@musnows/scriverse 1.0.11 → 1.1.0

package/dist/app.js

@@ -14,6 +14,7 @@ import { AI_PROVIDER_PROTOCOL_OPTIONS, AI_PROVIDER_PROTOCOLS, AI_THINKING_TYPES,
 import { MAX_AI_ANALYSIS_TIMEOUT_SECONDS, MIN_AI_ANALYSIS_TIMEOUT_SECONDS } from "./ai-analysis-timeout.js";
 import { aiConversationExportContentDisposition, exportAiConversationMarkdown } from "./ai-conversation-export.js";
 import { DEFAULT_AI_CHAT_TAB_LIMIT } from "./ai-chat-tab-limit.js";
+import { DEFAULT_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH } from "./chapter-annotation-note.js";
 import { MAX_AI_STREAM_IDLE_TIMEOUT_SECONDS, MIN_AI_STREAM_IDLE_TIMEOUT_SECONDS, normalizeAiStreamIdleTimeoutSeconds } from "./ai-stream-timeout.js";
 import { AttachmentStorage } from "./attachment-storage.js";
 import { attachmentDownloadFileName, inlineContentDisposition } from "./attachment-download.js";
@@ -22,6 +23,7 @@ import { LiteLlmPriceCache } from "./ai-model-pricing.js";
 import { MIN_AGENT_TOOL_CALL_LIMIT, resolveMaxAgentToolCallLimit } from "./ai-tool-results.js";
 import { SEMANTIC_SOURCE_TYPES } from "./semantic-search.js";
 import { CHARACTER_EXTRACTION_MAX_ALIASES, CHARACTER_EXTRACTION_MAX_CANDIDATES, CHARACTER_EXTRACTION_MAX_IDENTITY_LENGTH, CHARACTER_EXTRACTION_MAX_NAME_LENGTH, CHARACTER_EXTRACTION_MAX_SPECIES_LENGTH } from "./character-extraction.js";
+import { characterAttributesInputSchema, characterStateInputSchema } from "./character-structured-fields.js";
 import { AiWritePlanManager, AI_USER_QUESTION_STATUSES, AI_WRITE_PLAN_STATUSES, aiWriteToolDescriptions, aiWriteToolLabels, aiWriteToolsUpdateSchema, answerAiUserQuestionSchema, resolveAiWritePlanMaxOperations } from "./ai-write-plans.js";
 import { CredentialVault } from "./credential-vault.js";
 import { Database } from "./database.js";
@@ -39,7 +41,7 @@ import { composeRoleplayStoredUserContent } from "./roleplay-turn.js";
 import { ROLEPLAY_MEMORY_CATEGORIES, ROLEPLAY_MEMORY_CERTAINTY, ROLEPLAY_MEMORY_IMPORTANCE, ROLEPLAY_MEMORY_STATUSES } from "./roleplay-memory.js";
 import { paginated, parsePagination } from "./pagination.js";
 import { normalizeUploadFileName } from "./utils.js";
-import { assertSafeAiEndpoint, assertSafeS3Endpoint, createApiRateLimitMiddleware, createAuthenticationRateLimitMiddleware, createBasicAuthMiddleware, createCaptchaRateLimitMiddleware, createExpensiveApiRateLimitMiddleware, createSameOriginMiddleware, createSecurityHeadersMiddleware, createUploadRateLimitMiddleware, enforceCaseInsensitiveRouting, normalizeApiPath, resolveTrustProxySetting, verifySetupToken } from "./security.js";
+import { assertSafeAiEndpoint, assertSafeS3Endpoint, createApiRateLimitMiddleware, createAuthenticationRateLimitMiddleware, createBasicAuthMiddleware, createCaptchaRateLimitMiddleware, createExpensiveApiRateLimitMiddleware, createSameOriginMiddleware, createSecurityHeadersMiddleware, createUploadRateLimitMiddleware, enforceCaseInsensitiveRouting, isRegistrationEnabled, normalizeApiPath, resolveRegistrationMode, resolveTrustProxySetting, verifySetupToken } from "./security.js";
 import { ImageCaptchaService } from "./image-captcha.js";
 import { ImService } from "./im.js";
 import { ImOrchestrator } from "./im-orchestrator.js";
@@ -146,6 +148,7 @@ const registrationSchema = z.object({
     password: passwordSchema,
     passwordConfirmation: passwordSchema,
     setupToken: z.string().max(500).optional(),
+    inviteCode: z.string().trim().max(32).optional(),
     ...captchaFields
 }).strict().refine((input) => input.password === input.passwordConfirmation, {
     path: ["passwordConfirmation"],
@@ -164,6 +167,20 @@ const desktopLoginSchema = z.object({
     clientVersion: z.string().trim().min(1).max(80),
     ...captchaFields
 }).strict();
+const desktopRegistrationSchema = z.object({
+    username: usernameSchema,
+    password: passwordSchema,
+    passwordConfirmation: passwordSchema,
+    setupToken: z.string().max(500).optional(),
+    inviteCode: z.string().trim().max(32).optional(),
+    desktopId: z.string().uuid(),
+    profileId: z.string().uuid(),
+    clientVersion: z.string().trim().min(1).max(80),
+    ...captchaFields
+}).strict().refine((input) => input.password === input.passwordConfirmation, {
+    path: ["passwordConfirmation"],
+    message: "两次输入的密码不一致"
+});
 const userUpdateSchema = z.object({ role: z.enum(["admin", "user"]).optional(), status: z.enum(["active", "disabled"]).optional() }).strict();
 const memberRoleValueSchema = z.enum(["editor", "settings-editor", "viewer"]);
 const moduleAccessSchema = z.enum(["none", "read", "write"]);
@@ -299,9 +316,9 @@ const characterSchema = z.object({
     aliases: z.array(z.string().trim().min(1).max(200)).max(100).optional(),
     raceId: identifier.nullable().optional(),
     organizationIds: z.array(identifier).max(100).optional(),
-    attributes: jsonObject.optional(),
+    attributes: characterAttributesInputSchema.optional(),
     profile: jsonObject.optional(),
-    currentState: jsonObject.optional(),
+    currentState: characterStateInputSchema.optional(),
     lockedFields: optionalStrings,
     firstChapterId: identifier.nullable().optional()
 }).strict();
@@ -1266,6 +1283,7 @@ function redactVersionSnapshots(value, mapper) {
 export function createRuntime(options) {
     const uploadLimits = options.uploadLimits ?? DEFAULT_IMAGE_UPLOAD_LIMITS;
     const aiChatTabLimit = options.aiChatTabLimit ?? DEFAULT_AI_CHAT_TAB_LIMIT;
+    const chapterAnnotationNoteMaxLength = options.chapterAnnotationNoteMaxLength ?? DEFAULT_CHAPTER_ANNOTATION_NOTE_MAX_LENGTH;
     const requestedAiStreamHeartbeatIntervalMs = Number(options.aiStreamHeartbeatIntervalMs);
     const aiStreamHeartbeatIntervalMs = Number.isFinite(requestedAiStreamHeartbeatIntervalMs)
         ? Math.max(1, Math.trunc(requestedAiStreamHeartbeatIntervalMs))
@@ -1437,7 +1455,7 @@ export function createRuntime(options) {
         auth,
         resolveAnalysisTask: (workId, input) => ai.resolveTaskInput(workId, input),
         startAnalysisTask: (workId, input) => store.createTask(workId, input)
-    });
+    }, { chapterAnnotationNoteMaxLength });
     ai.attachWritePlanManager(aiWritePlanManager);
     const app = express();
     enforceCaseInsensitiveRouting(app);
@@ -1487,6 +1505,7 @@ export function createRuntime(options) {
             protocols: [...AI_PROVIDER_PROTOCOLS],
             development: options.developmentServer === true,
             aiChatTabLimit,
+            chapterAnnotationNoteMaxLength,
             uploadLimits
         });
     });
@@ -1502,15 +1521,38 @@ export function createRuntime(options) {
         app.use(createSameOriginMiddleware());
     app.use("/api/sync/works", express.json({ limit: "3mb" }));
     app.use(express.json({ limit: "2mb" }));
+    const registrationMode = resolveRegistrationMode(options.security);
+    const registrationEnabled = isRegistrationEnabled(registrationMode);
+    const registrationPolicy = (setupRequired) => ({
+        registrationMode,
+        registrationOpen: registrationEnabled,
+        inviteRequired: registrationMode === "invite" && !setupRequired
+    });
+    const resolvedInviteCode = (inviteCode, setupRequired) => {
+        if (registrationMode !== "invite" || setupRequired)
+            return undefined;
+        const trimmed = inviteCode?.trim() ?? "";
+        if (!trimmed)
+            throw new AppError(400, "INVITE_CODE_REQUIRED", "当前部署需要邀请码才能注册");
+        return trimmed;
+    };
     app.get("/api/auth/session", (request, response) => {
         const desktopSession = auth.authenticateDesktop(request);
         const session = desktopSession ? null : auth.authenticate(request);
-        const registrationOpen = options.security?.allowRegistration === true;
         const setupRequired = !auth.hasUsers();
         const setupTokenRequired = setupRequired && Boolean(options.security?.setupToken);
+        const policy = registrationPolicy(setupRequired);
         const developmentUser = getDevelopmentUser();
         if (!session && developmentUser) {
-            data(response, { authenticated: true, user: developmentUser, csrfToken: null, bootId, setupRequired: false, setupTokenRequired: false, registrationOpen });
+            data(response, {
+                authenticated: true,
+                user: developmentUser,
+                csrfToken: null,
+                bootId,
+                setupRequired: false,
+                setupTokenRequired: false,
+                ...registrationPolicy(false)
+            });
             return;
         }
         const interactiveSession = desktopSession ?? session;
@@ -1522,25 +1564,33 @@ export function createRuntime(options) {
                 bootId,
                 setupRequired: false,
                 setupTokenRequired: false,
-                registrationOpen
+                ...registrationPolicy(false)
             }
-            : { authenticated: false, user: null, csrfToken: null, bootId, setupRequired, setupTokenRequired, registrationOpen });
+            : { authenticated: false, user: null, csrfToken: null, bootId, setupRequired, setupTokenRequired, ...policy });
     });
     app.get("/api/auth/captcha", (_request, response) => {
         data(response, captcha.create());
     });
     app.post("/api/auth/register", (request, response) => {
-        if (options.security?.allowRegistration !== true) {
+        if (!registrationEnabled) {
             throw new AppError(403, "REGISTRATION_DISABLED", "当前部署已关闭新用户注册");
         }
         const input = parse(registrationSchema, request.body);
         captcha.consume(input.captchaId, input.captchaAnswer);
-        if (!auth.hasUsers() && !verifySetupToken(options.security?.setupToken, input.setupToken)) {
+        const setupRequired = !auth.hasUsers();
+        if (setupRequired && !verifySetupToken(options.security?.setupToken, input.setupToken)) {
             throw new AppError(403, "SETUP_TOKEN_INVALID", "初始化令牌无效或未配置");
         }
-        const result = auth.register({ username: input.username, password: input.password });
+        const result = auth.register({
+            username: input.username,
+            password: input.password,
+            inviteCode: resolvedInviteCode(input.inviteCode, setupRequired)
+        });
         setSessionCookie(response, result.token, request.secure);
-        runWithRequestActor(result.session.user, () => store.audit(null, "user.registered", "user", result.session.user.userId, { role: result.session.user.role }));
+        runWithRequestActor(result.session.user, () => store.audit(null, "user.registered", "user", result.session.user.userId, {
+            role: result.session.user.role,
+            ...(result.inviteId ? { inviteId: result.inviteId } : {})
+        }));
         logger.info("auth.registration.succeeded", { actorRef: accountReference(result.session.user.userId) });
         data(response, { user: result.session.user, csrfToken: result.session.csrfToken }, 201);
     });
@@ -1567,6 +1617,34 @@ export function createRuntime(options) {
         logger.info("auth.desktop_login.succeeded", { actorRef: accountReference(result.session.user.userId) });
         data(response, { token: result.token, expiresAt: result.session.expiresAt, user: result.session.user });
     });
+    app.post("/api/desktop/auth/register", (request, response) => {
+        if (!registrationEnabled) {
+            throw new AppError(403, "REGISTRATION_DISABLED", "当前部署已关闭新用户注册");
+        }
+        const input = parse(desktopRegistrationSchema, request.body);
+        captcha.consume(input.captchaId, input.captchaAnswer);
+        const setupRequired = !auth.hasUsers();
+        if (setupRequired && !verifySetupToken(options.security?.setupToken, input.setupToken)) {
+            throw new AppError(403, "SETUP_TOKEN_INVALID", "初始化令牌无效或未配置");
+        }
+        const result = auth.registerDesktop({
+            username: input.username,
+            password: input.password,
+            inviteCode: resolvedInviteCode(input.inviteCode, setupRequired),
+            desktopId: input.desktopId,
+            profileId: input.profileId,
+            clientVersion: input.clientVersion
+        });
+        imOrchestrator.disconnectUser(result.session.user.userId);
+        response.setHeader("Cache-Control", "no-store");
+        runWithRequestActor(result.session.user, () => store.audit(null, "user.registered", "user", result.session.user.userId, {
+            role: result.session.user.role,
+            source: "desktop",
+            ...(result.inviteId ? { inviteId: result.inviteId } : {})
+        }));
+        logger.info("auth.desktop_registration.succeeded", { actorRef: accountReference(result.session.user.userId) });
+        data(response, { token: result.token, expiresAt: result.session.expiresAt, user: result.session.user }, 201);
+    });
     app.use(createUserSessionMiddleware(auth, {
         disabled: options.disableUserAuth === true,
         resolveBypassUser: getDevelopmentUser
@@ -1714,6 +1792,28 @@ export function createRuntime(options) {
         store.audit(null, "user.updated", "user", updated.userId, { role: updated.role, status: updated.status });
         data(response, updated);
     });
+    app.get("/api/registration-invites", (request, response) => {
+        if (!request.authUser)
+            throw new AppError(401, "AUTH_REQUIRED", "请先登录");
+        if (request.authUser.role !== "admin")
+            throw new AppError(403, "ADMIN_REQUIRED", "该操作仅限系统管理员");
+        data(response, {
+            registrationMode,
+            registrationOpen: registrationEnabled,
+            items: auth.listRegistrationInvites()
+        });
+    });
+    app.post("/api/registration-invites", (request, response) => {
+        if (!request.authUser)
+            throw new AppError(401, "AUTH_REQUIRED", "请先登录");
+        if (request.authUser.role !== "admin")
+            throw new AppError(403, "ADMIN_REQUIRED", "该操作仅限系统管理员");
+        parse(z.object({}).strict(), request.body ?? {});
+        const created = auth.createRegistrationInvite(request.authUser);
+        store.audit(null, "registration-invite.created", "registration-invite", created.id, {});
+        logger.info("auth.registration_invite.created", { actorRef: accountReference(request.authUser.userId) });
+        data(response, created, 201);
+    });
     const requireImUser = (request) => {
         if (!request.authUser || !hasInteractiveSession(request)) {
             throw new AppError(401, "SESSION_REQUIRED", "请使用交互式会话访问 IM");
@@ -2404,12 +2504,12 @@ export function createRuntime(options) {
             kind: z.enum(["note", "todo"]),
             startLine: z.number().int().positive(),
             endLine: z.number().int().positive(),
-            note: z.string().trim().min(1).max(2000)
+            note: z.string().trim().min(1).max(chapterAnnotationNoteMaxLength)
         }).strict().refine((value) => value.endLine >= value.startLine, { message: "结束行不能早于开始行", path: ["endLine"] }), request.body);
         data(response, store.createChapterAnnotation(request.params.chapterId, input), 201);
     });
     app.patch("/api/chapter-annotations/:annotationId", (request, response) => {
-        const input = parse(z.object({ note: z.string().trim().min(1).max(2000).optional(), status: z.enum(["open", "resolved"]).optional(), expectedVersionNo: expectedVersionNoSchema }).strict().refine((value) => value.note !== undefined || value.status !== undefined, { message: "至少需要修改一项" }), request.body);
+        const input = parse(z.object({ note: z.string().trim().min(1).max(chapterAnnotationNoteMaxLength).optional(), status: z.enum(["open", "resolved"]).optional(), expectedVersionNo: expectedVersionNoSchema }).strict().refine((value) => value.note !== undefined || value.status !== undefined, { message: "至少需要修改一项" }), request.body);
         const { expectedVersionNo, ...update } = input;
         data(response, store.updateChapterAnnotation(request.params.annotationId, update, expectedVersionNo));
     });
@@ -3475,6 +3575,19 @@ export function createRuntime(options) {
         const permissions = requestPermissions(request, String(conversation.workId));
         data(response, redactAiConversationMessage(message, permissions), 201);
     });
+    app.post("/api/ai-conversations/:conversationId/steer", (request, response) => {
+        const input = parse(z.object({
+            content: nonEmpty.max(100_000)
+        }).strict(), request.body ?? {});
+        const conversation = store.getAiConversationSummary(request.params.conversationId);
+        const workId = String(conversation.workId);
+        const permissions = requestPermissions(request, workId);
+        if (!canWriteWorkModule(permissions, "ai-chat")) {
+            throw new AppError(403, "WORK_MODULE_WRITE_DENIED", "你没有使用创作助手的权限");
+        }
+        const entry = ai.enqueueSteer(workId, request.params.conversationId, input.content);
+        data(response, { ...entry, status: "pending" }, 202);
+    });
     app.post("/api/ai-conversations/:conversationId/context/prepare", async (request, response) => {
         const input = parse(z.object({
             modelId: identifier.optional(),
@@ -3972,6 +4085,7 @@ export function createRuntime(options) {
             if (!response.writableEnded && !response.destroyed)
                 response.write(`event: ${event}\ndata: ${JSON.stringify(payload)}\n\n`);
         };
+        let releaseSteer = () => undefined;
         try {
             if (!existingRequest) {
                 preparedChatImageAttachments = await ai.prepareChatImageAttachments(request.params.workId, modelId, input.imageAttachmentIds ?? [], permissions);
@@ -4092,6 +4206,7 @@ export function createRuntime(options) {
                     questionId: pendingQuestion.id
                 });
             }
+            releaseSteer = ai.steerMailbox.begin(conversationId);
             const result = await ai.createStreamingChat({
                 workId: request.params.workId,
                 instruction: resolvedInstruction,
@@ -4103,6 +4218,10 @@ export function createRuntime(options) {
                 onToolCall: (toolCall, round) => sendEvent("tool_call", { ...toolCall, round }),
                 onProcessStep: (step) => sendEvent("process_step", step),
                 onContextCompacted: (event) => sendEvent("context_compacted", event),
+                onSteer: (event) => sendEvent("steer", {
+                    message: redactAiConversationMessage(event.message, permissions),
+                    applied: true
+                }),
                 conversationId,
                 excludeConversationMessageId: currentMessageId,
                 ...(currentMessageId ? { assistantMessageRequestId: `assistant:${currentMessageId}` } : {}),
@@ -4159,6 +4278,7 @@ export function createRuntime(options) {
             }
         }
         finally {
+            releaseSteer();
             stopStreamHeartbeat();
             if (streamRequestId && !streamRequestFinished && !stopping) {
                 store.finishAiConversationStreamRequest(streamRequestId, "cancelled", "stream_closed");