@ai0x0/utils 0.9.0 → 0.10.0

package/SKILL.md

@@ -317,6 +317,8 @@ export const { GET } = route({
 - **Fail closed**: if the session is missing → 401; if `scope.value` returns empty → 403. A scope that cannot be resolved is **never** downgraded to "no filter". PUT/DELETE put the scope straight into the `UPDATE`/`DELETE` `where` (one statement, no read-then-write window) and return 404 when it affects zero rows — "does not exist" and "not yours" are deliberately indistinguishable, otherwise the endpoint becomes an existence oracle.
 - **Auto injection**: POST stamps the scope column with the scope value (by default that is `creatorId = session.userId`); PUT writes `editorId = session.userId`; GET/GET_LIST apply the scope as a mandatory `where`.
 - **Session shape** is yours: `getSession` is generic, so resolve "who + which space + what role" once and let `scope.value` / `can` read the same object instead of each querying again.
+- **Built-in error copy** (`未登录` / `没有权限` / `缺少 id` / `未找到编辑(删除)对象，或没有权限` / scope-unresolved 403): thrown from inside the library, so the app's own i18n throw-sites never see them. Register `setHttpErrorMessageResolver(() => ({ unauthenticated: t("..."), ... }))` once at app startup to translate them per request — the resolver may be `async` (e.g. resolving the locale from `next/headers`), is called lazily at each throw site, and falls back to the Chinese defaults when absent or when it throws. Deliberately string-based, not error-code-based: CLI and agent consumers read these messages too and have no translation layer.
+
 - **Date coercion**: any body field ending in `At` is passed through `dayjs(value).toDate()` before write — accept ISO strings from clients.
 - **List filtering** (all querystring values are strings). **A column is filterable only if it appears in `schemas.response`** — the filter surface is the readable surface, so a list that returns `id / title` cannot be probed with `?secret=…` (unknown or unreadable keys are ignored, not rejected). Anything you want filterable belongs in the response schema.
   - `key=a,b,c` → `IN (...)` when the key is `id` or ends with `Id`; otherwise `OR ILIKE %a% OR ILIKE %b%`

package/es/backend/actions/write-action-core.js

@@ -26,7 +26,7 @@ function _asyncToGenerator(fn) { return function () { var self = this, args = ar
 
 import { and, eq } from "drizzle-orm";
 import { NO_SCOPE, scopeCondition } from "../scope.js";
-import { HttpError } from "../errors.js";
+import { HttpError, httpErrorMessages } from "../errors.js";
 import { transformBody } from "./transform-body.js";
 
 /** 核心用得到表的哪一部分：只有 id。dialect 各自的 Table 类型不进来。 */
@@ -49,25 +49,35 @@ export function createPutActionCore(_ref) {
             scope = _ref2.scope;
             id = body.id;
             if (id) {
-              _context.next = 4;
+              _context.next = 8;
               break;
             }
-            throw new HttpError(400, "缺少 id");
-          case 4:
+            _context.t0 = HttpError;
             _context.next = 6;
-            return db.update(table).set(transformBody(body)).where(byId(table, id, scope)).returning();
+            return httpErrorMessages();
           case 6:
+            _context.t1 = _context.sent.missingId;
+            throw new _context.t0(400, _context.t1);
+          case 8:
+            _context.next = 10;
+            return db.update(table).set(transformBody(body)).where(byId(table, id, scope)).returning();
+          case 10:
             _yield$db$update$set$ = _context.sent;
             _yield$db$update$set$2 = _slicedToArray(_yield$db$update$set$, 1);
             data = _yield$db$update$set$2[0];
             if (!(!data && scope !== NO_SCOPE)) {
-              _context.next = 11;
+              _context.next = 19;
               break;
             }
-            throw new HttpError(404, "未找到编辑对象，或没有权限");
-          case 11:
+            _context.t2 = HttpError;
+            _context.next = 17;
+            return httpErrorMessages();
+          case 17:
+            _context.t3 = _context.sent.editNotFound;
+            throw new _context.t2(404, _context.t3);
+          case 19:
             return _context.abrupt("return", data);
-          case 12:
+          case 20:
           case "end":
             return _context.stop();
         }
@@ -90,23 +100,33 @@ export function createDeleteActionCore(_ref4) {
             id = _ref5.id;
             scope = _ref6.scope;
             if (id) {
-              _context2.next = 4;
+              _context2.next = 8;
               break;
             }
-            throw new HttpError(400, "缺少 id");
-          case 4:
+            _context2.t0 = HttpError;
             _context2.next = 6;
-            return db.delete(table).where(byId(table, id, scope)).returning();
+            return httpErrorMessages();
           case 6:
+            _context2.t1 = _context2.sent.missingId;
+            throw new _context2.t0(400, _context2.t1);
+          case 8:
+            _context2.next = 10;
+            return db.delete(table).where(byId(table, id, scope)).returning();
+          case 10:
             rows = _context2.sent;
             if (!(rows.length === 0 && scope !== NO_SCOPE)) {
-              _context2.next = 9;
+              _context2.next = 17;
               break;
             }
-            throw new HttpError(404, "未找到删除对象，或没有权限");
-          case 9:
+            _context2.t2 = HttpError;
+            _context2.next = 15;
+            return httpErrorMessages();
+          case 15:
+            _context2.t3 = _context2.sent.deleteNotFound;
+            throw new _context2.t2(404, _context2.t3);
+          case 17:
             return _context2.abrupt("return", rows);
-          case 10:
+          case 18:
           case "end":
             return _context2.stop();
         }

package/es/backend/errors.d.ts

@@ -2,3 +2,33 @@ export declare class HttpError extends Error {
     status: number;
     constructor(status: number, message: string);
 }
+export interface HttpErrorMessages {
+    /** 401：会话不存在。 */
+    unauthenticated: string;
+    /** 403：access.can 拒绝且没给自定义文案。 */
+    forbidden: string;
+    /** 400：PUT / DELETE 请求体缺 id。 */
+    missingId: string;
+    /** 404：PUT 影响 0 行（不存在或不属于调用者）。 */
+    editNotFound: string;
+    /** 404：DELETE 影响 0 行。 */
+    deleteNotFound: string;
+    /** 403：作用域值解析不出来 —— 多半是配错了列名，但请求照样要被拒绝。 */
+    scopeUnresolved: (column: string) => string;
+}
+export declare const defaultHttpErrorMessages: HttpErrorMessages;
+type HttpErrorMessageResolver = () => Partial<HttpErrorMessages> | Promise<Partial<HttpErrorMessages>>;
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export declare function setHttpErrorMessageResolver(next: HttpErrorMessageResolver | undefined): void;
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export declare function httpErrorMessages(): Promise<HttpErrorMessages>;
+export {};

package/es/backend/errors.js

@@ -1,4 +1,9 @@
+function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
+function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, _toPropertyKey(descriptor.key), descriptor); } }
 function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }
 function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
@@ -28,4 +33,78 @@ export var HttpError = /*#__PURE__*/function (_Error) {
     return _this;
   }
   return _createClass(HttpError);
-}( /*#__PURE__*/_wrapNativeSuper(Error));
+}( /*#__PURE__*/_wrapNativeSuper(Error));
+
+// =============================================================================
+// 框架内建报错的文案 —— 默认中文，调用方可以按请求语言换掉
+// =============================================================================
+// 这几句是从**库内部**抛出去的（准入判定、写动作的兜底），业务自己的报错在业务代码里
+// 渲染（do-tv 是 (backend)/utils/i18n 的 serverT，抛出点就地翻成请求的语言）。库不知道
+// 也不该知道各项目的 i18n 栈（next-intl、react-i18next、自研…），所以不给库塞字典，
+// 只留一个「抛出前问一次」的钩子：谁做国际化，谁在应用启动时注册一个解析器。
+//
+// 为什么不回错误码让前端翻：这些 message 的读者不只是浏览器 —— CLI 与 agent 也读它，
+// 它们没有前端那套翻译层，回个码等于让它们打印一串 `errors.UNAUTHENTICATED`。在服务端
+// 渲染成字符串，所有读者拿到的都是人话。
+//
+// 解析器按**请求**解析（语言藏在 cookie / Accept-Language 里），所以它是每次抛出时现调
+// 的函数，而不是启动时钉死的一份字符串。允许 async —— 各抛出点本来就在 async 函数里，
+// 而「按当前请求取翻译」在 Next 里就得 await（do-tv 的 requestText() 走 next/headers）。
+
+export var defaultHttpErrorMessages = {
+  unauthenticated: "未登录",
+  forbidden: "没有权限",
+  missingId: "缺少 id",
+  editNotFound: "未找到编辑对象，或没有权限",
+  deleteNotFound: "未找到删除对象，或没有权限",
+  scopeUnresolved: function scopeUnresolved(column) {
+    return "\u65E0\u6CD5\u786E\u5B9A\u8FD9\u6B21\u8BF7\u6C42\u7684\u5F52\u5C5E\uFF08".concat(column, "\uFF09\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u505A\u9694\u79BB\u300D\u2014\u2014\u8BF7\u6C42\u88AB\u62D2\u7EDD\u3002");
+  }
+};
+var resolver;
+
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export function setHttpErrorMessageResolver(next) {
+  resolver = next;
+}
+
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export function httpErrorMessages() {
+  return _httpErrorMessages.apply(this, arguments);
+}
+function _httpErrorMessages() {
+  _httpErrorMessages = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee() {
+    var overrides, _resolver;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          _context.prev = 0;
+          _context.next = 3;
+          return (_resolver = resolver) === null || _resolver === void 0 ? void 0 : _resolver();
+        case 3:
+          overrides = _context.sent;
+          _context.next = 9;
+          break;
+        case 6:
+          _context.prev = 6;
+          _context.t0 = _context["catch"](0);
+          overrides = undefined;
+        case 9:
+          return _context.abrupt("return", _objectSpread(_objectSpread({}, defaultHttpErrorMessages), overrides));
+        case 10:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee, null, [[0, 6]]);
+  }));
+  return _httpErrorMessages.apply(this, arguments);
+}

package/es/backend/route-operation/operation-common.js

@@ -8,7 +8,7 @@ function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" ==
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 import { TypedNextResponse } from "@ai0x0/next-rest-framework";
-import { HttpError } from "../errors.js";
+import { HttpError, httpErrorMessages } from "../errors.js";
 import { isEmptyScopeValue, NO_SCOPE } from "../scope.js";
 
 // ==============================================================================
@@ -100,52 +100,83 @@ function _resolveAccess() {
         case 9:
           session = _context.t0;
           if (!(access !== null && access !== void 0 && access.can)) {
-            _context.next = 19;
+            _context.next = 33;
             break;
           }
           if (session) {
-            _context.next = 13;
+            _context.next = 17;
             break;
           }
-          throw new HttpError(401, "未登录");
-        case 13:
+          _context.t1 = HttpError;
           _context.next = 15;
+          return httpErrorMessages();
+        case 15:
+          _context.t2 = _context.sent.unauthenticated;
+          throw new _context.t1(401, _context.t2);
+        case 17:
+          _context.next = 19;
           return access.can({
             method: method,
             session: session
           });
-        case 15:
+        case 19:
           verdict = _context.sent;
           if (!(verdict !== true)) {
-            _context.next = 19;
+            _context.next = 33;
             break;
           }
           denial = _typeof(verdict) === "object" ? verdict : {};
-          throw new HttpError((_denial$status = denial.status) !== null && _denial$status !== void 0 ? _denial$status : 403, (_denial$message = denial.message) !== null && _denial$message !== void 0 ? _denial$message : "没有权限");
-        case 19:
+          _context.t3 = HttpError;
+          _context.t4 = (_denial$status = denial.status) !== null && _denial$status !== void 0 ? _denial$status : 403;
+          if (!((_denial$message = denial.message) !== null && _denial$message !== void 0)) {
+            _context.next = 28;
+            break;
+          }
+          _context.t5 = _denial$message;
+          _context.next = 31;
+          break;
+        case 28:
+          _context.next = 30;
+          return httpErrorMessages();
+        case 30:
+          _context.t5 = _context.sent.forbidden;
+        case 31:
+          _context.t6 = _context.t5;
+          throw new _context.t3(_context.t4, _context.t6);
+        case 33:
           if (wantsScope) {
-            _context.next = 21;
+            _context.next = 35;
             break;
           }
           return _context.abrupt("return", {
             scope: NO_SCOPE,
             session: session
           });
-        case 21:
+        case 35:
           if (session) {
-            _context.next = 23;
+            _context.next = 41;
             break;
           }
-          throw new HttpError(401, "未登录");
-        case 23:
+          _context.t7 = HttpError;
+          _context.next = 39;
+          return httpErrorMessages();
+        case 39:
+          _context.t8 = _context.sent.unauthenticated;
+          throw new _context.t7(401, _context.t8);
+        case 41:
           column = (_access$scope$column = access === null || access === void 0 || (_access$scope = access.scope) === null || _access$scope === void 0 ? void 0 : _access$scope.column) !== null && _access$scope$column !== void 0 ? _access$scope$column : DEFAULT_SCOPE_COLUMN;
           value = access !== null && access !== void 0 && access.scope ? access.scope.value(session) : session.userId;
           if (!isEmptyScopeValue(value)) {
-            _context.next = 27;
+            _context.next = 49;
             break;
           }
-          throw new HttpError(403, "\u65E0\u6CD5\u786E\u5B9A\u8FD9\u6B21\u8BF7\u6C42\u7684\u5F52\u5C5E\uFF08".concat(column, "\uFF09\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u505A\u9694\u79BB\u300D\u2014\u2014\u8BF7\u6C42\u88AB\u62D2\u7EDD\u3002"));
-        case 27:
+          _context.t9 = HttpError;
+          _context.next = 47;
+          return httpErrorMessages();
+        case 47:
+          _context.t10 = _context.sent.scopeUnresolved(column);
+          throw new _context.t9(403, _context.t10);
+        case 49:
           return _context.abrupt("return", {
             scope: {
               column: column,
@@ -153,7 +184,7 @@ function _resolveAccess() {
             },
             session: session
           });
-        case 28:
+        case 50:
         case "end":
           return _context.stop();
       }

package/lib/backend/actions/write-action-core.js

@@ -39,11 +39,11 @@ function createPutActionCore({
   return async (body, { scope }) => {
     const id = body.id;
     if (!id) {
-      throw new import_errors.HttpError(400, "缺少 id");
+      throw new import_errors.HttpError(400, (await (0, import_errors.httpErrorMessages)()).missingId);
     }
     const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where(byId(table, id, scope)).returning();
     if (!data && scope !== import_scope.NO_SCOPE) {
-      throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
+      throw new import_errors.HttpError(404, (await (0, import_errors.httpErrorMessages)()).editNotFound);
     }
     return data;
   };
@@ -54,11 +54,11 @@ function createDeleteActionCore({
 }) {
   return async ({ id }, { scope }) => {
     if (!id) {
-      throw new import_errors.HttpError(400, "缺少 id");
+      throw new import_errors.HttpError(400, (await (0, import_errors.httpErrorMessages)()).missingId);
     }
     const rows = await db.delete(table).where(byId(table, id, scope)).returning();
     if (rows.length === 0 && scope !== import_scope.NO_SCOPE) {
-      throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
+      throw new import_errors.HttpError(404, (await (0, import_errors.httpErrorMessages)()).deleteNotFound);
     }
     return rows;
   };

package/lib/backend/errors.d.ts

@@ -2,3 +2,33 @@ export declare class HttpError extends Error {
     status: number;
     constructor(status: number, message: string);
 }
+export interface HttpErrorMessages {
+    /** 401：会话不存在。 */
+    unauthenticated: string;
+    /** 403：access.can 拒绝且没给自定义文案。 */
+    forbidden: string;
+    /** 400：PUT / DELETE 请求体缺 id。 */
+    missingId: string;
+    /** 404：PUT 影响 0 行（不存在或不属于调用者）。 */
+    editNotFound: string;
+    /** 404：DELETE 影响 0 行。 */
+    deleteNotFound: string;
+    /** 403：作用域值解析不出来 —— 多半是配错了列名，但请求照样要被拒绝。 */
+    scopeUnresolved: (column: string) => string;
+}
+export declare const defaultHttpErrorMessages: HttpErrorMessages;
+type HttpErrorMessageResolver = () => Partial<HttpErrorMessages> | Promise<Partial<HttpErrorMessages>>;
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export declare function setHttpErrorMessageResolver(next: HttpErrorMessageResolver | undefined): void;
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export declare function httpErrorMessages(): Promise<HttpErrorMessages>;
+export {};

package/lib/backend/errors.js

@@ -19,7 +19,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/backend/errors.ts
 var errors_exports = {};
 __export(errors_exports, {
-  HttpError: () => HttpError
+  HttpError: () => HttpError,
+  defaultHttpErrorMessages: () => defaultHttpErrorMessages,
+  httpErrorMessages: () => httpErrorMessages,
+  setHttpErrorMessageResolver: () => setHttpErrorMessageResolver
 });
 module.exports = __toCommonJS(errors_exports);
 var HttpError = class extends Error {
@@ -29,7 +32,31 @@ var HttpError = class extends Error {
     this.status = status;
   }
 };
+var defaultHttpErrorMessages = {
+  unauthenticated: "未登录",
+  forbidden: "没有权限",
+  missingId: "缺少 id",
+  editNotFound: "未找到编辑对象，或没有权限",
+  deleteNotFound: "未找到删除对象，或没有权限",
+  scopeUnresolved: (column) => `无法确定这次请求的归属（${column}）。这不是「不做隔离」——请求被拒绝。`
+};
+var resolver;
+function setHttpErrorMessageResolver(next) {
+  resolver = next;
+}
+async function httpErrorMessages() {
+  let overrides;
+  try {
+    overrides = await (resolver == null ? void 0 : resolver());
+  } catch {
+    overrides = void 0;
+  }
+  return { ...defaultHttpErrorMessages, ...overrides };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  HttpError
+  HttpError,
+  defaultHttpErrorMessages,
+  httpErrorMessages,
+  setHttpErrorMessageResolver
 });

package/lib/backend/route-operation/operation-common.js

@@ -49,26 +49,29 @@ async function resolveAccess({
   const session = wantsScope || (access == null ? void 0 : access.can) || (access == null ? void 0 : access.stamp) ? await loadSession() : void 0;
   if (access == null ? void 0 : access.can) {
     if (!session) {
-      throw new import_errors.HttpError(401, "未登录");
+      throw new import_errors.HttpError(401, (await (0, import_errors.httpErrorMessages)()).unauthenticated);
     }
     const verdict = await access.can({ method, session });
     if (verdict !== true) {
       const denial = typeof verdict === "object" ? verdict : {};
-      throw new import_errors.HttpError(denial.status ?? 403, denial.message ?? "没有权限");
+      throw new import_errors.HttpError(
+        denial.status ?? 403,
+        denial.message ?? (await (0, import_errors.httpErrorMessages)()).forbidden
+      );
     }
   }
   if (!wantsScope) {
     return { scope: import_scope.NO_SCOPE, session };
   }
   if (!session) {
-    throw new import_errors.HttpError(401, "未登录");
+    throw new import_errors.HttpError(401, (await (0, import_errors.httpErrorMessages)()).unauthenticated);
   }
   const column = ((_a = access == null ? void 0 : access.scope) == null ? void 0 : _a.column) ?? DEFAULT_SCOPE_COLUMN;
   const value = (access == null ? void 0 : access.scope) ? access.scope.value(session) : session.userId;
   if ((0, import_scope.isEmptyScopeValue)(value)) {
     throw new import_errors.HttpError(
       403,
-      `无法确定这次请求的归属（${column}）。这不是「不做隔离」——请求被拒绝。`
+      (await (0, import_errors.httpErrorMessages)()).scopeUnresolved(column)
     );
   }
   return { scope: { column, value }, session };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"