@ai0x0/utils 0.5.0 → 0.6.1

package/es/backend/route-operation/read-operation-core.js

@@ -1,11 +1,16 @@
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : String(i); }
+function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 import { routeOperation, TypedNextResponse } from "next-rest-framework";
 import { listBodySchema } from "../schemas/index.js";
 import { createOpenApiOperation } from "./open-api-operation.js";
-import { getDefaultTags, getReadParams, handleOperationError } from "./operation-common.js";
+import { callerIdOf, getDefaultTags, getReadParams, handleOperationError } from "./operation-common.js";
 
 // ==============================================================================
 // GET single operation
@@ -44,7 +49,7 @@ export function createGetOperationFactory(_ref) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-          var _yield$getReadParams, mergedParams, scope, rawResult, result;
+          var _yield$getReadParams, mergedParams, scope, session, rawResult, result;
           return _regeneratorRuntime().wrap(function _callee$(_context) {
             while (1) switch (_context.prev = _context.next) {
               case 0:
@@ -61,11 +66,12 @@ export function createGetOperationFactory(_ref) {
                 _yield$getReadParams = _context.sent;
                 mergedParams = _yield$getReadParams.params;
                 scope = _yield$getReadParams.scope;
+                session = _yield$getReadParams.session;
                 if (!(table && db)) {
-                  _context.next = 12;
+                  _context.next = 13;
                   break;
                 }
-                _context.next = 9;
+                _context.next = 10;
                 return createAction({
                   bodySchema: schemas.response,
                   db: db,
@@ -75,40 +81,43 @@ export function createGetOperationFactory(_ref) {
                 })(mergedParams, {
                   scope: scope
                 });
-              case 9:
+              case 10:
                 _context.t0 = _context.sent;
-                _context.next = 13;
+                _context.next = 14;
                 break;
-              case 12:
-                _context.t0 = mergedParams;
               case 13:
+                _context.t0 = mergedParams;
+              case 14:
                 rawResult = _context.t0;
                 result = rawResult !== null && rawResult !== void 0 ? rawResult : {};
                 if (!handler) {
-                  _context.next = 19;
+                  _context.next = 20;
                   break;
                 }
-                _context.next = 18;
+                _context.next = 19;
                 return handler({
                   data: result,
-                  params: mergedParams,
+                  // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+                  params: _objectSpread(_objectSpread({}, mergedParams), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
-              case 18:
-                result = _context.sent;
               case 19:
+                result = _context.sent;
+              case 20:
                 return _context.abrupt("return", TypedNextResponse.json(result, {
                   status: 200
                 }));
-              case 22:
-                _context.prev = 22;
+              case 23:
+                _context.prev = 23;
                 _context.t1 = _context["catch"](0);
                 return _context.abrupt("return", handleOperationError(_context.t1, catchHandler));
-              case 25:
+              case 26:
               case "end":
                 return _context.stop();
             }
-          }, _callee, null, [[0, 22]]);
+          }, _callee, null, [[0, 23]]);
         }));
         return function (_x) {
           return _ref4.apply(this, arguments);
@@ -155,7 +164,7 @@ export function createGetListOperationFactory(_ref5) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref8 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req) {
-          var _yield$getReadParams2, mergedParams, scope, result;
+          var _yield$getReadParams2, mergedParams, scope, session, result;
           return _regeneratorRuntime().wrap(function _callee2$(_context2) {
             while (1) switch (_context2.prev = _context2.next) {
               case 0:
@@ -172,11 +181,12 @@ export function createGetListOperationFactory(_ref5) {
                 _yield$getReadParams2 = _context2.sent;
                 mergedParams = _yield$getReadParams2.params;
                 scope = _yield$getReadParams2.scope;
+                session = _yield$getReadParams2.session;
                 if (!(table && db)) {
-                  _context2.next = 12;
+                  _context2.next = 13;
                   break;
                 }
-                _context2.next = 9;
+                _context2.next = 10;
                 return createAction({
                   bodySchema: schemas.response,
                   db: db,
@@ -186,42 +196,45 @@ export function createGetListOperationFactory(_ref5) {
                 })(mergedParams, {
                   scope: scope
                 });
-              case 9:
+              case 10:
                 _context2.t0 = _context2.sent;
-                _context2.next = 13;
+                _context2.next = 14;
                 break;
-              case 12:
+              case 13:
                 _context2.t0 = {
                   data: [],
                   total: 0
                 };
-              case 13:
+              case 14:
                 result = _context2.t0;
                 if (!handler) {
-                  _context2.next = 18;
+                  _context2.next = 19;
                   break;
                 }
-                _context2.next = 17;
+                _context2.next = 18;
                 return handler({
                   data: result,
-                  params: mergedParams,
+                  // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+                  params: _objectSpread(_objectSpread({}, mergedParams), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
-              case 17:
-                result = _context2.sent;
               case 18:
+                result = _context2.sent;
+              case 19:
                 return _context2.abrupt("return", TypedNextResponse.json(result, {
                   status: 200
                 }));
-              case 21:
-                _context2.prev = 21;
+              case 22:
+                _context2.prev = 22;
                 _context2.t1 = _context2["catch"](0);
                 return _context2.abrupt("return", handleOperationError(_context2.t1, catchHandler));
-              case 24:
+              case 25:
               case "end":
                 return _context2.stop();
             }
-          }, _callee2, null, [[0, 21]]);
+          }, _callee2, null, [[0, 22]]);
         }));
         return function (_x2) {
           return _ref8.apply(this, arguments);

package/es/backend/route-operation/write-operation-core.d.ts

@@ -5,6 +5,7 @@ import { type RouteOpenApiOperation } from "./open-api-operation.js";
 import { AccessOptions, ActionFactory, DefaultSession, RouteCatch, SessionGetter } from "./operation-common.js";
 import { ScopeArg } from "../scope.js";
 export type PostOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     creatorId?: string;
 };
 export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -37,6 +38,7 @@ export declare function createPostOperationFactory<TTable>({ createAction, getTa
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: PostOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
 export type PutOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     editorId?: string;
 };
 export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -65,7 +67,7 @@ export declare function createPutOperationFactory<TTable>({ createAction, getTab
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: PutOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
 export type DeleteOperationParams<B extends ZodSchema> = z.infer<B> & Record<string, unknown> & {
-    creatorId?: string;
+    callerId?: string;
     id: string;
 };
 export interface DeleteOperationOptions<TTable, B extends ZodSchema, TSession = DefaultSession> {

package/es/backend/route-operation/write-operation-core.js

@@ -10,13 +10,17 @@ function _asyncToGenerator(fn) { return function () { var self = this, args = ar
 import { routeOperation, TypedNextResponse } from "next-rest-framework";
 import { z } from "zod";
 import { createOpenApiOperation } from "./open-api-operation.js";
-import { getDefaultTags, handleOperationError, readPostBody, resolveAccess, sessionLoader } from "./operation-common.js";
+import { callerIdOf, getDefaultTags, handleOperationError, readPostBody, resolveAccess, sessionLoader } from "./operation-common.js";
 import { NO_SCOPE } from "../scope.js";
 
 // ==============================================================================
 // POST create operation
 // ==============================================================================
 
+// creatorId 是**归属戳**（access.scope 指的那一列）——默认作用域下它确实叫 creatorId，
+// 但换成 `scope: { column: "ownerId" }` 之后这一行盖的就是 ownerId 了。要「谁发的请求」
+// 一律读 callerId，那个四个方法都有、也不受作用域配置影响。
+
 export function createPostOperationFactory(_ref) {
   var createAction = _ref.createAction,
     getTableName = _ref.getTableName;
@@ -127,7 +131,11 @@ export function createPostOperationFactory(_ref) {
                 _context.next = 28;
                 return handler({
                   data: raw,
-                  params: params,
+                  // callerId 只加在**交给 handler 的那一份**上，不进上面 createAction 收到的
+                  // params —— 那一份会被原样 insert，而 callerId 不是任何表的列。
+                  params: _objectSpread(_objectSpread({}, params), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
               case 28:
@@ -163,6 +171,9 @@ export function createPostOperationFactory(_ref) {
 // PUT update operation
 // ==============================================================================
 
+// editorId 是要写进行里的**审计列**（「谁改的」）。它恰好等于调用者，但语义是两件事 ——
+// 判权请读 callerId，别读它。
+
 export function createPutOperationFactory(_ref5) {
   var createAction = _ref5.createAction,
     getTableName = _ref5.getTableName;
@@ -279,7 +290,11 @@ export function createPutOperationFactory(_ref5) {
                 _context2.next = 39;
                 return handler({
                   data: raw,
-                  params: params,
+                  // 同 POST：callerId 不进 createAction 那一份（它会被 .set() 原样写进 UPDATE，
+                  // 而 callerId 不是列）。editorId 是列，所以它留在 params 里。
+                  params: _objectSpread(_objectSpread({}, params), {}, {
+                    callerId: editorId
+                  }),
                   req: req
                 });
               case 39:
@@ -318,6 +333,11 @@ export function createPutOperationFactory(_ref5) {
 var defaultDeleteBodySchema = z.object({
   id: z.string().describe("Id of the row to delete.")
 });
+
+// 原先这里声明的是 `creatorId?: string`，而删除**从来没有填过它** —— 类型说有、运行时没有，
+// 于是 `requireAdmin(params.creatorId)` 这种判权写法编译绿灯、线上对所有人 401。换成 callerId
+// 并且真的盖上。
+
 export function createDeleteOperationFactory(_ref9) {
   var createAction = _ref9.createAction,
     getTableName = _ref9.getTableName;
@@ -345,7 +365,7 @@ export function createDeleteOperationFactory(_ref9) {
         contentType: "application/json"
       }).handler( /*#__PURE__*/function () {
         var _ref12 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req) {
-          var bodySchema, body, _yield$resolveAccess3, scope, data;
+          var bodySchema, body, loadSession, _yield$resolveAccess3, scope, data;
           return _regeneratorRuntime().wrap(function _callee3$(_context3) {
             while (1) switch (_context3.prev = _context3.next) {
               case 0:
@@ -357,20 +377,22 @@ export function createDeleteOperationFactory(_ref9) {
               case 5:
                 _context3.t1 = _context3.sent;
                 body = _context3.t0.parse.call(_context3.t0, _context3.t1);
-                _context3.next = 9;
+                // loadSession 带缓存，下面取 callerId 时不会再往返一次。
+                loadSession = sessionLoader(getSession, req);
+                _context3.next = 10;
                 return resolveAccess({
                   access: access,
-                  loadSession: sessionLoader(getSession, req),
+                  loadSession: loadSession,
                   method: "DELETE"
                 });
-              case 9:
+              case 10:
                 _yield$resolveAccess3 = _context3.sent;
                 scope = _yield$resolveAccess3.scope;
                 if (!(table && db)) {
-                  _context3.next = 17;
+                  _context3.next = 18;
                   break;
                 }
-                _context3.next = 14;
+                _context3.next = 15;
                 return createAction({
                   db: db,
                   table: table
@@ -379,33 +401,54 @@ export function createDeleteOperationFactory(_ref9) {
                 }, {
                   scope: scope
                 });
-              case 14:
+              case 15:
                 _context3.t2 = _context3.sent;
-                _context3.next = 18;
+                _context3.next = 19;
                 break;
-              case 17:
-                _context3.t2 = body;
               case 18:
+                _context3.t2 = body;
+              case 19:
                 data = _context3.t2;
-                _context3.next = 21;
-                return handler === null || handler === void 0 ? void 0 : handler({
-                  data: data,
-                  params: body,
-                  req: req
-                });
-              case 21:
+                if (!handler) {
+                  _context3.next = 37;
+                  break;
+                }
+                _context3.t3 = handler;
+                _context3.t4 = data;
+                _context3.t5 = _objectSpread;
+                _context3.t6 = _objectSpread({}, body);
+                _context3.t7 = {};
+                _context3.t8 = callerIdOf;
+                _context3.next = 29;
+                return loadSession();
+              case 29:
+                _context3.t9 = _context3.sent;
+                _context3.t10 = (0, _context3.t8)(_context3.t9);
+                _context3.t11 = {
+                  callerId: _context3.t10
+                };
+                _context3.t12 = (0, _context3.t5)(_context3.t6, _context3.t7, _context3.t11);
+                _context3.t13 = req;
+                _context3.t14 = {
+                  data: _context3.t4,
+                  params: _context3.t12,
+                  req: _context3.t13
+                };
+                _context3.next = 37;
+                return (0, _context3.t3)(_context3.t14);
+              case 37:
                 return _context3.abrupt("return", TypedNextResponse.json(data, {
                   status: 200
                 }));
-              case 24:
-                _context3.prev = 24;
-                _context3.t3 = _context3["catch"](0);
-                return _context3.abrupt("return", handleOperationError(_context3.t3, catchHandler));
-              case 27:
+              case 40:
+                _context3.prev = 40;
+                _context3.t15 = _context3["catch"](0);
+                return _context3.abrupt("return", handleOperationError(_context3.t15, catchHandler));
+              case 43:
               case "end":
                 return _context3.stop();
             }
-          }, _callee3, null, [[0, 24]]);
+          }, _callee3, null, [[0, 40]]);
         }));
         return function (_x3) {
           return _ref12.apply(this, arguments);

package/es/backend/schemas/common.d.ts

@@ -0,0 +1,112 @@
+import { z } from "zod";
+/**
+ * 业务侧 insert schema 需要从 drizzle-zod 生成的 schema 中排除的基础字段。
+ * 这些字段由后端在 createPostAction 中自动写入。
+ *
+ * 使用方式（在业务 schema 中）：
+ *   const insertFooSchema = createInsertSchema(foos)
+ *     .omit(BASIC_INSERT_OMIT)
+ *     .extend({ ... });
+ *
+ * 说明：上游导出为 const 而不是 helper function，是为了避免经过泛型
+ * wrapper 后 TS 把 drizzle-zod 推导出的深层条件 Shape 归约成 Omit，
+ * 从而在下游 `.extend(...)` 时丢失原有字段类型。
+ */
+export declare const BASIC_INSERT_OMIT: {
+    readonly id: true;
+    readonly creatorId: true;
+    readonly editorId: true;
+    readonly accessedAt: true;
+    readonly createdAt: true;
+    readonly updatedAt: true;
+};
+/**
+ * 业务侧 update schema 需要从 drizzle-zod 生成的 schema 中排除的基础字段。
+ * update 保留 id（随后用 `.required({ id: true })` 变成必填），其余由
+ * 后端 createPutAction 自动维护。
+ */
+export declare const BASIC_UPDATE_OMIT: {
+    readonly creatorId: true;
+    readonly editorId: true;
+    readonly accessedAt: true;
+    readonly createdAt: true;
+    readonly updatedAt: true;
+};
+export declare const queryListSchema: <Incoming extends z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>>(schema: Incoming) => z.ZodObject<(("orderBy" | "orderDir" | "pageSize" | "creatorId" | "current" | "createdAtFrom" | "createdAtTo") & keyof Incoming["shape"] extends never ? {
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+} & Incoming["shape"] : ({
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+} extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof Incoming["shape"] ? never : K]: {
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}[K]; } : never) & (Incoming["shape"] extends infer T_2 extends z.core.util.SomeObject ? { [K_1 in keyof T_2]: Incoming["shape"][K_1]; } : never)) extends infer T ? { [k in keyof T]: (("orderBy" | "orderDir" | "pageSize" | "creatorId" | "current" | "createdAtFrom" | "createdAtTo") & keyof Incoming["shape"] extends never ? {
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+} & Incoming["shape"] : ({
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+} extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof Incoming["shape"] ? never : K]: {
+    current: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    pageSize: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    createdAtFrom: z.ZodOptional<z.ZodString>;
+    createdAtTo: z.ZodOptional<z.ZodString>;
+    orderBy: z.ZodOptional<z.ZodString>;
+    creatorId: z.ZodOptional<z.ZodString>;
+    orderDir: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}[K]; } : never) & (Incoming["shape"] extends infer T_2 extends z.core.util.SomeObject ? { [K_1 in keyof T_2]: Incoming["shape"][K_1]; } : never))[k]; } : never, Incoming["_zod"]["config"]>;
+export declare const listBodySchema: <T extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>(schema: T) => z.ZodObject<{
+    total: z.ZodNumber;
+    data: z.ZodArray<T>;
+}, z.core.$strip>;
+/**
+ * 给 schema 上已有的字段挂说明。字段不在这个 schema 里就跳过 —— 同一张表的
+ * insert / update / select 三份含的列不一样（basicFields 只在 select 里），一份说明表要能同时
+ * 喂给三者，就不能对「字段一定存在」有要求。**不给不存在的字段凭空造一个。**
+ */
+export declare const describeFields: <T extends z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>>(schema: T, notes: Record<string, string>) => T;
+export declare const describeBasicFields: <T extends z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>>(schema: T) => T;