@ai0x0/utils 0.0.50 → 0.1.0

package/lib/backend/scope.d.ts

@@ -0,0 +1,27 @@
+import { SQL } from "drizzle-orm";
+import { BaseTable } from "./types.js";
+/** 归属值：单个（等值匹配）或多个（IN）。 */
+export type ScopeValue = string | string[];
+/** 解析完的作用域：限定哪一列、限定成什么值。 */
+export interface ScopeCondition {
+    /** 承载归属的列名，如 "creatorId" / "ownerId"。 */
+    column: string;
+    value: ScopeValue;
+}
+/**
+ * 明确表示「这条查询不做行级隔离」。
+ *
+ * 用一个可辨识的值而不是 undefined：调用方漏传参数时 TypeScript 会报错，而不是悄悄
+ * 退化成「查全表」。凡是接受作用域的地方都必须收到 ScopeCondition 或 NO_SCOPE 之一。
+ */
+export declare const NO_SCOPE: null;
+export type ScopeArg = ScopeCondition | typeof NO_SCOPE;
+/** 空作用域值（undefined / 空串 / 空数组）—— 拿到它一律视为「解析失败」，不是「不筛」。 */
+export declare function isEmptyScopeValue(value: ScopeValue | undefined): value is undefined;
+/**
+ * 作用域 → drizzle 条件。NO_SCOPE 返回 undefined（调用方据此不加条件）。
+ *
+ * 列不在表上直接抛：这多半是配错了列名，而一个「配错了就不加条件」的实现等于把配置错误
+ * 变成越权漏洞。
+ */
+export declare function scopeCondition(table: BaseTable, scope: ScopeArg): SQL | undefined;

package/lib/backend/scope.js

@@ -0,0 +1,57 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/backend/scope.ts
+var scope_exports = {};
+__export(scope_exports, {
+  NO_SCOPE: () => NO_SCOPE,
+  isEmptyScopeValue: () => isEmptyScopeValue,
+  scopeCondition: () => scopeCondition
+});
+module.exports = __toCommonJS(scope_exports);
+var import_drizzle_orm = require("drizzle-orm");
+var NO_SCOPE = null;
+function isEmptyScopeValue(value) {
+  if (value === void 0) {
+    return true;
+  }
+  return Array.isArray(value) ? value.length === 0 : value.trim() === "";
+}
+function scopeCondition(table, scope) {
+  if (scope === NO_SCOPE) {
+    return void 0;
+  }
+  const column = table[scope.column];
+  if (!column) {
+    throw new Error(
+      `作用域列 "${scope.column}" 不在这张表上。检查 access.scope.column 是否写错，或这张表是否真的有归属列。`
+    );
+  }
+  if (isEmptyScopeValue(scope.value)) {
+    throw new Error(
+      `作用域列 "${scope.column}" 拿到的是空值。这不是「不筛」—— 上游应当在解析阶段就拒绝这个请求。`
+    );
+  }
+  return Array.isArray(scope.value) ? (0, import_drizzle_orm.inArray)(column, scope.value) : (0, import_drizzle_orm.eq)(column, scope.value);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NO_SCOPE,
+  isEmptyScopeValue,
+  scopeCondition
+});

package/lib/backend/sqlite/actions/create-delete-action.d.ts

@@ -1,8 +1,10 @@
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../../scope.js";
 export declare function createDeleteAction<TTable extends BaseTable>({ table, db, }: {
     db: any;
     table: TTable;
-}): ({ id, creatorId }: {
+}): ({ id }: {
     id: string;
-    creatorId?: string | undefined;
+}, { scope }: {
+    scope: ScopeArg;
 }) => Promise<any>;

package/lib/backend/sqlite/actions/create-delete-action.js

@@ -23,28 +23,22 @@ __export(create_delete_action_exports, {
 });
 module.exports = __toCommonJS(create_delete_action_exports);
 var import_drizzle_orm = require("drizzle-orm");
-var import_sqlite = require("..");
-var import_zod = require("zod");
+var import_scope = require("../../scope");
 var import_errors = require("../errors");
 function createDeleteAction({
   table,
   db
 }) {
-  return async ({ id, creatorId }) => {
-    if (creatorId) {
-      const data = await (0, import_sqlite.createGetAction)({
-        db,
-        table,
-        bodySchema: import_zod.z.object({
-          creatorId: import_zod.z.string(),
-          id: import_zod.z.string()
-        })
-      })({ creatorId, id });
-      if (!data) {
-        throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
-      }
+  return async ({ id }, { scope }) => {
+    if (!id) {
+      throw new import_errors.HttpError(400, "缺少 id");
     }
-    return db.delete(table).where((0, import_drizzle_orm.eq)(table.id, id)).returning();
+    const guard = (0, import_scope.scopeCondition)(table, scope);
+    const rows = await db.delete(table).where(guard ? (0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(table.id, id), guard) : (0, import_drizzle_orm.eq)(table.id, id)).returning();
+    if (rows.length === 0 && scope !== import_scope.NO_SCOPE) {
+      throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
+    }
+    return rows;
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/lib/backend/sqlite/actions/create-get-action.d.ts

@@ -1,3 +1,4 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 export declare function createGetAction<TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: any;
@@ -5,4 +6,6 @@ export declare function createGetAction<TTable extends BaseTable>({ bodySchema,
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Record<string, unknown>) => Promise<unknown>;
+}): (params: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<unknown>;

package/lib/backend/sqlite/actions/create-get-action.js

@@ -31,7 +31,7 @@ function createGetAction({
   relations,
   table
 }) {
-  return async (params) => {
+  return async (params, { scope }) => {
     const fields = {};
     for (const key of Object.keys(bodySchema.shape)) {
       const field = table[key];
@@ -44,6 +44,7 @@ function createGetAction({
       fields,
       jsonArrayFields,
       params,
+      scope,
       relations,
       table
     });

package/lib/backend/sqlite/actions/create-get-list-action.d.ts

@@ -1,3 +1,4 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 export declare function createGetListAction<TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: any;
@@ -5,7 +6,9 @@ export declare function createGetListAction<TTable extends BaseTable>({ bodySche
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Record<string, unknown>) => Promise<{
+}): (params: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<{
     data: unknown[];
     total: number;
 }>;

package/lib/backend/sqlite/actions/create-get-list-action.js

@@ -31,7 +31,7 @@ function createGetListAction({
   relations,
   table
 }) {
-  return async (params) => {
+  return async (params, { scope }) => {
     const { current, pageSize, ...other } = params;
     const fields = {};
     for (const key of Object.keys(bodySchema.shape)) {
@@ -45,6 +45,7 @@ function createGetListAction({
       fields,
       jsonArrayFields,
       params: other,
+      scope,
       relations,
       table
     });

package/lib/backend/sqlite/actions/create-put-action.d.ts

@@ -1,8 +1,9 @@
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../../scope.js";
 export declare function createPutAction<TTable extends BaseTable>({ db, table, }: {
     bodySchema: any;
     db: any;
     table: TTable;
-}): (body: Record<string, unknown>, { byCreator, }?: {
-    byCreator?: boolean | undefined;
+}): (body: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
 }) => Promise<any>;

package/lib/backend/sqlite/actions/create-put-action.js

@@ -22,35 +22,24 @@ __export(create_put_action_exports, {
   createPutAction: () => createPutAction
 });
 module.exports = __toCommonJS(create_put_action_exports);
-var import_zod = require("zod");
 var import_transform_body = require("./transform-body");
 var import_drizzle_orm = require("drizzle-orm");
-var import_sqlite = require("..");
+var import_scope = require("../../scope");
 var import_errors = require("../errors");
 function createPutAction({
   db,
   table
 }) {
-  return async (body, {
-    byCreator = true
-  } = {}) => {
-    if (byCreator) {
-      const data2 = await (0, import_sqlite.createGetAction)({
-        db,
-        table,
-        bodySchema: import_zod.z.object({
-          creatorId: import_zod.z.string(),
-          id: import_zod.z.string()
-        })
-      })({
-        creatorId: body.editorId,
-        id: body.id
-      });
-      if (!data2) {
-        throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
-      }
+  return async (body, { scope }) => {
+    const id = body.id;
+    if (!id) {
+      throw new import_errors.HttpError(400, "缺少 id");
+    }
+    const guard = (0, import_scope.scopeCondition)(table, scope);
+    const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where(guard ? (0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(table.id, id), guard) : (0, import_drizzle_orm.eq)(table.id, id)).returning();
+    if (!data && scope !== import_scope.NO_SCOPE) {
+      throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
     }
-    const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where((0, import_drizzle_orm.eq)(table.id, body.id)).returning();
     return data;
   };
 }

package/lib/backend/sqlite/actions/get-list-query.d.ts

@@ -1,9 +1,12 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 import { SelectedFields } from "drizzle-orm/sqlite-core/query-builders/select.types";
-export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, table, }: {
+export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, scope, relations, table, }: {
     db: any;
     fields: TSelection;
     jsonArrayFields?: string[];
+    /** 必填。与 pg 那套同义，见 backend/scope.ts。 */
+    scope: ScopeArg;
     params: {
         [field: string]: unknown;
         orderBy?: keyof BaseTable;

package/lib/backend/sqlite/actions/get-list-query.js

@@ -22,12 +22,14 @@ __export(get_list_query_exports, {
   getListQuery: () => getListQuery
 });
 module.exports = __toCommonJS(get_list_query_exports);
+var import_scope = require("../../scope");
 var import_drizzle_orm = require("drizzle-orm");
 function getListQuery({
   db,
   fields,
   jsonArrayFields,
   params,
+  scope,
   relations,
   table
 }) {
@@ -146,7 +148,9 @@ function getListQuery({
     return orderDir2 === "asc" ? (0, import_drizzle_orm.asc)(orderColumn) : (0, import_drizzle_orm.desc)(orderColumn);
   }
   const baseQuery = buildBaseQuery(table, fields, relations);
-  const conditions = buildConditions(filters, table, relations);
+  const scopeSql = (0, import_scope.scopeCondition)(table, scope);
+  const conditions = scopeSql ? [scopeSql] : [];
+  conditions.push(...buildConditions(filters, table, relations));
   const query = baseQuery.where(conditions.length > 0 ? (0, import_drizzle_orm.and)(...conditions) : void 0).orderBy(buildOrderBy(table, orderBy, orderDir)).limit(pageSize).offset((page - 1) * pageSize);
   const countQuery = db.select({ count: import_drizzle_orm.sql`COUNT(DISTINCT ${table.id})` }).from(table).where(conditions.length > 0 ? (0, import_drizzle_orm.and)(...conditions) : void 0);
   if (relations == null ? void 0 : relations.length) {

package/lib/backend/sqlite/route-operation/delete-operation.d.ts

@@ -10,4 +10,6 @@ export declare const createDeleteOperation: ({ db, getSession, }: {
     } | undefined>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/lib/backend/sqlite/route-operation/get-list-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createGetListOperation: ({ db, getSession, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/sqlite/route-operation/get-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createGetOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/sqlite/route-operation/post-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createPostOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/lib/backend/sqlite/route-operation/put-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createPutOperation: ({ getSession, db, }: {
         userId?: string;
     } | undefined>;
     db?: unknown;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.0.50",
+  "version": "0.1.0",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"
@@ -19,6 +19,42 @@
   "main": "./lib/index.js",
   "module": "./es/index.js",
   "types": "./lib/index.d.ts",
+  "//exports": "调用方写 `@ai0x0/utils/backend`，不要再写 `@ai0x0/utils/es/backend/index.js` —— 那是在指名道姓地引构建产物，等于把「有 es/ 和 lib/ 两套输出」这个内部细节焊进每一个 import。./es/* 与 ./lib/* 两条通配留着只为不打断已有调用方，新代码别用。",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./es/index.js",
+      "default": "./lib/index.js"
+    },
+    "./backend": {
+      "types": "./lib/backend/index.d.ts",
+      "import": "./es/backend/index.js",
+      "default": "./lib/backend/index.js"
+    },
+    "./backend/schemas": {
+      "types": "./lib/backend/schemas/index.d.ts",
+      "import": "./es/backend/schemas/index.js",
+      "default": "./lib/backend/schemas/index.js"
+    },
+    "./backend/sqlite": {
+      "types": "./lib/backend/sqlite/index.d.ts",
+      "import": "./es/backend/sqlite/index.js",
+      "default": "./lib/backend/sqlite/index.js"
+    },
+    "./backend/sqlite/schemas": {
+      "types": "./lib/backend/sqlite/schemas/index.d.ts",
+      "import": "./es/backend/sqlite/schemas/index.js",
+      "default": "./lib/backend/sqlite/schemas/index.js"
+    },
+    "./eslint-config": "./eslint-config/index.js",
+    "./eslint-rules": "./eslint-rules/index.js",
+    "./eslint-rules/*": "./eslint-rules/*",
+    "./es/*": "./es/*",
+    "./lib/*": "./lib/*",
+    "./SKILL.md": "./SKILL.md",
+    "./.agents/*": "./.agents/*",
+    "./package.json": "./package.json"
+  },
   "files": [
     "es",
     "lib",
@@ -60,6 +96,7 @@
     "drizzle-orm": "^0.45.2",
     "drizzle-zod": "^0.8.3",
     "eslint": "9",
+    "eslint-config-next": "^16.3.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.5",
     "father": "^4.6.18",