@com55/node-red-ai-access 0.2.0-beta.6 → 0.2.0-beta.8

package/dist/plugin.d.cts

@@ -217,7 +217,34 @@ declare class AuditLog {
  * Proposal JSON store under `.ai-access/proposals/`.
  */
 
-type ProposalStatus = 'pending' | 'approved' | 'rejected' | 'failed' | 'withdrawn' | 'expired' | 'superseded';
+type ProposalStatus = 'pending' | 'conflict' | 'approved' | 'rejected' | 'failed' | 'withdrawn' | 'expired' | 'superseded';
+/** One stored rebase conflict (field paths only, including env names / credential keys; never values). */
+interface StoredRebaseConflict {
+    kind: string;
+    nodeId?: string;
+    nodeType?: string;
+    nodeName?: string;
+    fields?: string[];
+    message: string;
+    choices: ('live' | 'proposed')[];
+}
+/** Paths where an AI conflict choice replaced a live editor change. */
+interface AiConflictOverride {
+    nodeId: string;
+    fields: string[];
+}
+/** Result of the last auto-rebase check against the live flows. */
+interface ProposalRebaseInfo {
+    /** Live rev the check ran against. */
+    rev: string;
+    state: 'clean' | 'merged' | 'conflict';
+    /** Hash of the tab approve would deploy (absent on conflict). */
+    mergedHash?: string;
+    conflicts: StoredRebaseConflict[];
+    /** Nodes (or the tab) changed live since the base snapshot. */
+    liveChangedCount: number;
+    checkedAt: string;
+}
 type ProposalType = 'replace_flow';
 interface AccessLinkProposalCreator {
     kind: 'access-link';
@@ -273,6 +300,28 @@ interface Proposal {
         nodeId: string;
         property: string;
     }[];
+    /** Persisted while a timed-out runtime deployment has an unknown outcome. */
+    deployPending?: {
+        mergedHash: string;
+        reason: string;
+        queueReleased?: boolean;
+    };
+    /** Last auto-rebase result (pending / conflict proposals). */
+    rebase?: ProposalRebaseInfo;
+    /** AI resolutions that replace editor changes and still require reviewer acknowledgement. */
+    aiConflictOverrides?: AiConflictOverride[];
+    /** Latest manual resolution, retained for admin undo until the next body edit. */
+    conflictChoice?: {
+        nodeId: string;
+        choice: 'live' | 'proposed';
+        chooser?: 'ai' | 'human';
+        undo?: {
+            baseFlow: Partial<FlowTab>;
+            flow: Partial<FlowTab>;
+            warnings: ProposalWarning[];
+            aiConflictOverrides?: AiConflictOverride[];
+        };
+    };
     /**
      * Short human title (≤80 chars). Set at submit (AI-supplied or auto-generated).
      * Optional on legacy proposals; API responses always resolve a title.
@@ -329,15 +378,40 @@ declare class ProposalStore {
      */
     beginApprove(id: string): Proposal;
     releaseLock(id: string): void;
+    recordDeployPending(id: string, pending: Proposal['deployPending']): Proposal;
     markApproved(id: string, decidedBy: ProposalDecisionBy, resultRev: string): Proposal;
     markRejected(id: string, decidedBy: ProposalDecisionBy | undefined, reason: string): Proposal;
     markFailed(id: string, decidedBy: ProposalDecisionBy | undefined, reason: string): Proposal;
     markWithdrawn(id: string, decidedBy: ProposalDecisionBy, reason: string): Proposal;
     /**
      * Auto-close a pending proposal that can no longer be approved
-     * (`expired` = live rev moved; `superseded` = another proposal was approved).
+     * (`expired` = pending longer than the proposal TTL).
      */
     markClosed(id: string, status: 'expired' | 'superseded', reason: string, decidedBy?: ProposalDecisionBy): Proposal;
+    /**
+     * Store the latest rebase check and flip `pending` ↔ `conflict`.
+     * No-op (no write) when nothing changed. Skips decided or in-flight records.
+     */
+    recordRebase(id: string, info: ProposalRebaseInfo): Proposal;
+    /**
+     * Replace an open proposal's base snapshot and/or body (conflict resolution).
+     * Status returns to `pending`; the caller re-runs the rebase.
+     */
+    updateBody(id: string, update: {
+        baseFlow: Partial<FlowTab>;
+        flow: Partial<FlowTab>;
+        expectedRev?: string;
+        title?: string;
+        restoredSecrets?: {
+            nodeId: string;
+            property: string;
+        }[];
+        warnings?: ProposalWarning[];
+        conflictChoice?: Proposal['conflictChoice'];
+        aiConflictOverrides?: AiConflictOverride[];
+    }): Proposal;
+    /** True while an approve holds this proposal's lock. */
+    isApproving(id: string): boolean;
 }
 
 /**
@@ -357,6 +431,7 @@ interface PersistedAiAccessSettings {
     enabled?: boolean;
     allowWithoutAdminAuth?: boolean;
     defaultLinkTtlSeconds?: number;
+    proposalTtlDays?: number;
     defaultDeploymentType?: DeploymentType;
     maxActiveLinks?: number;
     publicBaseUrl?: string;
@@ -378,6 +453,7 @@ interface EffectiveAiAccessSettings {
     enabled: boolean;
     allowWithoutAdminAuth: boolean;
     defaultLinkTtlSeconds: number;
+    proposalTtlDays: number;
     defaultDeploymentType: DeploymentType;
     maxActiveLinks: number;
     publicBaseUrl: string;
@@ -463,15 +539,32 @@ type CatalogueFetcher = (url: string, etag?: string) => Promise<{
  * Approve / reject proposals through the FlowAdapter with audit logging.
  */
 
+interface ProposalServiceOptions {
+    /** Maximum time to await updateFlow (default 60 seconds). Does not cancel the runtime operation. */
+    deployTimeoutMs?: number;
+    /** Maximum time waiting to start approval (default 60 seconds). */
+    approveQueueTimeoutMs?: number;
+    /** Release the queue after this much unsettled deployment time (default 5 minutes). */
+    deployHardCapMs?: number;
+}
+interface ApproveOptions {
+    deploymentType?: DeploymentType;
+    /**
+     * `mergedHash` the reviewer last saw. Required when the rebase merged live
+     * changes into the proposal; when supplied it must match the current merge.
+     */
+    mergedHash?: string;
+}
 declare class ProposalService {
     private readonly proposals;
     private readonly audit;
     private readonly adapter;
     private readonly getDeploymentType;
-    constructor(proposals: ProposalStore, audit: AuditLog, adapter: FlowAdapter, getDeploymentType: () => DeploymentType);
-    approve(id: string, decidedBy: ProposalDecisionBy, options?: {
-        deploymentType?: DeploymentType;
-    }): Promise<Proposal>;
+    private readonly serviceOptions;
+    constructor(proposals: ProposalStore, audit: AuditLog, adapter: FlowAdapter, getDeploymentType: () => DeploymentType, serviceOptions?: ProposalServiceOptions);
+    approve(id: string, decidedBy: ProposalDecisionBy, options?: ApproveOptions): Promise<Proposal>;
+    private approveLocked;
+    private withDeployDeadline;
     reject(id: string, decidedBy: ProposalDecisionBy, reason: string): Proposal;
 }
 
@@ -495,10 +588,17 @@ interface AiAccessSettings {
     allowWithoutAdminAuth?: boolean;
     /** Default access-link TTL in seconds (default: 14400 = 4h). */
     defaultLinkTtlSeconds?: number;
+    proposalTtlDays?: number;
     /** Maximum concurrent active access links (default: 10). */
     maxActiveLinks?: number;
     /** Deployment type used when approving proposals (default: nodes). */
     defaultDeploymentType?: 'nodes' | 'flows' | 'full';
+    /** Approval queue waiting deadline in milliseconds (default 60,000). */
+    approveQueueTimeoutMs?: number;
+    /** Deployment caller deadline in milliseconds (default 60,000). */
+    deployTimeoutMs?: number;
+    /** Release an unsettled deployment's approval queue after this duration (default 300,000 ms). */
+    deployHardCapMs?: number;
     /**
      * Rate-limit window in milliseconds for `/mcp/api` and `/mcp/a`
      * (default: 60000).
@@ -643,6 +743,7 @@ interface NodeRedPluginAPI {
     };
     events?: {
         on(event: string, listener: () => void): void;
+        removeListener?(event: string, listener: () => void): void;
     };
     auth: NodeRedAuthAPI;
     plugins: {