 +356,36 @@ export function ignoredLatexRanges(source) {
                     nonProseStack.pop();
                     open.range.to = cursor;
                 }
-                else {
-                    addRange(ranges, commandStart, command.end);
-                    addRange(ranges, environment.from, environment.to);
-                }
             }
             index = Math.max(command.end, cursor);
             continue;
         }
-        addRange(ranges, commandStart, command.end);
         const options = balancedArgument(source, cursor, "[", "]");
         if (options) {
             addRange(ranges, options.from, options.to);
-            cursor = skipWhitespace(source, options.to);
+            cursor = commandName === "lstinline" ? skipWhitespace(source, options.to) : skipTrivia(source, options.to, ranges);
+        }
+        if (commandName === "lstinline") {
+            cursor = maskDelimitedOrBracedCode(source, cursor, ranges);
+        }
+        else if (commandName === "mintinline") {
+            const language = balancedArgument(source, cursor, "{", "}");
+            if (language) {
+                addRange(ranges, language.from, language.to);
+                cursor = maskDelimitedOrBracedCode(source, skipWhitespace(source, language.to), ranges);
+            }
+        }
+        else {
+            const macroDefinitionArgumentCount = macroDefinitionArgumentCounts.get(commandName);
+            if (macroDefinitionArgumentCount !== undefined) {
+                cursor = maskMacroDefinition(source, cursor, macroDefinitionArgumentCount, ranges);
+            }
+            else {
+                const opaqueCount = opaqueArgumentCount(commandName);
+                if (opaqueCount > 0)
+                    cursor = maskBraceArguments(source, cursor, opaqueCount, ranges);
+            }
         }
-        if (masksOpaqueArguments(command.name))
-            cursor = maskOpaqueArguments(source, cursor, command.name, ranges);
         index = Math.max(command.end, cursor);
     }
     return mergeOrderedRanges(ranges);

package/dist/server/pm2.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import path from "node:path";
+import { basePathHref, withBasePath } from "../shared/basePath.js";
 import { managedLogPaths } from "./logRotation.js";
 import { defaultConfigPath, packageRootDirectory, packageServerEntry } from "./runtimePaths.js";
 let pm2Client = null;
@@ -197,7 +198,7 @@ export async function processStatus(config) {
         uptimeSeconds: startedAt === null ? null : Math.max(0, Math.floor((Date.now() - startedAt) / 1000)),
         restarts: env?.restart_time ?? 0,
         version: packageVersion(),
-        address: `http://${config.host}:${config.port}`,
+        address: `http://${config.host}:${config.port}${basePathHref(config.basePath)}`,
         dataDir: config.dataDir,
         cwd: env?.pm_cwd ?? packageRootDirectory(),
         outputLog: env?.pm_out_log_path ?? null,
@@ -255,7 +256,7 @@ function probeHost(host) {
 function healthUrl(config) {
     const host = probeHost(config.host);
     const formattedHost = host.includes(":") ? `[${host}]` : host;
-    return `http://${formattedHost}:${config.port}/api/health`;
+    return `http://${formattedHost}:${config.port}${withBasePath(config.basePath, "/api/health")}`;
 }
 function probeService(config, timeoutMs = 1_500) {
     return new Promise((resolve) => {

package/dist/server/projectReferences.js

@@ -0,0 +1,109 @@
+import fs from "node:fs";
+import { listProjectFilesAsync, resolveSourcePath } from "./files.js";
+import { findLatexReferenceDefinitions, lineAndColumnAt } from "../shared/latexReferences.js";
+import { documentSourceOrder, latexDocumentDirectives, resolveProjectReferencePath, uniqueProjectPaths } from "./latexDocumentGraph.js";
+const definitionExtensions = /\.(?:tex|sty|cls)$/i;
+const texExtension = /\.tex$/i;
+const bibExtension = /\.bib$/i;
+const MAX_REFERENCE_KEY_LENGTH = 512;
+export function validReferenceKey(value) {
+    return typeof value === "string"
+        && value.trim().length > 0
+        && value.trim().length <= MAX_REFERENCE_KEY_LENGTH
+        && !/[\u0000-\u001f\u007f]/.test(value);
+}
+/**
+ * Resolve a source-level citation or label target from the project tree.
+ *
+ * A document's own input graph and declared bibliography files are checked
+ * before unrelated files in the project. This keeps a stale \bibitem in an
+ * archive or template from shadowing the bibliography used by the selected
+ * main document.
+ */
+export async function resolveProjectReference(config, projectId, kind, keyInput, options = {}) {
+    // Keep the former preferred-path argument working for internal callers
+    // during the transition to the richer main-document-aware lookup options.
+    const lookup = typeof options === "string" ? { preferredPath: options } : options;
+    const key = keyInput.trim();
+    const files = (await listProjectFilesAsync(config, projectId))
+        .filter((entry) => entry.type === "file" && (definitionExtensions.test(entry.path) || bibExtension.test(entry.path)));
+    const sourceEntries = files.filter((entry) => definitionExtensions.test(entry.path));
+    const bibEntries = files.filter((entry) => bibExtension.test(entry.path));
+    const sourceContents = await readProjectSources(config, projectId, sourceEntries.map((entry) => entry.path));
+    const sourcePaths = [...sourceContents.keys()].sort((left, right) => left.localeCompare(right));
+    const bibPaths = bibEntries.map((entry) => entry.path).sort((left, right) => left.localeCompare(right));
+    const sourceDirectives = new Map();
+    for (const [entryPath, source] of sourceContents)
+        sourceDirectives.set(entryPath, latexDocumentDirectives(source));
+    const preferredPath = sourceContents.has(lookup.preferredPath ?? "") ? lookup.preferredPath ?? "" : "";
+    const mainFile = sourceContents.has(lookup.mainFile ?? "") && texExtension.test(lookup.mainFile ?? "")
+        ? lookup.mainFile ?? ""
+        : "";
+    const documentSources = documentSourceOrder(sourceDirectives, mainFile);
+    const prioritizedSources = uniqueProjectPaths([
+        ...(preferredPath ? [preferredPath] : []),
+        ...documentSources
+    ]);
+    const orderedPaths = kind === "label"
+        ? uniqueProjectPaths([...prioritizedSources, ...sourcePaths])
+        : citationLookupOrder(sourceDirectives, prioritizedSources, bibPaths, sourcePaths);
+    for (const entryPath of orderedPaths) {
+        const source = sourceContents.get(entryPath)
+            ?? await readProjectFile(config, projectId, entryPath);
+        if (source === null)
+            continue;
+        const definition = findLatexReferenceDefinitions(source, kind, bibExtension.test(entryPath))
+            .find((candidate) => candidate.key === key);
+        if (!definition)
+            continue;
+        const location = lineAndColumnAt(source, definition.targetFrom);
+        return { path: entryPath, ...location, kind, source: definition.source };
+    }
+    return null;
+}
+async function readProjectSources(config, projectId, paths) {
+    const contents = new Map();
+    await Promise.all(paths.map(async (entryPath) => {
+        const source = await readProjectFile(config, projectId, entryPath);
+        if (source !== null)
+            contents.set(entryPath, source);
+    }));
+    return contents;
+}
+async function readProjectFile(config, projectId, entryPath) {
+    try {
+        return await fs.promises.readFile(resolveSourcePath(config, projectId, entryPath), "utf8");
+    }
+    catch (error) {
+        // A concurrent file deletion is harmless for navigation. The project
+        // mutation barrier prevents partial writes; simply continue to the next
+        // possible definition when a file has disappeared.
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function citationLookupOrder(sourceDirectives, documentSources, bibPaths, sourcePaths) {
+    // Callers without a selected root retain the conservative legacy behavior:
+    // prefer in-source thebibliography entries before standalone .bib files.
+    if (documentSources.length === 0)
+        return uniqueProjectPaths([...sourcePaths, ...bibPaths]);
+    const bibPathSet = new Set(bibPaths);
+    const declaredBibliographies = [];
+    for (const sourcePath of documentSources) {
+        const directives = sourceDirectives.get(sourcePath);
+        if (!directives)
+            continue;
+        for (const bibliography of directives.bibliographies) {
+            const resolved = resolveProjectReferencePath(bibliography, sourcePath, ".bib", bibPathSet, true);
+            if (resolved)
+                declaredBibliographies.push(resolved);
+        }
+    }
+    return uniqueProjectPaths([
+        ...documentSources,
+        ...declaredBibliographies,
+        ...bibPaths,
+        ...sourcePaths
+    ]);
+}

package/dist/server/routes/auth.js

@@ -1,6 +1,7 @@
 import { publicUser, requireUser } from "../auth.js";
 import { createSessionToken, digestToken, hashPassword, verifyPassword } from "../security.js";
 import { apiError, ValidationError } from "../http.js";
+import { basePathHref } from "../../shared/basePath.js";
 const now = () => new Date().toISOString();
 function text(value, max = 200) {
     if (typeof value !== "string" || !value.trim() || value.length > max) {
@@ -35,8 +36,9 @@ export function registerAuthRoutes(app, context) {
         db.prepare("INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
             .run(session.digest, user.id, expires.toISOString(), createdAt);
         const isSecure = request.protocol === "https" || request.headers["x-forwarded-proto"] === "https";
+        const cookiePath = basePathHref(config.basePath);
         reply.setCookie("texlite_session", session.token, {
-            path: "/",
+            path: cookiePath,
             httpOnly: true,
             sameSite: "strict",
             secure: isSecure,
@@ -48,7 +50,8 @@ export function registerAuthRoutes(app, context) {
         const token = request.cookies.texlite_session;
         if (token)
             db.prepare("DELETE FROM sessions WHERE id = ?").run(digestToken(token));
-        reply.clearCookie("texlite_session", { path: "/" });
+        const cookiePath = basePathHref(config.basePath);
+        reply.clearCookie("texlite_session", { path: cookiePath });
         return { ok: true };
     });
     app.get("/api/me", async (request, reply) => {

package/dist/server/routes/comments.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { requireUser } from "../auth.js";
 import { createSourceAnchor, offsetToLine } from "../anchors.js";
 import { resolveSourcePath, safeRelativePath } from "../files.js";
@@ -106,6 +106,18 @@ export function registerCommentRoutes(app, context) {
             if (!Number.isInteger(body.startOffset) || !Number.isInteger(body.endOffset)) {
                 return apiError(reply, 400, "COMMENT_RANGE_INVALID");
             }
+            // The browser supplies the exact source revision the user selected.
+            // Keep this optional for an already-open client during an upgrade;
+            // current clients never bind an annotation to offsets from a different
+            // revision.
+            if (body.sourceHash !== undefined) {
+                if (typeof body.sourceHash !== "string" || !/^[a-f0-9]{64}$/.test(body.sourceHash)) {
+                    return apiError(reply, 400, "REQUEST_INVALID");
+                }
+                const currentHash = createHash("sha256").update(source, "utf8").digest("hex");
+                if (currentHash !== body.sourceHash)
+                    return apiError(reply, 409, "COMMENT_SOURCE_CHANGED");
+            }
             const anchor = createSourceAnchor(source, Number(body.startOffset), Number(body.endOffset));
             const comment = {
                 id: randomUUID(), filePath,

package/dist/server/routes/compile.js

@@ -85,7 +85,7 @@ export function registerCompileRoutes(app, context) {
                 } : null
             } : null,
             hasPdf: Boolean(pdf),
-            pdfUrl: pdf ? compilePdfUrl(id, mainFile, pdfVersion ?? pdf.version) : null,
+            pdfUrl: pdf ? compilePdfUrl(config, id, mainFile, pdfVersion ?? pdf.version) : null,
             pdfCompiledAt: publishedRun?.finished_at ?? latestSuccess?.finished_at ?? null,
             ...pdfMetadata
         };
@@ -674,7 +674,7 @@ export function registerCompileRoutes(app, context) {
         ].filter(Boolean).join(", "));
         return {
             mainFile, runId: result.runId, ok: result.ok, cancelled: result.cancelled === true, skipped: result.skipped === true, log: result.log, diagnostics: result.diagnostics,
-            pdfUrl: result.ok ? compilePdfUrl(id, mainFile, result.runId) : null,
+            pdfUrl: result.ok ? compilePdfUrl(config, id, mainFile, result.runId) : null,
             pdfCompiledAt: result.ok ? completed?.finished_at ?? null : null,
             ...pdfMetadata,
             timings

package/dist/server/routes/projectFiles.js

@@ -149,14 +149,23 @@ export function registerProjectFileRoutes(app, context) {
         if (!user)
             return;
         const { id } = request.params;
-        if (!accessibleProject(db, id, user))
+        const project = accessibleProject(db, id, user);
+        if (!project)
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const mainFile = compileMainFile(config, id, project.main_file, query.mainFile);
+        if (!mainFile)
+            return apiError(reply, 400, "MAIN_DOCUMENT_INVALID");
         const startedAt = performance.now();
         try {
-            return await projectMutations.runConsistentRead(id, async () => ({ index: await latexCompletions.build(id) }), {
+            return await projectMutations.runConsistentRead(id, async () => ({ index: await latexCompletions.build(id, mainFile) }), {
                 preflight: () => {
-                    if (!accessibleProject(db, id, user))
+                    const current = accessibleProject(db, id, user);
+                    if (!current)
                         throw httpError(404, "PROJECT_NOT_FOUND");
+                    const selected = compileMainFile(config, id, current.main_file, query.mainFile);
+                    if (!selected || selected !== mainFile)
+                        throw httpError(400, "MAIN_DOCUMENT_INVALID");
                 }
             });
         }

package/dist/server/routes/projectHistory.js

@@ -155,7 +155,12 @@ export function registerProjectHistoryRoutes(app, context) {
         if (!project || !canEdit(project))
             return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
         const body = request.body;
-        const label = body.label === null || body.label === "" ? null : text(body.label, 80);
+        if (body?.snapshotHash !== undefined && (typeof body.snapshotHash !== "string" || !/^[a-f0-9]{64}$/.test(body.snapshotHash))) {
+            return apiError(reply, 400, "REQUEST_INVALID");
+        }
+        const snapshotHash = typeof body?.snapshotHash === "string" ? body.snapshotHash : undefined;
+        history.assertSnapshotHash(id, versionId, snapshotHash);
+        const label = body?.label === null || body?.label === "" ? null : text(body?.label, 80);
         const version = history.setLabel(id, versionId, label);
         if (!version)
             return apiError(reply, 404, "HISTORY_VERSION_NOT_FOUND");
@@ -206,8 +211,15 @@ export function registerProjectHistoryRoutes(app, context) {
             return apiError(reply, 403, "PROJECT_EDIT_FORBIDDEN");
         const body = request.body;
         const filePath = typeof body?.path === "string" ? safeRelativePath(body.path) : undefined;
+        // Current clients bind a restore to the snapshot they displayed. Accept
+        // an omitted fingerprint only for already-open clients during an upgrade.
+        if (body?.snapshotHash !== undefined && (typeof body.snapshotHash !== "string" || !/^[a-f0-9]{64}$/.test(body.snapshotHash))) {
+            return apiError(reply, 400, "REQUEST_INVALID");
+        }
+        const snapshotHash = typeof body?.snapshotHash === "string" ? body.snapshotHash : undefined;
         return await projectMutations.runExclusive(id, "history restore", () => {
             const currentProject = requireEditableProject(db, id, user);
+            history.assertSnapshotHash(id, versionId, snapshotHash);
             recordHistory(id, user.id, "checkpoint");
             const before = projectTextSnapshot(config, id);
             const restored = history.restore(id, versionId, filePath);

package/dist/server/routes/projectReferences.js

@@ -0,0 +1,36 @@
+import { requireUser } from "../auth.js";
+import { safeRelativePath } from "../files.js";
+import { apiError, httpError } from "../http.js";
+import { resolveProjectReference, validReferenceKey } from "../projectReferences.js";
+import { accessibleProject } from "../projects.js";
+/** Register Ctrl/Cmd-click source-reference navigation routes. */
+export function registerProjectReferenceRoutes(app, context) {
+    const { config, db, projectMutations } = context;
+    app.get("/api/projects/:id/references/resolve", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project)
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const kind = query.kind === "citation" || query.kind === "label" ? query.kind : null;
+        if (!kind || !validReferenceKey(query.key))
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const key = query.key;
+        const preferredPath = typeof query.path === "string" && query.path ? safeRelativePath(query.path) : "";
+        const requestedMainFile = typeof query.mainFile === "string" && query.mainFile
+            ? safeRelativePath(query.mainFile)
+            : "";
+        const mainFile = /\.tex$/i.test(requestedMainFile) ? requestedMainFile : project.main_file;
+        return await projectMutations.runConsistentRead(id, async () => ({
+            target: await resolveProjectReference(config, id, kind, key, { preferredPath, mainFile })
+        }), {
+            preflight: () => {
+                if (!accessibleProject(db, id, user))
+                    throw httpError(404, "PROJECT_NOT_FOUND");
+            }
+        });
+    });
+}