@ai0x0/utils 0.1.3 → 0.2.0

package/es/backend/route-operation/delete-operation.d.ts

@@ -1,16 +1,12 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable } from "../types.js";
 import { type DeleteOperationOptions as CoreDeleteOperationOptions } from "./operation-core.js";
-export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema> = CoreDeleteOperationOptions<TTable, B>;
-export declare const createDeleteOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema, TSession = DefaultSession> = CoreDeleteOperationOptions<TTable, B, TSession>;
+export declare const createDeleteOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+    getSession: SessionGetter<TSession>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, TSession>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/es/backend/route-operation/get-list-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetListOperationOptions as CoreGetListOperationOptions } from "./operation-core.js";
-export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetListOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetListOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/route-operation/get-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetOperationOptions as CoreGetOperationOptions } from "./operation-core.js";
-export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/route-operation/index.d.ts

@@ -4,3 +4,5 @@ export * from "./delete-operation.js";
 export * from "./post-operation.js";
 export * from "./put-operation.js";
 export * from "./open-api-operation.js";
+export type { AccessDenial, AccessOptions, DefaultSession, HttpMethod, SessionGetter, } from "./operation-common.js";
+export type { ScopeCondition, ScopeValue } from "../scope.js";

package/es/backend/route-operation/index.js

@@ -3,4 +3,7 @@ export * from "./get-list-operation.js";
 export * from "./delete-operation.js";
 export * from "./post-operation.js";
 export * from "./put-operation.js";
-export * from "./open-api-operation.js";
+export * from "./open-api-operation.js";
+// 调用方要自己拼 access 预设（把 scope / can / stamp 收在一处复用）就得有这几个类型 ——
+// 不导出的话只能在业务里重写一遍 HttpMethod 之类，两边一旦漂移就是静默的错配。
+export {};

package/es/backend/route-operation/operation-common.d.ts

@@ -44,6 +44,18 @@ export interface AccessOptions<TSession = DefaultSession> {
         session: TSession;
         method: HttpMethod;
     }) => boolean | AccessDenial | Promise<boolean | AccessDenial>;
+    /**
+     * 新建（POST）时额外要盖在行上的列。归属列由 `scope` 盖，这里管别的服务端字段 ——
+     * 最典型的就是「谁建的」：归属列一旦不是 `creatorId`（比如换成 `ownerId`），作者就没人写了，
+     * 而 `setBody` 只能返回请求体 schema 里有的字段，`creatorId` 不在里面。
+     *
+     * 与归属戳同一条不变量：**最后展开，客户端覆盖不了**。所以这里能安全地盖任何服务端字段，
+     * 不必担心请求体里塞一个同名键把它顶掉。
+     *
+     * 库不替业务猜要盖什么（哪张表有 creatorId、要不要记作者，都是业务的事），所以给的是钩子
+     * 而不是默认行为。
+     */
+    stamp?: (session: TSession) => Record<string, unknown>;
 }
 /**
  * 把会话读取包成「本次请求最多取一次」的取值器。

package/es/backend/route-operation/operation-common.js

@@ -69,7 +69,8 @@ function _resolveAccess() {
         case 0:
           access = _ref.access, loadSession = _ref.loadSession, method = _ref.method;
           wantsScope = Boolean(access === null || access === void 0 ? void 0 : access.scope) || ((_access$byCreator = access === null || access === void 0 ? void 0 : access.byCreator) !== null && _access$byCreator !== void 0 ? _access$byCreator : true); // 不需要就不取：关掉隔离的路由（多半是公开端点）不该为此白付一次会话读取。
-          if (!(wantsScope || access !== null && access !== void 0 && access.can)) {
+          // stamp 也要会话 —— 它是拿会话算「盖哪些列」的。
+          if (!(wantsScope || access !== null && access !== void 0 && access.can || access !== null && access !== void 0 && access.stamp)) {
             _context.next = 8;
             break;
           }

package/es/backend/route-operation/post-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PostOperationOptions as CorePostOperationOptions } from "./operation-core.js";
-export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePostOperationOptions<IB, OB, TTable>;
-export declare const createPostOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePostOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPostOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+    getSession: SessionGetter<TSession>;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/es/backend/route-operation/put-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PutOperationOptions as CorePutOperationOptions } from "./operation-core.js";
-export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePutOperationOptions<IB, OB, TTable>;
-export declare const createPutOperation: ({ getSession, db, }: {
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePutOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPutOperation: <TSession = DefaultSession>({ getSession, db, }: {
+    getSession: SessionGetter<TSession>;
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/es/backend/route-operation/write-operation-core.js

@@ -54,7 +54,7 @@ export function createPostOperationFactory(_ref) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-          var _yield$resolveAccess, scope, body, extraBody, params, raw, data;
+          var _access$stamp, _access$stamp2, _yield$resolveAccess, scope, session, body, extraBody, stamped, params, raw, data;
           return _regeneratorRuntime().wrap(function _callee$(_context) {
             while (1) switch (_context.prev = _context.next) {
               case 0:
@@ -68,27 +68,31 @@ export function createPostOperationFactory(_ref) {
               case 3:
                 _yield$resolveAccess = _context.sent;
                 scope = _yield$resolveAccess.scope;
-                _context.next = 7;
+                session = _yield$resolveAccess.session;
+                _context.next = 8;
                 return readPostBody(req, {
                   contentType: contentType,
                   parseBody: parseBody
                 });
-              case 7:
+              case 8:
                 body = _context.sent;
-                _context.next = 10;
+                _context.next = 11;
                 return setBody === null || setBody === void 0 ? void 0 : setBody(req);
-              case 10:
+              case 11:
                 _context.t0 = _context.sent;
                 if (_context.t0) {
-                  _context.next = 13;
+                  _context.next = 14;
                   break;
                 }
                 _context.t0 = {};
-              case 13:
+              case 14:
                 extraBody = _context.t0;
                 // 新建的行归属这次请求的作用域。默认情形下作用域就是 creatorId = 当前用户，
                 // 换了归属列（比如 ownerId）时它自动跟着换。
-                // 想再记一个「谁建的」用 setBody 补 —— 那是调用方的语义，库不猜。
+                //
+                // 别的服务端字段（最典型的是「谁建的」）由 access.stamp 盖：归属列一旦不是
+                // creatorId，作者就没人写了，而 setBody 只能返回请求体 schema 里有的字段。
+                // 归属戳排在它后面 —— 两者撞同一个键时以归属为准，那是更强的那条不变量。
                 //
                 // **归属戳必须最后展开**，这是一条安全不变量，别为了「让调用方能覆盖」而调顺序：
                 // `.input({ body })` 只校验、**不替换**请求体（next-rest-framework 交给 handler 的
@@ -96,55 +100,56 @@ export function createPostOperationFactory(_ref) {
                 // schema 过滤。所以只要 body 排在戳后面，客户端在 JSON 里塞一个 `ownerId` /
                 // `creatorId` 就能把行写到别人名下 —— 调用方把该列从 schema 里 omit 掉也拦不住。
                 // 见 __tests__/route-operation-scope-stamp。
-                params = _objectSpread(_objectSpread(_objectSpread({}, body), extraBody), scopeStamp(scope));
+                stamped = session === undefined ? {} : (_access$stamp = access === null || access === void 0 || (_access$stamp2 = access.stamp) === null || _access$stamp2 === void 0 ? void 0 : _access$stamp2.call(access, session)) !== null && _access$stamp !== void 0 ? _access$stamp : {};
+                params = _objectSpread(_objectSpread(_objectSpread(_objectSpread({}, body), extraBody), stamped), scopeStamp(scope));
                 if (!(table && db)) {
-                  _context.next = 21;
+                  _context.next = 23;
                   break;
                 }
-                _context.next = 18;
+                _context.next = 20;
                 return createAction({
                   bodySchema: schemas.body,
                   db: db,
                   table: table
                 })(params);
-              case 18:
+              case 20:
                 _context.t1 = _context.sent[0];
-                _context.next = 22;
+                _context.next = 24;
                 break;
-              case 21:
+              case 23:
                 _context.t1 = params;
-              case 22:
+              case 24:
                 raw = _context.t1;
                 if (!handler) {
-                  _context.next = 29;
+                  _context.next = 31;
                   break;
                 }
-                _context.next = 26;
+                _context.next = 28;
                 return handler({
                   data: raw,
                   params: params,
                   req: req
                 });
-              case 26:
+              case 28:
                 _context.t2 = _context.sent;
-                _context.next = 30;
+                _context.next = 32;
                 break;
-              case 29:
+              case 31:
                 _context.t2 = raw;
-              case 30:
+              case 32:
                 data = _context.t2;
                 return _context.abrupt("return", TypedNextResponse.json(data, {
                   status: 200
                 }));
-              case 34:
-                _context.prev = 34;
+              case 36:
+                _context.prev = 36;
                 _context.t3 = _context["catch"](0);
                 return _context.abrupt("return", handleOperationError(_context.t3, catchHandler));
-              case 37:
+              case 39:
               case "end":
                 return _context.stop();
             }
-          }, _callee, null, [[0, 34]]);
+          }, _callee, null, [[0, 36]]);
         }));
         return function (_x) {
           return _ref4.apply(this, arguments);

package/lib/backend/route-operation/delete-operation.d.ts

@@ -1,16 +1,12 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable } from "../types.js";
 import { type DeleteOperationOptions as CoreDeleteOperationOptions } from "./operation-core.js";
-export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema> = CoreDeleteOperationOptions<TTable, B>;
-export declare const createDeleteOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema, TSession = DefaultSession> = CoreDeleteOperationOptions<TTable, B, TSession>;
+export declare const createDeleteOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+    getSession: SessionGetter<TSession>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, TSession>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/lib/backend/route-operation/get-list-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetListOperationOptions as CoreGetListOperationOptions } from "./operation-core.js";
-export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetListOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetListOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/get-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetOperationOptions as CoreGetOperationOptions } from "./operation-core.js";
-export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/index.d.ts

@@ -4,3 +4,5 @@ export * from "./delete-operation.js";
 export * from "./post-operation.js";
 export * from "./put-operation.js";
 export * from "./open-api-operation.js";
+export type { AccessDenial, AccessOptions, DefaultSession, HttpMethod, SessionGetter, } from "./operation-common.js";
+export type { ScopeCondition, ScopeValue } from "../scope.js";

package/lib/backend/route-operation/operation-common.d.ts

@@ -44,6 +44,18 @@ export interface AccessOptions<TSession = DefaultSession> {
         session: TSession;
         method: HttpMethod;
     }) => boolean | AccessDenial | Promise<boolean | AccessDenial>;
+    /**
+     * 新建（POST）时额外要盖在行上的列。归属列由 `scope` 盖，这里管别的服务端字段 ——
+     * 最典型的就是「谁建的」：归属列一旦不是 `creatorId`（比如换成 `ownerId`），作者就没人写了，
+     * 而 `setBody` 只能返回请求体 schema 里有的字段，`creatorId` 不在里面。
+     *
+     * 与归属戳同一条不变量：**最后展开，客户端覆盖不了**。所以这里能安全地盖任何服务端字段，
+     * 不必担心请求体里塞一个同名键把它顶掉。
+     *
+     * 库不替业务猜要盖什么（哪张表有 creatorId、要不要记作者，都是业务的事），所以给的是钩子
+     * 而不是默认行为。
+     */
+    stamp?: (session: TSession) => Record<string, unknown>;
 }
 /**
  * 把会话读取包成「本次请求最多取一次」的取值器。

package/lib/backend/route-operation/operation-common.js

@@ -42,7 +42,7 @@ async function resolveAccess({
 }) {
   var _a;
   const wantsScope = Boolean(access == null ? void 0 : access.scope) || ((access == null ? void 0 : access.byCreator) ?? true);
-  const session = wantsScope || (access == null ? void 0 : access.can) ? await loadSession() : void 0;
+  const session = wantsScope || (access == null ? void 0 : access.can) || (access == null ? void 0 : access.stamp) ? await loadSession() : void 0;
   if (access == null ? void 0 : access.can) {
     if (!session) {
       throw new import_errors.HttpError(401, "未登录");

package/lib/backend/route-operation/post-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PostOperationOptions as CorePostOperationOptions } from "./operation-core.js";
-export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePostOperationOptions<IB, OB, TTable>;
-export declare const createPostOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePostOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPostOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+    getSession: SessionGetter<TSession>;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/lib/backend/route-operation/put-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PutOperationOptions as CorePutOperationOptions } from "./operation-core.js";
-export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePutOperationOptions<IB, OB, TTable>;
-export declare const createPutOperation: ({ getSession, db, }: {
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePutOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPutOperation: <TSession = DefaultSession>({ getSession, db, }: {
+    getSession: SessionGetter<TSession>;
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/lib/backend/route-operation/write-operation-core.js

@@ -62,15 +62,22 @@ function createPostOperationFactory({
       status: 200
     }
   ]).handler(async (req) => {
+    var _a;
     try {
-      const { scope } = await (0, import_operation_common.resolveAccess)({
+      const { scope, session } = await (0, import_operation_common.resolveAccess)({
         access,
         loadSession: (0, import_operation_common.sessionLoader)(getSession, req),
         method: "POST"
       });
       const body = await (0, import_operation_common.readPostBody)(req, { contentType, parseBody });
       const extraBody = await (setBody == null ? void 0 : setBody(req)) || {};
-      const params = { ...body, ...extraBody, ...scopeStamp(scope) };
+      const stamped = session === void 0 ? {} : ((_a = access == null ? void 0 : access.stamp) == null ? void 0 : _a.call(access, session)) ?? {};
+      const params = {
+        ...body,
+        ...extraBody,
+        ...stamped,
+        ...scopeStamp(scope)
+      };
       const raw = table && db ? (await createAction({
         bodySchema: schemas.body,
         db,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"