@mokuyoaxis/dsh-iris 0.2.7 → 0.3.0-alpha.1

package/lib/local-api-projection.js

@@ -1,9 +1,10 @@
 // HTTP DTOs whitelist existing Core facts; never expose records or configuration wholesale.
+import { isAudioRecipe } from './audio-flow-input.js';
 const STATUSES = new Set(['not_started', 'running', 'needs_attention', 'delivery_failed',
-  'needs_comparison', 'awaiting_selection', 'selected']);
+  'needs_comparison', 'needs_result', 'awaiting_selection', 'selected', 'ready']);
 
 export function projectLocalApiFlow(facts) {
-  if (facts.contractVersion !== 0 || facts.run.recipe !== 'image-edit/v0' || !STATUSES.has(facts.status)) {
+  if (facts.contractVersion !== 0 || !['image-edit/v0', 'image-generate/v0'].includes(facts.run.recipe) && !isAudioRecipe(facts.run.recipe) || !STATUSES.has(facts.status)) {
     throw new TypeError('不支持的流程契约或状态');
   }
   const { run, task } = facts;
@@ -11,8 +12,10 @@ export function projectLocalApiFlow(facts) {
   return {
     contractVersion: 0, id: run.id, recipe: run.recipe, revision: run.revision,
     createdAt: run.createdAt, updatedAt: run.updatedAt, status: facts.status,
-    input: { prompt: run.input.prompt, modelRef: run.input.model_ref,
-      ...(run.input.size !== undefined ? { size: run.input.size } : {}) },
+    input: { ...(isAudioRecipe(run.recipe) ? run.recipe === 'speech/v0' ? { text: run.input.text,
+      ...(run.input.voice !== undefined ? { voice: run.input.voice } : {}) } : {} : { prompt: run.input.prompt }), modelRef: run.input.model_ref,
+      ...(run.input.size !== undefined ? { size: run.input.size } : {}),
+      ...(run.input.workflow_parameters !== undefined ? { workflowParameters: run.input.workflow_parameters } : {}) },
     source: ref(run.source), output: ref(run.output), comparison: ref(run.comparison), selection: ref(run.selection),
     task: task ? { id: task.id, acceptance: task.acceptance, outcome: task.outcome,
       deliveryState: task.deliveryState, attemptCount: task.attempts.length } : null,
@@ -23,5 +26,7 @@ export function projectLocalApiFlow(facts) {
 
 export function projectLocalApiRunSummary(run) {
   return { id: run.id, recipe: run.recipe, createdAt: run.createdAt,
-    modelRef: run.modelRef, source: { artifactId: run.source.artifactId } };
+    updatedAt: run.updatedAt, revision: run.revision, modelRef: run.input.model_ref,
+    source: run.source ? { artifactId: run.source.artifactId } : null, output: run.output ? { artifactId: run.output.artifactId } : null,
+    selection: run.selection ? { artifactId: run.selection.artifactId } : null };
 }

package/lib/local-api-token-directory.js

@@ -0,0 +1,31 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { writeLocalApiTokenFile } from './local-api.js';
+
+const invalid = message => { throw Object.assign(new Error(message), { code: 'IRIS_API_TOKEN_DIRECTORY_INVALID' }); };
+
+/** The explicitly chosen directory may be new; its parent must exist. No chmod or cleanup. */
+export function checkLocalApiTokenDirectory(directory, dataRoot) {
+  if (typeof directory !== 'string' || !path.isAbsolute(directory)) invalid('token-dir 必须是根外私有目录的绝对路径');
+  const supplied = path.resolve(directory);
+  let info;
+  try { info = fs.lstatSync(supplied); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (info && (!info.isDirectory() || info.isSymbolicLink() || process.platform !== 'win32' && info.mode & 0o077)) {
+    invalid('token-dir 必须是私有真实目录（POSIX 0700）；不会修改已有目录权限');
+  }
+  const resolved = info ? fs.realpathSync(supplied) : path.join(fs.realpathSync(path.dirname(supplied)), path.basename(supplied));
+  const physical = info ? fs.realpathSync.native(supplied) : path.join(fs.realpathSync.native(path.dirname(supplied)), path.basename(supplied));
+  const relative = path.relative(fs.realpathSync.native(dataRoot), physical);
+  if (!relative || relative !== '..' && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative)) invalid('token-dir 必须位于 Core 数据根之外');
+  return resolved;
+}
+
+export function writeLocalApiTokenDirectory(directory, token, dataRoot) {
+  const target = checkLocalApiTokenDirectory(directory, dataRoot);
+  if (!fs.existsSync(target)) fs.mkdirSync(target, { mode: 0o700 });
+  const file = path.join(target, 'session-' + crypto.randomUUID() + '.token');
+  writeLocalApiTokenFile(file, token, dataRoot);
+  return file;
+}