@musnows/scriverse 0.6.3 → 0.6.5

package/dist/app.js

@@ -9,6 +9,7 @@ import { rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { z, ZodError } from "zod";
+import { AI_PROVIDER_PROTOCOLS } from "./ai-protocol.js";
 import { AttachmentStorage } from "./attachment-storage.js";
 import { AiManager } from "./ai.js";
 import { CredentialVault } from "./credential-vault.js";
@@ -16,9 +17,10 @@ import { Database } from "./database.js";
 import { assertSafeDocxArchive } from "./docx-security.js";
 import { DRAFT_SETTING_MODULES, TASK_TYPES } from "./domain.js";
 import { AppError } from "./errors.js";
+import { isOfficialGoogleVertexBaseUrl, parseGoogleServiceAccount } from "./google-vertex-auth.js";
 import { HYBRID_SEARCH_TYPES } from "./hybrid-search.js";
 import { applyImportFileHints, parseNovelText } from "./parser.js";
-import { attachmentPermissionModules, Store, versionedEntityTypes } from "./store.js";
+import { aiConversationTaskTypes, attachmentPermissionModules, Store, versionedEntityTypes } from "./store.js";
 import { paginated, parsePagination } from "./pagination.js";
 import { normalizeUploadFileName } from "./utils.js";
 import { assertSafeAiEndpoint, createApiRateLimitMiddleware, createAuthenticationRateLimitMiddleware, createBasicAuthMiddleware, createCaptchaRateLimitMiddleware, createExpensiveApiRateLimitMiddleware, createSameOriginMiddleware, createSecurityHeadersMiddleware, createUploadRateLimitMiddleware, enforceCaseInsensitiveRouting, normalizeApiPath, resolveTrustProxySetting, verifySetupToken } from "./security.js";
@@ -37,6 +39,7 @@ const identifier = z.string().trim().min(1).max(200);
 const optionalStrings = z.array(z.string()).optional();
 const jsonObject = z.record(z.string(), z.unknown());
 const chapterTypeSchema = z.enum(["正文", "设定", "作者的话", "其他"]);
+const aiConversationTaskTypeSchema = z.enum(aiConversationTaskTypes);
 const versionedEntityTypeSchema = z.enum(versionedEntityTypes);
 const attachmentPermissionModuleSchema = z.enum(attachmentPermissionModules);
 const maximumImportedTextLength = 20_000_000;
@@ -289,16 +292,54 @@ const reviewSchema = z.object({
     status: z.enum(["pending", "ignored", "fixing", "fixed", "exception"]).optional(),
     resolutionNote: z.string().max(20_000).optional()
 });
-const providerSchema = z.object({
+const providerBaseSchema = z.object({
     name: nonEmpty.max(200),
     baseUrl: z.string().url().refine((value) => value.startsWith("http://") || value.startsWith("https://"), "接口地址必须使用 HTTP 或 HTTPS"),
-    apiKey: nonEmpty.max(10_000),
-    protocol: z.enum(["openai-chat-completions", "anthropic-messages"]).optional(),
+    apiKey: z.string().trim().min(1).max(50_000),
+    protocol: z.enum(AI_PROVIDER_PROTOCOLS).optional(),
     status: z.enum(["enabled", "disabled"]).optional(),
     note: z.string().max(10_000).optional(),
     concurrencyLimit: z.number().int().min(1).max(100).optional(),
     rpmLimit: z.number().int().min(1).max(10_000).optional()
 });
+function refineProviderApiKey(value, ctx) {
+    if (value.protocol === "google-vertex" && value.baseUrl && !isOfficialGoogleVertexBaseUrl(value.baseUrl)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["baseUrl"],
+            message: "Google Vertex 接口地址必须使用官方 aiplatform.googleapis.com 或 *-aiplatform.googleapis.com 域名"
+        });
+    }
+    if (!value.apiKey)
+        return;
+    const protocol = value.protocol ?? "openai-chat-completions";
+    if (protocol === "google-vertex") {
+        try {
+            parseGoogleServiceAccount(value.apiKey);
+        }
+        catch (error) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["apiKey"],
+                message: error instanceof AppError ? error.message : "服务账号 JSON 无效"
+            });
+        }
+        return;
+    }
+    if (value.apiKey.length > 10_000) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["apiKey"],
+            message: "API 密钥过长"
+        });
+    }
+}
+const providerSchema = providerBaseSchema.superRefine((value, ctx) => {
+    refineProviderApiKey(value, ctx);
+});
+const providerUpdateSchema = providerBaseSchema.partial().superRefine((value, ctx) => {
+    refineProviderApiKey(value, ctx);
+});
 const modelSchema = z.object({
     displayName: nonEmpty.max(200),
     modelId: nonEmpty.max(300),
@@ -390,17 +431,22 @@ const workAiSettingsSchema = z.object({
     agentToolCallLimit: z.number().int().min(5).max(48).optional(),
     agentToolCallGlobalMultiplier: z.number().int().min(1).max(6).optional(),
     agentTools: z.array(z.enum(["story_index", "read_chapters", "grep", "search_story_entities", "read_character_sections", "search_drafts"])).max(6).optional(),
+    alwaysIncludeSettingInfo: z.boolean().optional(),
     titleGenerationModelId: z.string().trim().max(200).optional()
 }).strict();
 const contextSchema = z.object({
-    type: z.enum(["none", "selection", "chapter", "volume", "book", "entities"]),
+    type: z.enum(["none", "selection", "chapter", "volume", "book", "settings-catalog", "entities"]),
     chapterId: identifier.optional(),
     volumeId: identifier.optional(),
     selection: z.string().max(200_000).optional(),
     chapterIds: z.array(identifier).max(20).optional(),
     characterIds: optionalStrings,
+    mentionCharacterIds: optionalStrings,
     settingIds: optionalStrings,
-    includeBookSummary: z.boolean().optional()
+    raceIds: optionalStrings,
+    organizationIds: optionalStrings,
+    includeBookSummary: z.boolean().optional(),
+    includeSettingInfo: z.boolean().optional()
 });
 const analysisTaskTypeSchema = z.enum(["structure", "chapter-analysis", "character-extraction", "character-summary", "character-identity-audit", "timeline-analysis", "worldview-analysis", "setting-extraction", "consistency-check", "report-update", "book-analysis"]);
 const relationshipSourceRefSchema = z.object({
@@ -622,6 +668,18 @@ function redactAiCallContext(record, permissions) {
         delete redactedScope.characterIds;
         restricted = true;
     }
+    if (permissions.characters === "none" && "mentionCharacterIds" in redactedScope) {
+        delete redactedScope.mentionCharacterIds;
+        restricted = true;
+    }
+    if (permissions.races === "none" && "raceIds" in redactedScope) {
+        delete redactedScope.raceIds;
+        restricted = true;
+    }
+    if (permissions.organizations === "none" && "organizationIds" in redactedScope) {
+        delete redactedScope.organizationIds;
+        restricted = true;
+    }
     if (permissions.settings === "none" && "settingIds" in redactedScope) {
         delete redactedScope.settingIds;
         restricted = true;
@@ -670,10 +728,12 @@ function redactAiConversationMessage(item, permissions) {
 }
 /** 无正文读取权限时隐藏对话预览与消息正文，避免历史对话泄露章节原文。 */
 function redactAiConversation(record, permissions) {
+    const readableRecord = permissions.characters === "none" ? { ...record, roleplayCharacter: null } : record;
+    const scopedRecord = redactAiCallContext(readableRecord, permissions);
     if (permissions.prose !== "none")
-        return record;
+        return scopedRecord;
     const result = {
-        ...record,
+        ...scopedRecord,
         title: proseRestrictedPlaceholder
     };
     if (typeof result.preview === "string" && result.preview.length > 0) {
@@ -691,7 +751,7 @@ function redactAiConversation(record, permissions) {
     }
     return { ...result, restricted: true };
 }
-/** SSE 错误事件只暴露 AppError 的公开信息，避免透传内部异常 message。 */
+/** SSE 错误事件只暴露 AppError 的公开信息；AI_CALL_FAILED 的 failure 已在 AI 层完成密钥脱敏。 */
 export function publicAiStreamError(error) {
     if (error instanceof AppError) {
         const details = error.details && typeof error.details === "object" && !Array.isArray(error.details)
@@ -701,7 +761,7 @@ export function publicAiStreamError(error) {
             code: error.code,
             message: error.message,
             status: error.status,
-            ...(error.status < 500 && typeof details?.failure === "string" ? { failure: details.failure } : {}),
+            ...((error.status < 500 || error.code === "AI_CALL_FAILED") && typeof details?.failure === "string" ? { failure: details.failure } : {}),
             ...(typeof details?.callId === "string" ? { callId: details.callId } : {}),
             ...(typeof details?.providerName === "string" ? { providerName: details.providerName } : {}),
             ...(typeof details?.providerId === "string" ? { providerId: details.providerId } : {}),
@@ -843,7 +903,7 @@ export function createRuntime(options) {
             bootId,
             version: APP_VERSION,
             protocol: "openai-chat-completions",
-            protocols: ["openai-chat-completions", "anthropic-messages"],
+            protocols: [...AI_PROVIDER_PROTOCOLS],
             development: options.developmentServer === true
         });
     });
@@ -1880,8 +1940,11 @@ export function createRuntime(options) {
         data(response, mapRecords(store.listAiConversationsPage(request.params.workId, pagination), (conversation) => (redactAiConversation(conversation, permissions))));
     });
     app.post("/api/works/:workId/ai-conversations", (request, response) => {
-        const input = parse(z.object({ title: z.string().max(200).optional() }), request.body ?? {});
-        data(response, store.createAiConversation(request.params.workId, input.title), 201);
+        const input = parse(z.object({
+            title: z.string().max(200).optional(),
+            taskType: aiConversationTaskTypeSchema.optional()
+        }).strict(), request.body ?? {});
+        data(response, store.createAiConversation(request.params.workId, input.title, input.taskType), 201);
     });
     app.get("/api/ai-conversations/:conversationId", (request, response) => {
         const pagination = parsePagination(request.query);
@@ -1897,6 +1960,24 @@ export function createRuntime(options) {
         const permissions = requestPermissions(request, String(forked.workId));
         data(response, redactAiConversation(forked, permissions), 201);
     });
+    app.patch("/api/ai-conversations/:conversationId/task-type", (request, response) => {
+        const input = parse(z.object({ taskType: aiConversationTaskTypeSchema }).strict(), request.body);
+        const updated = store.setAiConversationTaskType(request.params.conversationId, input.taskType);
+        const permissions = requestPermissions(request, String(updated.workId));
+        data(response, redactAiConversation(updated, permissions));
+    });
+    app.patch("/api/ai-conversations/:conversationId/context-scope", (request, response) => {
+        const input = parse(z.object({ scope: contextSchema }).strict(), request.body);
+        const updated = store.setAiConversationContextScope(request.params.conversationId, input.scope);
+        const permissions = requestPermissions(request, String(updated.workId));
+        data(response, redactAiConversation(updated, permissions));
+    });
+    app.patch("/api/ai-conversations/:conversationId/roleplay", (request, response) => {
+        const input = parse(z.object({ characterId: identifier.nullable() }).strict(), request.body);
+        const updated = store.setAiConversationRoleplayCharacter(request.params.conversationId, input.characterId);
+        const permissions = requestPermissions(request, String(updated.workId));
+        data(response, redactAiConversation(updated, permissions));
+    });
     app.post("/api/ai-conversations/:conversationId/messages", (request, response) => {
         const input = parse(z.object({
             role: z.enum(["user", "assistant"]),
@@ -1963,7 +2044,7 @@ export function createRuntime(options) {
         data(response, ai.createProvider(parse(providerSchema, request.body)), 201);
     });
     app.get("/api/providers/:providerId", (request, response) => data(response, ai.getProvider(request.params.providerId)));
-    app.patch("/api/providers/:providerId", (request, response) => data(response, ai.updateProvider(request.params.providerId, parse(providerSchema.partial(), request.body))));
+    app.patch("/api/providers/:providerId", (request, response) => data(response, ai.updateProvider(request.params.providerId, parse(providerUpdateSchema, request.body))));
     app.delete("/api/providers/:providerId", (request, response) => {
         ai.deleteProvider(request.params.providerId);
         noContent(response);