texlite 0.9.1 → 0.9.3

package/dist/server/projectOutline.js

@@ -1,45 +1,55 @@
 import fs from "node:fs";
-import path from "node:path";
-import { listProjectFilesAsync, resolveSourcePath, safeRelativePath } from "./files.js";
-const levels = { part: 0, chapter: 0, section: 1, subsection: 2, subsubsection: 3, paragraph: 4 };
-const commandPattern = /\\(part|chapter|section|subsection|subsubsection|paragraph)\*?(?:\s*\[[^\]]*\])?\s*\{|\\(?:input|include|subfile)\s*\{/g;
+import { maskLatexComments } from "../shared/latexLiterals.js";
+import { findLatexSourceIncludes } from "../shared/latexDependencies.js";
+import { forEachLatexCommand, readLatexMandatoryArguments } from "../shared/latexScanner.js";
+import { resolveLatexInclude, toLatexIncludeDirective } from "./latexDocumentGraph.js";
+import { listProjectFiles, listProjectFilesAsync, resolveSourcePath, safeRelativePath } from "./files.js";
+const levels = new Map([
+    ["part", 0],
+    ["chapter", 0],
+    ["section", 1],
+    ["subsection", 2],
+    ["subsubsection", 3],
+    ["paragraph", 4]
+]);
 export function buildProjectOutline(config, projectId, mainFileInput) {
     const mainFile = safeRelativePath(mainFileInput);
+    return buildProjectOutlineFromFiles(config, projectId, mainFile, sourceFilePaths(listProjectFiles(config, projectId)));
+}
+function buildProjectOutlineFromFiles(config, projectId, mainFile, availableFiles) {
     const result = [];
     const visited = new Set();
-    const visit = (filePath) => {
+    const visit = (filePath, importBase) => {
         if (visited.has(filePath) || visited.size >= 200)
             return;
         visited.add(filePath);
         const absolute = resolveSourcePath(config, projectId, filePath);
         if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile() || fs.statSync(absolute).size > 3 * 1024 * 1024)
             return;
-        const content = stripCommentsPreserveLines(fs.readFileSync(absolute, "utf8"));
-        const lineStarts = sourceLineStarts(content);
-        commandPattern.lastIndex = 0;
-        for (const command of content.matchAll(commandPattern)) {
-            const start = (command.index ?? 0) + command[0].length;
-            const argument = balancedArgument(content, start);
-            if (!argument)
-                continue;
-            if (command[1]) {
-                result.push({ path: filePath, line: lineAtOffset(lineStarts, command.index ?? 0), level: levels[command[1]], title: cleanTitle(argument.value) });
+        const content = fs.readFileSync(absolute, "utf8");
+        for (const event of scanOutlineSource(content)) {
+            if (event.type === "heading") {
+                result.push({ path: filePath, line: event.line, level: event.level, title: event.title });
                 continue;
             }
-            const included = resolveIncludedFile(config, projectId, filePath, argument.value);
+            const included = resolveLatexInclude(event.directive, importBase, availableFiles);
             if (included)
-                visit(included);
+                visit(included.path, included.importBase);
         }
     };
-    visit(mainFile);
+    visit(mainFile, "");
     return result;
 }
 /** Async outline builder used by the HTTP path so large projects do not block the event loop. */
 export async function buildProjectOutlineAsync(config, projectId, mainFileInput) {
     const mainFile = safeRelativePath(mainFileInput);
+    const availableFiles = sourceFilePaths(await listProjectFilesAsync(config, projectId));
+    return buildProjectOutlineAsyncFromFiles(config, projectId, mainFile, availableFiles);
+}
+async function buildProjectOutlineAsyncFromFiles(config, projectId, mainFile, availableFiles) {
     const result = [];
     const visited = new Set();
-    const visit = async (filePath) => {
+    const visit = async (filePath, importBase) => {
         if (visited.has(filePath) || visited.size >= 200)
             return;
         visited.add(filePath);
@@ -54,28 +64,22 @@ export async function buildProjectOutlineAsync(config, projectId, mainFileInput)
             return;
         let content;
         try {
-            content = stripCommentsPreserveLines(await fs.promises.readFile(resolveSourcePath(config, projectId, filePath), "utf8"));
+            content = await fs.promises.readFile(resolveSourcePath(config, projectId, filePath), "utf8");
         }
         catch {
             return;
         }
-        const lineStarts = sourceLineStarts(content);
-        const pattern = new RegExp(commandPattern.source, commandPattern.flags);
-        for (const command of content.matchAll(pattern)) {
-            const start = (command.index ?? 0) + command[0].length;
-            const argument = balancedArgument(content, start);
-            if (!argument)
-                continue;
-            if (command[1]) {
-                result.push({ path: filePath, line: lineAtOffset(lineStarts, command.index ?? 0), level: levels[command[1]], title: cleanTitle(argument.value) });
+        for (const event of scanOutlineSource(content)) {
+            if (event.type === "heading") {
+                result.push({ path: filePath, line: event.line, level: event.level, title: event.title });
                 continue;
             }
-            const included = await resolveIncludedFileAsync(config, projectId, filePath, argument.value);
+            const included = resolveLatexInclude(event.directive, importBase, availableFiles);
             if (included)
-                await visit(included);
+                await visit(included.path, included.importBase);
         }
     };
-    await visit(mainFile);
+    await visit(mainFile, "");
     return result;
 }
 /**
@@ -119,7 +123,7 @@ export class ProjectOutlineService {
             cached.touched = Date.now();
             return cached.outline;
         }
-        const outline = await buildProjectOutlineAsync(this.config, projectId, mainFile);
+        const outline = await buildProjectOutlineAsyncFromFiles(this.config, projectId, mainFile, sourceFilePaths(entries));
         this.cache.set(key, { signature, outline, touched: Date.now() });
         if (this.cache.size > 64) {
             const oldest = [...this.cache.entries()].sort((left, right) => left[1].touched - right[1].touched)[0];
@@ -129,65 +133,51 @@ export class ProjectOutlineService {
         return outline;
     }
 }
-function resolveIncludedFile(config, projectId, currentFile, value) {
-    const raw = value.trim();
-    if (!raw || /[\\#]/.test(raw))
-        return null;
-    const withExtension = path.posix.extname(raw) ? raw : `${raw}.tex`;
-    const candidates = [withExtension, path.posix.join(path.posix.dirname(currentFile), withExtension)];
-    for (const candidate of [...new Set(candidates)]) {
-        try {
-            const safe = safeRelativePath(candidate);
-            if (fs.existsSync(resolveSourcePath(config, projectId, safe)))
-                return safe;
-        }
-        catch { /* Ignore includes outside the project. */ }
-    }
-    return null;
+function sourceFilePaths(entries) {
+    return new Set(entries.filter((entry) => entry.type === "file").map((entry) => entry.path));
 }
-async function resolveIncludedFileAsync(config, projectId, currentFile, value) {
-    const raw = value.trim();
-    if (!raw || /[\\#]/.test(raw))
-        return null;
-    const withExtension = path.posix.extname(raw) ? raw : `${raw}.tex`;
-    const candidates = [withExtension, path.posix.join(path.posix.dirname(currentFile), withExtension)];
-    for (const candidate of [...new Set(candidates)]) {
-        try {
-            const safe = safeRelativePath(candidate);
-            const stat = await fs.promises.stat(resolveSourcePath(config, projectId, safe));
-            if (stat.isFile())
-                return safe;
-        }
-        catch { /* Ignore includes outside the project. */ }
-    }
-    return null;
-}
-function balancedArgument(source, start) {
-    let depth = 1;
-    for (let index = start; index < source.length; index += 1) {
-        if (source[index] === "{" && !escapedAt(source, index))
-            depth += 1;
-        if (source[index] === "}" && !escapedAt(source, index))
-            depth -= 1;
-        if (depth === 0)
-            return { value: source.slice(start, index), end: index };
+/**
+ * Read one source file into ordered outline events. The shared scanner keeps
+ * offsets from the original source while skipping comments and literal TeX
+ * forms, so the synchronous and asynchronous builders cannot drift in their
+ * interpretation of headings and arguments.
+ */
+function scanOutlineSource(source) {
+    const lineStarts = sourceLineStarts(source);
+    const events = [];
+    forEachLatexCommand(source, (command) => {
+        const level = levels.get(command.name);
+        if (level === undefined)
+            return;
+        const argument = readLatexMandatoryArguments(source, command.to, 1)[0];
+        if (!argument)
+            return;
+        const value = source.slice(argument.contentFrom, argument.contentTo);
+        events.push({
+            type: "heading",
+            from: command.from,
+            line: lineAtOffset(lineStarts, command.from),
+            level,
+            title: cleanTitle(maskLatexComments(value))
+        });
+    });
+    for (const reference of findLatexSourceIncludes(source)) {
+        const directive = toLatexIncludeDirective(reference);
+        if (!isStaticOutlineInclude(directive))
+            continue;
+        events.push({
+            type: "include",
+            from: reference.from,
+            directive
+        });
     }
-    return null;
-}
-function stripCommentsPreserveLines(source) {
-    return source.split(/(?<=\n)/).map((line) => {
-        for (let index = 0; index < line.length; index += 1) {
-            if (line[index] === "%" && !escapedAt(line, index))
-                return `${line.slice(0, index)}${line.endsWith("\n") ? "\n" : ""}`;
-        }
-        return line;
-    }).join("");
-}
-function escapedAt(source, index) {
-    let slashes = 0;
-    for (let cursor = index - 1; cursor >= 0 && source[cursor] === "\\"; cursor -= 1)
-        slashes += 1;
-    return slashes % 2 === 1;
+    return events.sort((left, right) => {
+        if (left.from !== right.from)
+            return left.from - right.from;
+        if (left.type === right.type)
+            return 0;
+        return left.type === "heading" ? -1 : 1;
+    });
 }
 function sourceLineStarts(source) {
     const starts = [0];
@@ -209,5 +199,27 @@ function lineAtOffset(starts, offset) {
     return Math.max(1, low);
 }
 function cleanTitle(value) {
-    return value.replace(/\\(?:texorpdfstring|MakeUppercase)\s*\{([^{}]*)\}(?:\{[^{}]*\})?/g, "$1").replace(/\\[a-zA-Z@]+\*?/g, "").replace(/[{}]/g, "").trim() || value.trim();
+    const cleaned = value
+        .replace(/\\(?:texorpdfstring|MakeUppercase)\s*\{([^{}]*)\}(?:\{[^{}]*\})?/g, "$1")
+        .replace(/\\[a-zA-Z@]+\*?/g, "")
+        .replace(/[{}]/g, "");
+    return compactOutlineWhitespace(cleaned) || compactOutlineWhitespace(value);
+}
+/**
+ * `maskLatexComments` intentionally keeps source offsets intact, so a long
+ * comment becomes a long run of spaces. Outline titles are display-only: keep
+ * their original line breaks but collapse that offset-preserving padding.
+ */
+function compactOutlineWhitespace(value) {
+    return value.replace(/[^\S\r\n]{2,}/g, " ").trim();
+}
+/**
+ * TeX paths containing a command or parameter marker need macro expansion.
+ * Do not guess their target while building an outline. The generic document
+ * graph deliberately supports backslash-separated paths for other consumers,
+ * while the legacy outline already skipped these dynamic forms.
+ */
+function isStaticOutlineInclude(directive) {
+    return !/[\\#]/.test(directive.path)
+        && (directive.directory === undefined || !/[\\#]/.test(directive.directory));
 }

package/dist/server/projectReferences.js

@@ -0,0 +1,109 @@
+import fs from "node:fs";
+import { listProjectFilesAsync, resolveSourcePath } from "./files.js";
+import { findLatexReferenceDefinitions, lineAndColumnAt } from "../shared/latexReferences.js";
+import { documentSourceOrder, latexDocumentDirectives, resolveProjectReferencePath, uniqueProjectPaths } from "./latexDocumentGraph.js";
+const definitionExtensions = /\.(?:tex|sty|cls)$/i;
+const texExtension = /\.tex$/i;
+const bibExtension = /\.bib$/i;
+const MAX_REFERENCE_KEY_LENGTH = 512;
+export function validReferenceKey(value) {
+    return typeof value === "string"
+        && value.trim().length > 0
+        && value.trim().length <= MAX_REFERENCE_KEY_LENGTH
+        && !/[\u0000-\u001f\u007f]/.test(value);
+}
+/**
+ * Resolve a source-level citation or label target from the project tree.
+ *
+ * A document's own input graph and declared bibliography files are checked
+ * before unrelated files in the project. This keeps a stale \bibitem in an
+ * archive or template from shadowing the bibliography used by the selected
+ * main document.
+ */
+export async function resolveProjectReference(config, projectId, kind, keyInput, options = {}) {
+    // Keep the former preferred-path argument working for internal callers
+    // during the transition to the richer main-document-aware lookup options.
+    const lookup = typeof options === "string" ? { preferredPath: options } : options;
+    const key = keyInput.trim();
+    const files = (await listProjectFilesAsync(config, projectId))
+        .filter((entry) => entry.type === "file" && (definitionExtensions.test(entry.path) || bibExtension.test(entry.path)));
+    const sourceEntries = files.filter((entry) => definitionExtensions.test(entry.path));
+    const bibEntries = files.filter((entry) => bibExtension.test(entry.path));
+    const sourceContents = await readProjectSources(config, projectId, sourceEntries.map((entry) => entry.path));
+    const sourcePaths = [...sourceContents.keys()].sort((left, right) => left.localeCompare(right));
+    const bibPaths = bibEntries.map((entry) => entry.path).sort((left, right) => left.localeCompare(right));
+    const sourceDirectives = new Map();
+    for (const [entryPath, source] of sourceContents)
+        sourceDirectives.set(entryPath, latexDocumentDirectives(source));
+    const preferredPath = sourceContents.has(lookup.preferredPath ?? "") ? lookup.preferredPath ?? "" : "";
+    const mainFile = sourceContents.has(lookup.mainFile ?? "") && texExtension.test(lookup.mainFile ?? "")
+        ? lookup.mainFile ?? ""
+        : "";
+    const documentSources = documentSourceOrder(sourceDirectives, mainFile);
+    const prioritizedSources = uniqueProjectPaths([
+        ...(preferredPath ? [preferredPath] : []),
+        ...documentSources
+    ]);
+    const orderedPaths = kind === "label"
+        ? uniqueProjectPaths([...prioritizedSources, ...sourcePaths])
+        : citationLookupOrder(sourceDirectives, prioritizedSources, bibPaths, sourcePaths);
+    for (const entryPath of orderedPaths) {
+        const source = sourceContents.get(entryPath)
+            ?? await readProjectFile(config, projectId, entryPath);
+        if (source === null)
+            continue;
+        const definition = findLatexReferenceDefinitions(source, kind, bibExtension.test(entryPath))
+            .find((candidate) => candidate.key === key);
+        if (!definition)
+            continue;
+        const location = lineAndColumnAt(source, definition.targetFrom);
+        return { path: entryPath, ...location, kind, source: definition.source };
+    }
+    return null;
+}
+async function readProjectSources(config, projectId, paths) {
+    const contents = new Map();
+    await Promise.all(paths.map(async (entryPath) => {
+        const source = await readProjectFile(config, projectId, entryPath);
+        if (source !== null)
+            contents.set(entryPath, source);
+    }));
+    return contents;
+}
+async function readProjectFile(config, projectId, entryPath) {
+    try {
+        return await fs.promises.readFile(resolveSourcePath(config, projectId, entryPath), "utf8");
+    }
+    catch (error) {
+        // A concurrent file deletion is harmless for navigation. The project
+        // mutation barrier prevents partial writes; simply continue to the next
+        // possible definition when a file has disappeared.
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function citationLookupOrder(sourceDirectives, documentSources, bibPaths, sourcePaths) {
+    // Callers without a selected root retain the conservative legacy behavior:
+    // prefer in-source thebibliography entries before standalone .bib files.
+    if (documentSources.length === 0)
+        return uniqueProjectPaths([...sourcePaths, ...bibPaths]);
+    const bibPathSet = new Set(bibPaths);
+    const declaredBibliographies = [];
+    for (const sourcePath of documentSources) {
+        const directives = sourceDirectives.get(sourcePath);
+        if (!directives)
+            continue;
+        for (const bibliography of directives.bibliographies) {
+            const resolved = resolveProjectReferencePath(bibliography, sourcePath, ".bib", bibPathSet, "project-root-then-source-file");
+            if (resolved)
+                declaredBibliographies.push(resolved);
+        }
+    }
+    return uniqueProjectPaths([
+        ...documentSources,
+        ...declaredBibliographies,
+        ...bibPaths,
+        ...sourcePaths
+    ]);
+}

package/dist/server/routes/auth.js

@@ -1,6 +1,7 @@
 import { publicUser, requireUser } from "../auth.js";
 import { createSessionToken, digestToken, hashPassword, verifyPassword } from "../security.js";
 import { apiError, ValidationError } from "../http.js";
+import { basePathHref } from "../../shared/basePath.js";
 const now = () => new Date().toISOString();
 function text(value, max = 200) {
     if (typeof value !== "string" || !value.trim() || value.length > max) {
@@ -35,8 +36,9 @@ export function registerAuthRoutes(app, context) {
         db.prepare("INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
             .run(session.digest, user.id, expires.toISOString(), createdAt);
         const isSecure = request.protocol === "https" || request.headers["x-forwarded-proto"] === "https";
+        const cookiePath = basePathHref(config.basePath);
         reply.setCookie("texlite_session", session.token, {
-            path: "/",
+            path: cookiePath,
             httpOnly: true,
             sameSite: "strict",
             secure: isSecure,
@@ -48,7 +50,8 @@ export function registerAuthRoutes(app, context) {
         const token = request.cookies.texlite_session;
         if (token)
             db.prepare("DELETE FROM sessions WHERE id = ?").run(digestToken(token));
-        reply.clearCookie("texlite_session", { path: "/" });
+        const cookiePath = basePathHref(config.basePath);
+        reply.clearCookie("texlite_session", { path: cookiePath });
         return { ok: true };
     });
     app.get("/api/me", async (request, reply) => {

package/dist/server/routes/comments.js

@@ -6,7 +6,7 @@ import { resolveSourcePath, safeRelativePath } from "../files.js";
 import { apiError, httpError } from "../http.js";
 import { accessibleProject } from "../projects.js";
 import { commentMentionForUser, createCommentMentions, listCommentMentions, markAllCommentMentionsRead, markCommentMentionRead, markCommentMentionsResolved, mentionableUsersForProject } from "../commentMentions.js";
-import { commentsForFile, now, repliesForComment, text } from "./projectShared.js";
+import { commentsForFile, commentsForProject, now, repliesForComment, text } from "./projectShared.js";
 /** Register source-anchored comments and reply routes. */
 export function registerCommentRoutes(app, context) {
     const { config, db, collaboration, projectMutations } = context;
@@ -75,12 +75,18 @@ export function registerCommentRoutes(app, context) {
         if (!user)
             return;
         const { id } = request.params;
-        const { path: filePath } = request.query;
+        const { path: filePath, scope } = request.query;
         if (!accessibleProject(db, id, user))
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
-        const relative = safeRelativePath(filePath ?? "");
+        if (scope !== undefined && scope !== "project")
+            return apiError(reply, 400, "REQUEST_INVALID");
+        if (scope === "project" && filePath !== undefined)
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const load = scope === "project"
+            ? () => commentsForProject(db, config, id)
+            : () => commentsForFile(db, config, id, safeRelativePath(filePath ?? ""));
         return {
-            comments: await projectMutations.runConsistentRead(id, () => commentsForFile(db, config, id, relative), {
+            comments: await projectMutations.runConsistentRead(id, load, {
                 preflight: () => {
                     if (!accessibleProject(db, id, user))
                         throw httpError(404, "PROJECT_NOT_FOUND");

package/dist/server/routes/compile.js

@@ -85,7 +85,7 @@ export function registerCompileRoutes(app, context) {
                 } : null
             } : null,
             hasPdf: Boolean(pdf),
-            pdfUrl: pdf ? compilePdfUrl(id, mainFile, pdfVersion ?? pdf.version) : null,
+            pdfUrl: pdf ? compilePdfUrl(config, id, mainFile, pdfVersion ?? pdf.version) : null,
             pdfCompiledAt: publishedRun?.finished_at ?? latestSuccess?.finished_at ?? null,
             ...pdfMetadata
         };
@@ -674,7 +674,7 @@ export function registerCompileRoutes(app, context) {
         ].filter(Boolean).join(", "));
         return {
             mainFile, runId: result.runId, ok: result.ok, cancelled: result.cancelled === true, skipped: result.skipped === true, log: result.log, diagnostics: result.diagnostics,
-            pdfUrl: result.ok ? compilePdfUrl(id, mainFile, result.runId) : null,
+            pdfUrl: result.ok ? compilePdfUrl(config, id, mainFile, result.runId) : null,
             pdfCompiledAt: result.ok ? completed?.finished_at ?? null : null,
             ...pdfMetadata,
             timings

package/dist/server/routes/projectFiles.js

@@ -149,14 +149,23 @@ export function registerProjectFileRoutes(app, context) {
         if (!user)
             return;
         const { id } = request.params;
-        if (!accessibleProject(db, id, user))
+        const project = accessibleProject(db, id, user);
+        if (!project)
             return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const mainFile = compileMainFile(config, id, project.main_file, query.mainFile);
+        if (!mainFile)
+            return apiError(reply, 400, "MAIN_DOCUMENT_INVALID");
         const startedAt = performance.now();
         try {
-            return await projectMutations.runConsistentRead(id, async () => ({ index: await latexCompletions.build(id) }), {
+            return await projectMutations.runConsistentRead(id, async () => ({ index: await latexCompletions.build(id, mainFile) }), {
                 preflight: () => {
-                    if (!accessibleProject(db, id, user))
+                    const current = accessibleProject(db, id, user);
+                    if (!current)
                         throw httpError(404, "PROJECT_NOT_FOUND");
+                    const selected = compileMainFile(config, id, current.main_file, query.mainFile);
+                    if (!selected || selected !== mainFile)
+                        throw httpError(400, "MAIN_DOCUMENT_INVALID");
                 }
             });
         }

package/dist/server/routes/projectReferences.js

@@ -0,0 +1,36 @@
+import { requireUser } from "../auth.js";
+import { safeRelativePath } from "../files.js";
+import { apiError, httpError } from "../http.js";
+import { resolveProjectReference, validReferenceKey } from "../projectReferences.js";
+import { accessibleProject } from "../projects.js";
+/** Register Ctrl/Cmd-click source-reference navigation routes. */
+export function registerProjectReferenceRoutes(app, context) {
+    const { config, db, projectMutations } = context;
+    app.get("/api/projects/:id/references/resolve", async (request, reply) => {
+        const user = requireUser(request, reply, db);
+        if (!user)
+            return;
+        const { id } = request.params;
+        const project = accessibleProject(db, id, user);
+        if (!project)
+            return apiError(reply, 404, "PROJECT_NOT_FOUND");
+        const query = request.query;
+        const kind = query.kind === "citation" || query.kind === "label" ? query.kind : null;
+        if (!kind || !validReferenceKey(query.key))
+            return apiError(reply, 400, "REQUEST_INVALID");
+        const key = query.key;
+        const preferredPath = typeof query.path === "string" && query.path ? safeRelativePath(query.path) : "";
+        const requestedMainFile = typeof query.mainFile === "string" && query.mainFile
+            ? safeRelativePath(query.mainFile)
+            : "";
+        const mainFile = /\.tex$/i.test(requestedMainFile) ? requestedMainFile : project.main_file;
+        return await projectMutations.runConsistentRead(id, async () => ({
+            target: await resolveProjectReference(config, id, kind, key, { preferredPath, mainFile })
+        }), {
+            preflight: () => {
+                if (!accessibleProject(db, id, user))
+                    throw httpError(404, "PROJECT_NOT_FOUND");
+            }
+        });
+    });
+}

package/dist/server/routes/projectShared.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import { reanchorFileComments, offsetToLine } from "../anchors.js";
-import { maxCollaborativeFileBytes } from "../collaboration.js";
+import { isCollaborativeTextFile, maxCollaborativeFileBytes } from "../collaboration.js";
 import { listProjectFiles, resolveSourcePath } from "../files.js";
 import { httpError, ValidationError } from "../http.js";
 import { accessibleProject, canEdit } from "../projects.js";
@@ -154,8 +154,7 @@ export function requireActualProjectOwner(db, projectId, user) {
     return project;
 }
 export function projectTextSnapshot(config, projectId) {
-    const versionedText = (filePath) => /(?:\.tex|\.bib|\.sty|\.cls|\.txt|\.md|latexmkrc)$/i.test(filePath);
-    return new Map(listProjectFiles(config, projectId).filter((entry) => entry.type === "file" && versionedText(entry.path)).map((entry) => {
+    return new Map(listProjectFiles(config, projectId).filter((entry) => entry.type === "file" && isCollaborativeTextFile(entry.path)).map((entry) => {
         const absolute = resolveSourcePath(config, projectId, entry.path);
         return [entry.path, fs.statSync(absolute).size <= maxCollaborativeFileBytes(config) ? fs.readFileSync(absolute, "utf8") : ""];
     }));
@@ -189,21 +188,34 @@ export function repliesForComment(db, commentId) {
         editedAt: reply.edited_at
     }));
 }
-export function commentsForFile(db, config, projectId, filePath) {
-    const absolute = resolveSourcePath(config, projectId, filePath);
-    const source = fs.existsSync(absolute) ? fs.readFileSync(absolute, "utf8") : "";
+function commentsForScope(db, config, projectId, filePath) {
+    const hasFileScope = typeof filePath === "string";
+    const fileClause = hasFileScope ? " AND c.file_path = ?" : "";
+    // File-scoped reads retain chronological order for backwards compatibility.
+    // A project review is grouped by file and source position so next/previous
+    // follows the manuscript rather than arbitrary database insertion order.
+    const commentOrder = hasFileScope
+        ? "c.created_at"
+        : "c.file_path COLLATE NOCASE, c.start_line, c.created_at";
     const rows = db.prepare(`SELECT c.*, u.username AS author_username, u.display_name AS author_display_name FROM comments c
-    LEFT JOIN users u ON u.id = c.author_id WHERE c.project_id = ? AND c.file_path = ? ORDER BY c.created_at`)
-        .all(projectId, filePath);
+    LEFT JOIN users u ON u.id = c.author_id WHERE c.project_id = ?${fileClause} ORDER BY ${commentOrder}`)
+        .all(projectId, ...(hasFileScope ? [filePath] : []));
     if (!rows.length)
         return [];
+    const sourceByPath = new Map();
+    for (const row of rows) {
+        if (sourceByPath.has(row.file_path))
+            continue;
+        const absolute = resolveSourcePath(config, projectId, row.file_path);
+        sourceByPath.set(row.file_path, fs.existsSync(absolute) ? fs.readFileSync(absolute, "utf8") : "");
+    }
     const replies = db.prepare(`SELECT reply.*, user.username AS author_username, user.display_name AS author_display_name
     FROM comment_replies reply
     JOIN comments c ON c.id = reply.comment_id
     LEFT JOIN users user ON user.id = reply.author_id
-    WHERE c.project_id = ? AND c.file_path = ?
+    WHERE c.project_id = ?${fileClause}
     ORDER BY reply.created_at`)
-        .all(projectId, filePath);
+        .all(projectId, ...(hasFileScope ? [filePath] : []));
     const replyMap = new Map();
     for (const reply of replies) {
         const list = replyMap.get(reply.comment_id) ?? [];
@@ -221,14 +233,15 @@ export function commentsForFile(db, config, projectId, filePath) {
     }
     return rows.map((comment) => ({
         id: comment.id,
+        filePath: comment.file_path,
         authorId: comment.author_id,
         authorUsername: comment.author_username,
         authorDisplayName: comment.author_display_name,
         selectedText: comment.selected_text,
         startOffset: comment.start_offset,
         endOffset: comment.end_offset,
-        startLine: offsetToLine(source, comment.start_offset),
-        endLine: offsetToLine(source, comment.end_offset),
+        startLine: offsetToLine(sourceByPath.get(comment.file_path) ?? "", comment.start_offset),
+        endLine: offsetToLine(sourceByPath.get(comment.file_path) ?? "", comment.end_offset),
         content: comment.content,
         resolved: Boolean(comment.resolved),
         orphaned: Boolean(comment.orphaned),
@@ -238,3 +251,11 @@ export function commentsForFile(db, config, projectId, filePath) {
         replies: replyMap.get(comment.id) ?? []
     }));
 }
+/** Comments anchored in one source file, used for editor decorations. */
+export function commentsForFile(db, config, projectId, filePath) {
+    return commentsForScope(db, config, projectId, filePath);
+}
+/** All project comments, grouped in manuscript order for the review drawer. */
+export function commentsForProject(db, config, projectId) {
+    return commentsForScope(db, config, projectId);
+}

package/dist/server/routes/projects.js

@@ -12,6 +12,7 @@ import { writeProjectArchive } from "../archive.js";
 import { extractProjectZip, ZipValidationError } from "../zip.js";
 import { HarperLintSupersededError, HarperUnavailableError } from "../harper.js";
 import { digestToken } from "../security.js";
+import { supportsWritingChecks } from "../../shared/writingChecks.js";
 import { unreadMentionCountsForProjects } from "../commentMentions.js";
 import { commentsSummaryForProject, commentsSummaryForProjects, dictionaryWord, escapeLikePattern, now, projectJson, requireProjectOwnerPermission, tagColors, tagsForProject, tagsForProjects, text } from "./projectShared.js";
 const clientIdPattern = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;
@@ -390,6 +391,10 @@ export function registerProjectCatalogRoutes(app, context) {
         catch {
             return apiError(reply, 400, "SPELLCHECK_SOURCE_INVALID");
         }
+        // Bibliography files are structured reference data rather than prose.
+        // Keep this server-side guard for legacy clients and direct API callers.
+        if (!supportsWritingChecks(filePath))
+            return { lints: [] };
         // A login session is shared by browser tabs. Pair the authenticated user
         // with the page-local client ID so each new editor can replace only its
         // own obsolete waiting work. Legacy clients retain their former session

package/dist/server/routes/system.js

@@ -8,6 +8,7 @@ export function registerSystemRoutes(app, context) {
     app.get("/api/config", async () => ({
         siteName: config.siteName,
         adminEmail: config.adminEmail,
+        basePath: config.basePath,
         minPasswordLength: MIN_PASSWORD_LENGTH,
         maxCitationBibtexBytes: MAX_CITATION_BIBTEX_BYTES,
         maxUploadSizeMB: Math.floor(config.maxUploadBytes / 1024 / 1024),