@musnows/scriverse 0.6.0 → 0.6.2

package/dist/app.js

@@ -14,14 +14,14 @@ import { AiManager } from "./ai.js";
 import { CredentialVault } from "./credential-vault.js";
 import { Database } from "./database.js";
 import { assertSafeDocxArchive } from "./docx-security.js";
-import { TASK_TYPES } from "./domain.js";
+import { DRAFT_SETTING_MODULES, TASK_TYPES } from "./domain.js";
 import { AppError } from "./errors.js";
 import { HYBRID_SEARCH_TYPES } from "./hybrid-search.js";
 import { applyImportFileHints, parseNovelText } from "./parser.js";
-import { Store, versionedEntityTypes } from "./store.js";
-import { parsePagination } from "./pagination.js";
+import { attachmentPermissionModules, Store, versionedEntityTypes } from "./store.js";
+import { paginated, parsePagination } from "./pagination.js";
 import { normalizeUploadFileName } from "./utils.js";
-import { assertSafeAiEndpoint, createApiRateLimitMiddleware, createAuthenticationRateLimitMiddleware, createBasicAuthMiddleware, createSameOriginMiddleware, createSecurityHeadersMiddleware } from "./security.js";
+import { assertSafeAiEndpoint, createApiRateLimitMiddleware, createAuthenticationRateLimitMiddleware, createBasicAuthMiddleware, createSameOriginMiddleware, createSecurityHeadersMiddleware, createUploadRateLimitMiddleware, verifySetupToken } from "./security.js";
 import { ImageCaptchaService } from "./image-captcha.js";
 import { assertSafeImportedPlainText, decodeUtf8ImportedText } from "./import-security.js";
 import { InvalidRasterImageError, readRasterImageMetadata } from "./image-metadata.js";
@@ -29,7 +29,7 @@ import { createRequestLoggingMiddleware, sanitizeRequestPath } from "./http-logg
 import { accountReference, logger, sanitizeError } from "./logger.js";
 import { currentRequestActor, runWithRequestActor } from "./request-context.js";
 import { APP_VERSION } from "./version.js";
-import { fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
+import { canReadWorkModule, canWriteWorkModule, fullWorkModulePermissions, proseReplacementPermissionModules } from "./work-permissions.js";
 import { CollaborationPresence, entityEditorPageKey, presencePageKinds } from "./collaboration-presence.js";
 import { analysisTaskReadModules, clearSessionCookie, createCliApiScopeMiddleware, createUserSessionMiddleware, createWorkAuthorizationMiddleware, relationshipAnalysisReadModules, setSessionCookie, UserAuthService } from "./user-auth.js";
 const nonEmpty = z.string().trim().min(1);
@@ -38,6 +38,7 @@ const optionalStrings = z.array(z.string()).optional();
 const jsonObject = z.record(z.string(), z.unknown());
 const chapterTypeSchema = z.enum(["正文", "设定", "作者的话", "其他"]);
 const versionedEntityTypeSchema = z.enum(versionedEntityTypes);
+const attachmentPermissionModuleSchema = z.enum(attachmentPermissionModules);
 const maximumImportedTextLength = 20_000_000;
 const maximumKnowledgeSectionsLength = 4_000_000;
 const captchaFields = {
@@ -50,6 +51,7 @@ const registrationSchema = z.object({
     username: usernameSchema,
     password: passwordSchema,
     passwordConfirmation: passwordSchema,
+    setupToken: z.string().max(500).optional(),
     ...captchaFields
 }).strict().refine((input) => input.password === input.passwordConfirmation, {
     path: ["passwordConfirmation"],
@@ -103,7 +105,7 @@ const presenceHeartbeatSchema = z.object({
     page: z.discriminatedUnion("kind", [
         z.object({ kind: z.literal(presencePageKinds[0]) }).strict(),
         z.object({ kind: z.literal(presencePageKinds[1]), resourceId: identifier }).strict(),
-        z.object({ kind: z.literal(presencePageKinds[2]), module: z.enum(["drafts", "settings", "characters", "races", "organizations", "timeline", "relationships", "outlines", "reviews", "tasks", "ai-settings"]) }).strict(),
+        z.object({ kind: z.literal(presencePageKinds[2]), module: z.enum(["drafts", "settings", "characters", "races", "organizations", "timeline", "comments", "relationships", "outlines", "reviews", "tasks", "ai-settings"]) }).strict(),
         z.object({ kind: z.literal(presencePageKinds[3]), module: z.enum(["setting", "character", "race", "organization", "relationship"]), resourceId: identifier.optional() }).strict(),
         z.object({ kind: z.literal(presencePageKinds[4]) }).strict()
     ])
@@ -144,6 +146,8 @@ const settingSchema = z.object({
 });
 const draftSchema = z.object({
     draftType: z.enum(["prose", "setting"]),
+    volumeId: identifier.nullable().optional(),
+    settingModule: z.enum(DRAFT_SETTING_MODULES).nullable().optional(),
     title: nonEmpty.max(200),
     content: z.string().max(200_000)
 }).strict();
@@ -300,7 +304,7 @@ const modelSchema = z.object({
     modelId: nonEmpty.max(300),
     purposes: optionalStrings,
     contextNote: z.string().max(10_000).optional(),
-    contextWindow: z.number().int().min(1_024).max(2_000_000).optional(),
+    contextWindow: z.number().int().min(32_768, "模型上下文不能低于 32768 Token").max(2_000_000).optional(),
     outputNote: z.string().max(10_000).optional(),
     preset: jsonObject.optional(),
     thinkingEnabled: z.boolean().optional(),
@@ -322,6 +326,7 @@ const platformPageSizesSchema = z.object({
     timeline: z.number().int().min(10).max(100).optional(),
     outlines: z.number().int().min(10).max(100).optional(),
     relationships: z.number().int().min(10).max(100).optional(),
+    comments: z.number().int().min(10).max(100).optional(),
     reviews: z.number().int().min(10).max(100).optional(),
     analysisTasks: z.number().int().min(10).max(100).optional(),
     fileVersions: z.number().int().min(10).max(100).optional()
@@ -361,6 +366,15 @@ const aiProcessStepSchema = z.discriminatedUnion("type", [
         round: z.number().int().min(1).max(20),
         toolCall: aiToolCallResultSchema,
         createdAt: z.string().datetime({ offset: true })
+    }).strict(),
+    z.object({
+        id: z.string().min(1).max(300),
+        type: z.literal("context_compaction"),
+        round: z.number().int().min(1).max(20),
+        sourceMessageCount: z.number().int().min(1).max(100),
+        sourceChars: z.number().int().min(1).max(10_000_000),
+        summaryChars: z.number().int().min(1).max(1_000_000),
+        createdAt: z.string().datetime({ offset: true })
     }).strict()
 ]);
 const workAiSettingsSchema = z.object({
@@ -586,6 +600,32 @@ function redactTaskCharacterNames(record, permissions) {
     }
     return result;
 }
+function redactAiCallContext(record, permissions) {
+    const result = { ...record };
+    const scope = recordValue(result.contextScope);
+    if (!scope)
+        return result;
+    const redactedScope = { ...scope };
+    let restricted = false;
+    if (permissions.prose === "none") {
+        for (const field of ["selection", "chapterId", "volumeId", "chapterIds", "includeBookSummary"]) {
+            if (field in redactedScope) {
+                delete redactedScope[field];
+                restricted = true;
+            }
+        }
+    }
+    if (permissions.characters === "none" && "characterIds" in redactedScope) {
+        delete redactedScope.characterIds;
+        restricted = true;
+    }
+    if (permissions.settings === "none" && "settingIds" in redactedScope) {
+        delete redactedScope.settingIds;
+        restricted = true;
+    }
+    result.contextScope = restricted ? { ...redactedScope, restricted: true } : redactedScope;
+    return result;
+}
 function redactMergeRecords(value, mapper) {
     const record = recordValue(value);
     if (!record)
@@ -632,6 +672,32 @@ export function createRuntime(options) {
         ? auth.listUsers().find((user) => user.status === "active") ?? null
         : null;
     const store = new Store(database);
+    let attachmentCleanupChain = Promise.resolve();
+    const cleanupAttachments = () => {
+        const cleanup = attachmentCleanupChain.then(async () => {
+            store.queueUnreferencedAttachments();
+            for (const queued of store.listAttachmentCleanupQueue()) {
+                if (!store.attachmentCleanupStillRequired(queued.storageKey)) {
+                    store.completeAttachmentCleanup(queued.storageKey);
+                    continue;
+                }
+                try {
+                    await attachmentStorage.remove(queued.storageKey);
+                    store.completeAttachmentCleanup(queued.storageKey);
+                }
+                catch (error) {
+                    store.failAttachmentCleanup(queued.storageKey, error instanceof Error ? error.message : "Attachment cleanup failed");
+                    logger.warn("attachment.cleanup.failed", {
+                        storageKey: queued.storageKey,
+                        attempts: queued.attempts + 1,
+                        error: sanitizeError(error)
+                    });
+                }
+            }
+        });
+        attachmentCleanupChain = cleanup.catch(() => undefined);
+        return cleanup;
+    };
     const requestPermissions = (request, workId) => {
         if (!request.authUser)
             return fullWorkModulePermissions();
@@ -699,14 +765,16 @@ export function createRuntime(options) {
     app.get("/api/auth/session", (request, response) => {
         const session = auth.authenticate(request);
         const registrationOpen = options.security?.allowRegistration === true;
+        const setupRequired = !auth.hasUsers();
+        const setupTokenRequired = setupRequired && Boolean(options.security?.setupToken);
         const developmentUser = getDevelopmentUser();
         if (!session && developmentUser) {
-            data(response, { authenticated: true, user: developmentUser, csrfToken: null, setupRequired: false, registrationOpen });
+            data(response, { authenticated: true, user: developmentUser, csrfToken: null, setupRequired: false, setupTokenRequired: false, registrationOpen });
             return;
         }
         data(response, session
-            ? { authenticated: true, user: session.user, csrfToken: session.csrfToken, setupRequired: false, registrationOpen }
-            : { authenticated: false, user: null, csrfToken: null, setupRequired: !auth.hasUsers(), registrationOpen });
+            ? { authenticated: true, user: session.user, csrfToken: session.csrfToken, setupRequired: false, setupTokenRequired: false, registrationOpen }
+            : { authenticated: false, user: null, csrfToken: null, setupRequired, setupTokenRequired, registrationOpen });
     });
     app.get("/api/auth/captcha", (_request, response) => {
         data(response, captcha.create());
@@ -717,6 +785,9 @@ export function createRuntime(options) {
         }
         const input = parse(registrationSchema, request.body);
         captcha.consume(input.captchaId, input.captchaAnswer);
+        if (!auth.hasUsers() && !verifySetupToken(options.security?.setupToken, input.setupToken)) {
+            throw new AppError(403, "SETUP_TOKEN_INVALID", "初始化令牌无效或未配置");
+        }
         const result = auth.register({ username: input.username, password: input.password });
         setSessionCookie(response, result.token, request.secure);
         runWithRequestActor(result.session.user, () => store.audit(null, "user.registered", "user", result.session.user.userId, { role: result.session.user.role }));
@@ -736,6 +807,7 @@ export function createRuntime(options) {
         disabled: options.disableUserAuth === true,
         resolveBypassUser: getDevelopmentUser
     }));
+    app.use(createUploadRateLimitMiddleware());
     app.use(createCliApiScopeMiddleware(options.disableUserAuth));
     app.use(createWorkAuthorizationMiddleware(auth, options.disableUserAuth));
     app.get("/api/cli/session", (request, response) => {
@@ -935,8 +1007,8 @@ export function createRuntime(options) {
     });
     app.delete("/api/works/:workId", async (request, response) => {
         const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
-        const removableStorageKeys = store.deleteWork(request.params.workId, input.expectedVersionNo);
-        await Promise.all(removableStorageKeys.map((storageKey) => attachmentStorage.remove(storageKey)));
+        store.deleteWork(request.params.workId, input.expectedVersionNo);
+        await cleanupAttachments();
         noContent(response);
     });
     app.get("/api/works/:workId/cover", (request, response) => {
@@ -951,14 +1023,16 @@ export function createRuntime(options) {
         if (!request.file)
             throw new AppError(400, "FILE_REQUIRED", "请选择 PNG、JPEG 或 WebP 封面");
         const bytes = request.file.buffer;
-        const isPng = bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
-        const isJpeg = bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
-        const isWebp = bytes.length >= 12 && bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP";
-        const mimeType = isPng ? "image/png" : isJpeg ? "image/jpeg" : isWebp ? "image/webp" : null;
-        if (!mimeType)
-            throw new AppError(415, "INVALID_COVER", "封面文件内容不是有效的 PNG、JPEG 或 WebP 图片");
-        const expectedVersionNo = parse(expectedVersionNoSchema, request.body.expectedVersionNo);
-        data(response, store.setWorkCover(String(request.params.workId), mimeType, bytes, expectedVersionNo));
+        try {
+            const metadata = readRasterImageMetadata(bytes);
+            const expectedVersionNo = parse(expectedVersionNoSchema, request.body.expectedVersionNo);
+            data(response, store.setWorkCover(String(request.params.workId), metadata.mimeType, bytes, expectedVersionNo));
+        }
+        catch (error) {
+            if (error instanceof InvalidRasterImageError)
+                throw new AppError(415, "INVALID_COVER", error.message);
+            throw error;
+        }
     });
     app.delete("/api/works/:workId/cover", (request, response) => {
         const input = parse(z.object({ expectedVersionNo: expectedVersionNoSchema }).strict(), request.body ?? {});
@@ -1049,6 +1123,12 @@ export function createRuntime(options) {
         data(response, pagination ? store.listChapterInsightsPage(request.params.chapterId, pagination) : store.listChapterInsights(request.params.chapterId));
     });
     app.get("/api/chapters/:chapterId/annotations", (request, response) => data(response, store.listChapterAnnotations(request.params.chapterId)));
+    app.get("/api/works/:workId/chapter-annotations", (request, response) => {
+        const pagination = parsePagination(request.query);
+        data(response, pagination
+            ? store.listWorkChapterAnnotationsPage(request.params.workId, pagination)
+            : store.listWorkChapterAnnotations(request.params.workId));
+    });
     app.post("/api/chapters/:chapterId/annotations", (request, response) => {
         const input = parse(z.object({
             kind: z.enum(["note", "todo"]),
@@ -1285,11 +1365,16 @@ export function createRuntime(options) {
     });
     app.get("/api/works/:workId/attachments", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listAttachmentsPage(request.params.workId, pagination) : store.listAttachments(request.params.workId));
+        const permissions = requestPermissions(request, request.params.workId);
+        const readable = store.listAttachments(request.params.workId).filter((attachment) => (store.attachmentModules(String(attachment.id)).some((module) => canReadWorkModule(permissions, module))));
+        data(response, pagination
+            ? paginated(readable.slice(pagination.offset, pagination.offset + pagination.limit + 1), pagination, readable.length)
+            : readable);
     });
     app.post("/api/works/:workId/attachments", attachmentUpload.single("file"), async (request, response) => {
         if (!request.file)
             throw new AppError(400, "FILE_REQUIRED", "请选择要上传的图片附件");
+        const accessModule = parse(attachmentPermissionModuleSchema, request.query.module ?? "settings");
         let storageKey = null;
         try {
             const stored = await attachmentStorage.ingest(request.file.path);
@@ -1297,7 +1382,7 @@ export function createRuntime(options) {
             const result = store.createAttachment(String(request.params.workId), {
                 originalName: normalizeUploadFileName(request.file.originalname),
                 ...stored
-            });
+            }, accessModule);
             data(response, { ...result.attachment, deduplicated: !result.created }, result.created ? 201 : 200);
         }
         catch (error) {
@@ -1314,6 +1399,10 @@ export function createRuntime(options) {
     });
     app.get("/api/attachments/:attachmentId/content", async (request, response) => {
         const attachment = store.getAttachment(request.params.attachmentId);
+        const permissions = requestPermissions(request, String(attachment.workId));
+        if (!store.attachmentModules(request.params.attachmentId).some((module) => canReadWorkModule(permissions, module))) {
+            throw new AppError(403, "WORK_MODULE_READ_DENIED", "你没有读取该附件所属资料模块的权限");
+        }
         const content = await attachmentStorage.read(String(attachment.storageKey));
         response.setHeader("Content-Type", String(attachment.storedMimeType));
         response.setHeader("Content-Length", String(attachment.storedByteLength));
@@ -1323,9 +1412,13 @@ export function createRuntime(options) {
         response.send(content);
     });
     app.delete("/api/attachments/:attachmentId", async (request, response) => {
-        const deleted = store.deleteAttachment(request.params.attachmentId);
-        if (deleted.removeStoredFile)
-            await attachmentStorage.remove(deleted.storageKey);
+        const attachment = store.getAttachment(request.params.attachmentId);
+        const permissions = requestPermissions(request, String(attachment.workId));
+        if (!store.attachmentModules(request.params.attachmentId).some((module) => canWriteWorkModule(permissions, module))) {
+            throw new AppError(403, "WORK_MODULE_WRITE_DENIED", "你没有编辑该附件所属资料模块的权限");
+        }
+        store.deleteAttachment(request.params.attachmentId);
+        await cleanupAttachments();
         noContent(response);
     });
     app.get("/api/works/:workId/races", (request, response) => {
@@ -1683,8 +1776,11 @@ export function createRuntime(options) {
         data(response, updated);
     });
     app.get("/api/works/:workId/ai-conversations", (request, response) => {
-        const pagination = parsePagination(request.query);
-        data(response, pagination ? store.listAiConversationsPage(request.params.workId, pagination) : store.listAiConversations(request.params.workId));
+        const pagination = parsePagination({
+            page: request.query.page ?? "1",
+            limit: request.query.limit ?? "20"
+        }) ?? { page: 1, limit: 20, offset: 0 };
+        data(response, store.listAiConversationsPage(request.params.workId, pagination));
     });
     app.post("/api/works/:workId/ai-conversations", (request, response) => {
         const input = parse(z.object({ title: z.string().max(200).optional() }), request.body ?? {});
@@ -1734,32 +1830,23 @@ export function createRuntime(options) {
     app.post("/api/ai-conversations/:conversationId/compact", async (request, response) => {
         const input = parse(z.object({ modelId: identifier.optional(), scope: contextSchema }), request.body);
         const conversation = store.getAiConversation(request.params.conversationId);
-        data(response, await ai.compactConversation({
+        const compacted = await ai.compactConversation({
             conversationId: request.params.conversationId,
             workId: String(conversation.workId),
             modelId: input.modelId,
             scope: input.scope
-        }));
-    });
-    app.post("/api/works/:workId/ai-context-usage", (request, response) => {
-        const input = parse(z.object({
-            modelId: identifier.optional(),
-            taskType: z.enum(TASK_TYPES).default("chat"),
-            scope: contextSchema,
-            instruction: z.string().max(100_000).default(""),
-            citations: aiCitationsSchema.optional(),
-            conversationId: identifier.optional(),
-            currentMessageId: identifier.optional()
-        }), request.body ?? {});
-        data(response, ai.getContextUsage({
-            workId: request.params.workId,
-            modelId: input.modelId,
-            taskType: input.taskType,
-            scope: input.scope,
-            instruction: instructionWithCitations(input.instruction, input.citations ?? []),
-            conversationId: input.conversationId,
-            excludeConversationMessageId: input.currentMessageId
-        }));
+        });
+        data(response, {
+            ...compacted,
+            usage: ai.getContextUsage({
+                workId: String(conversation.workId),
+                taskType: "chat",
+                instruction: "",
+                conversationId: request.params.conversationId,
+                modelId: input.modelId,
+                scope: input.scope
+            })
+        });
     });
     app.get("/api/works/:workId/providers", (request, response) => {
         store.getWork(request.params.workId);
@@ -1861,6 +1948,40 @@ export function createRuntime(options) {
         };
         sendEvent("ready", { streaming: true });
         try {
+            const conversation = input.conversationId
+                ? store.getAiConversationSummary(input.conversationId)
+                : store.createAiConversation(request.params.workId);
+            if (String(conversation.workId) !== request.params.workId) {
+                throw new AppError(400, "CONVERSATION_WORK_MISMATCH", "AI 对话不属于当前作品");
+            }
+            const conversationId = String(conversation.id);
+            const prepared = await ai.prepareConversationContext({
+                conversationId,
+                workId: request.params.workId,
+                modelId: input.modelId,
+                scope: input.scope,
+                instruction: instructionWithCitations(input.instruction, citations),
+                excludeConversationMessageId: input.currentMessageId
+            });
+            sendEvent("context", {
+                ...prepared,
+                conversation: {
+                    ...store.getAiConversationSummary(conversationId),
+                    contextWarningPending: prepared.action === "warn"
+                }
+            });
+            if (prepared.action === "warn")
+                return;
+            const userMessage = input.currentMessageId
+                ? null
+                : store.addAiConversationMessage(conversationId, {
+                    role: "user",
+                    content: input.instruction,
+                    citations
+                });
+            const currentMessageId = input.currentMessageId ?? String(userMessage?.id ?? "");
+            if (userMessage)
+                sendEvent("user_message", { message: userMessage });
             const suggestion = await ai.createStreamingChat({
                 workId: request.params.workId,
                 instruction: instructionWithCitations(input.instruction, citations),
@@ -1868,9 +1989,10 @@ export function createRuntime(options) {
                 signal: controller.signal,
                 onToolCall: (toolCall, round) => sendEvent("tool_call", { ...toolCall, round }),
                 onProcessStep: (step) => sendEvent("process_step", step),
-                conversationId: input.conversationId,
-                excludeConversationMessageId: input.currentMessageId,
-                ...(input.currentMessageId ? { assistantMessageRequestId: `assistant:${input.currentMessageId}` } : {}),
+                onContextCompacted: (event) => sendEvent("context_compacted", event),
+                conversationId,
+                excludeConversationMessageId: currentMessageId,
+                ...(currentMessageId ? { assistantMessageRequestId: `assistant:${currentMessageId}` } : {}),
                 ...(input.modelId ? { modelId: input.modelId } : {}),
                 ...(input.parameters ? { parameters: input.parameters } : {})
             }, (delta) => sendEvent("delta", { delta }));
@@ -1884,6 +2006,8 @@ export function createRuntime(options) {
                 chapterVersion: suggestion.chapterVersion,
                 toolCalls: suggestion.toolCalls,
                 processSteps: suggestion.processSteps,
+                contextUsage: suggestion.contextUsage,
+                conversationId,
                 conversationTitle: suggestion.conversationTitle,
                 messageId: typeof suggestion.conversationMessage === "object" && suggestion.conversationMessage !== null
                     ? suggestion.conversationMessage.id
@@ -1903,7 +2027,11 @@ export function createRuntime(options) {
                     message: error instanceof Error ? error.message : "AI 流式调用失败",
                     ...(error instanceof AppError ? { status: error.status } : {}),
                     ...(typeof details?.failure === "string" ? { failure: details.failure } : {}),
-                    ...(typeof details?.callId === "string" ? { callId: details.callId } : {})
+                    ...(typeof details?.callId === "string" ? { callId: details.callId } : {}),
+                    ...(typeof details?.providerName === "string" ? { providerName: details.providerName } : {}),
+                    ...(typeof details?.providerId === "string" ? { providerId: details.providerId } : {}),
+                    ...(typeof details?.modelId === "string" ? { modelId: details.modelId } : {}),
+                    ...(typeof details?.modelRecordId === "string" ? { modelRecordId: details.modelRecordId } : {})
                 });
             }
         }
@@ -1930,7 +2058,10 @@ export function createRuntime(options) {
     app.post("/api/suggestions/:suggestionId/reject", (request, response) => data(response, ai.rejectSuggestion(request.params.suggestionId)));
     app.get("/api/works/:workId/ai-calls", (request, response) => {
         const pagination = parsePagination(request.query);
-        data(response, pagination ? ai.listCallsPage(request.params.workId, pagination) : ai.listCalls(request.params.workId));
+        const permissions = requestPermissions(request, request.params.workId);
+        data(response, pagination
+            ? mapRecords(ai.listCallsPage(request.params.workId, pagination), (call) => redactAiCallContext(call, permissions))
+            : ai.listCalls(request.params.workId).map((call) => redactAiCallContext(call, permissions)));
     });
     app.get("/api/works/:workId/search", async (request, response) => {
         const query = parse(z.object({
@@ -2084,7 +2215,7 @@ export function createRuntime(options) {
         response.status(500).json({ error: { code: "INTERNAL_ERROR", message: "服务器内部错误" } });
     });
     logger.info("runtime.ready", { serveUi: options.serveUi ?? true });
-    return { app, database, store, ai, auth, attachmentStorage, close: () => {
+    return { app, database, store, ai, auth, attachmentStorage, cleanupAttachments, close: () => {
             logger.info("runtime.closing");
             ai.dispose();
             database.close();