@com55/node-red-ai-access 0.2.0-beta.8 → 0.2.0-beta.9

package/dist/plugin.d.cts

@@ -300,11 +300,16 @@ interface Proposal {
         nodeId: string;
         property: string;
     }[];
+    deploymentAlert?: string;
+    landedAfterWithdraw?: boolean;
+    rejectedWhileDeployUnknown?: boolean;
     /** Persisted while a timed-out runtime deployment has an unknown outcome. */
     deployPending?: {
         mergedHash: string;
+        bootId?: string;
         reason: string;
         queueReleased?: boolean;
+        attemptId?: string;
     };
     /** Last auto-rebase result (pending / conflict proposals). */
     rebase?: ProposalRebaseInfo;
@@ -366,6 +371,7 @@ declare class ProposalStore {
     private toDiskRecord;
     private writeAtomic;
     create(input: CreateProposalInput): Proposal;
+    private currentProcessProposal;
     get(id: string): Proposal;
     list(filter?: {
         linkId?: string;
@@ -379,6 +385,9 @@ declare class ProposalStore {
     beginApprove(id: string): Proposal;
     releaseLock(id: string): void;
     recordDeployPending(id: string, pending: Proposal['deployPending']): Proposal;
+    flagRejectedWhileDeployUnknown(id: string): Proposal;
+    flagLandedAfterWithdraw(id: string): void;
+    flagDeployment(id: string, message: string): void;
     markApproved(id: string, decidedBy: ProposalDecisionBy, resultRev: string): Proposal;
     markRejected(id: string, decidedBy: ProposalDecisionBy | undefined, reason: string): Proposal;
     markFailed(id: string, decidedBy: ProposalDecisionBy | undefined, reason: string): Proposal;
@@ -548,6 +557,7 @@ interface ProposalServiceOptions {
     deployHardCapMs?: number;
 }
 interface ApproveOptions {
+    overrideDeployOutcomeUnknown?: boolean;
     deploymentType?: DeploymentType;
     /**
      * `mergedHash` the reviewer last saw. Required when the rebase merged live
@@ -562,6 +572,9 @@ declare class ProposalService {
     private readonly getDeploymentType;
     private readonly serviceOptions;
     constructor(proposals: ProposalStore, audit: AuditLog, adapter: FlowAdapter, getDeploymentType: () => DeploymentType, serviceOptions?: ProposalServiceOptions);
+    unknownDeployBlocks(): Proposal[];
+    confirmLiveChecked(id: string, actor: ProposalDecisionBy, expectedAttemptId: unknown): Proposal;
+    private guardUnknown;
     approve(id: string, decidedBy: ProposalDecisionBy, options?: ApproveOptions): Promise<Proposal>;
     private approveLocked;
     private withDeployDeadline;

package/docs/api/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 
 info:
   title: Node-RED AI Access Plugin API
-  version: 0.2.0-beta.8
+  version: 0.2.0-beta.9
   summary: Temporary, owner-approved Node-RED access for AI clients
   description: |
     REST surface exposed by the `@com55/node-red-ai-access` Node-RED plugin
@@ -950,6 +950,21 @@ paths:
                     type: array
                     items:
                       $ref: '#/components/schemas/Proposal'
+                  deployUnknownBlocks:
+                    type: array
+                    description: Admin-only active process blocks, independent of status filters and pagination. Each deployment submits a full flow snapshot, so these blocks apply to all approvals, including after proposal closure.
+                    items:
+                      type: object
+                      required: [proposalId, flowIds]
+                      properties:
+                        proposalId:
+                          type: string
+                        attemptId:
+                          type: string
+                        flowIds:
+                          type: array
+                          items:
+                            type: string
                   total:
                     type: integer
                     description: Count after filters, before limit/offset
@@ -1244,6 +1259,42 @@ paths:
         '415':
           $ref: '#/components/responses/UnsupportedMediaType'
 
+  /proposals/{id}/confirm-live-checked:
+    post:
+      tags: [Proposals]
+      summary: Confirm live flows checked and clear the unknown deployment block
+      description: Requires full admin permission (*). Records the actor and attempt in proposal.live_checked audit. Requires a post-cap deployPending.queueReleased flag and its matching attemptId. Does not cancel a detached deploy; a later landing is still monitored on every changed tab.
+      operationId: confirmProposalLiveChecked
+      security:
+        - AdminSession: []
+      parameters:
+        - $ref: '#/components/parameters/ProposalId'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [attemptId]
+              properties:
+                attemptId:
+                  type: string
+      responses:
+        '200':
+          description: Block cleared
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Proposal'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '409':
+          description: deploy_outcome_unknown — no post-cap deployment or attemptId does not match
+        '404':
+          $ref: '#/components/responses/NotFound'
+
   /proposals/{id}/reject:
     post:
       tags: [Proposals]
@@ -1569,6 +1620,7 @@ components:
         Machine-readable `code` on JSON error bodies. See docs/errors.md.
 
         - `approve_queue_timeout` (504): Approval exceeded its queue-wait deadline (default 60 seconds); no deployment was started for this request
+        - `deploy_outcome_unknown` (409): A past-cap deployment can still change live flows
         - `deploy_timeout` (504): Deployment exceeded its deadline (default 60 seconds); approvals wait for settlement or the hard cap (default 5 minutes)
         - `proposal_conflict` (409): Editor and proposal changes conflict (conflicts contains field names only)
         - `rebase_ack_required` (409): The merged result needs review (mergedHash included)
@@ -1630,6 +1682,7 @@ components:
         - `internal_error` (500): Unexpected server error
       enum:
         - approve_queue_timeout
+        - deploy_outcome_unknown
         - deploy_timeout
         - proposal_conflict
         - rebase_ack_required
@@ -2385,18 +2438,32 @@ components:
             choice:
               type: string
               enum: [live, proposed]
+        rejectedWhileDeployUnknown:
+          type: boolean
+          description: Rejected while a full-snapshot deploy could still land. Check live flows; late landing triggers an alert and audit entry.
+        landedAfterWithdraw:
+          type: boolean
+          description: The withdrawn proposal’s outstanding deployment landed later; shown as a dashboard badge.
+        deploymentAlert:
+          type: string
+          description: Warning that a late deployment may have overwritten an intervening decision.
         deployPending:
           type: object
           description: Timed-out deployment has an unknown outcome; approvals wait until settlement or the hard cap. Check live flows before approving again.
           required: [mergedHash, reason]
           properties:
+            attemptId:
+              type: string
+            bootId:
+              type: string
+              description: Process identity; flags from previous processes are ignored.
             mergedHash:
               type: string
             reason:
               type: string
             queueReleased:
               type: boolean
-              description: True when the deploy hard cap released the queue. Late settlement no longer updates this proposal; approval always re-reads live flows.
+              description: True when the deploy hard cap released the queue. All approvals are blocked until settlement, restart, or confirm-live-checked with a matching attemptId; closing the proposal does not clear the block; approval may proceed with an audited override. Rejection is allowed with rejectedWhileDeployUnknown warning. Late settlement updates the proposal or flags intervening decisions.
         rebase:
           $ref: '#/components/schemas/ProposalRebase'
         id:
@@ -2674,6 +2741,10 @@ components:
     ApproveProposalRequest:
       type: object
       properties:
+        overrideDeployOutcomeUnknown:
+          type: boolean
+          default: false
+          description: Explicitly allow approval while a past-cap deploy can still overwrite live flows.
         mergedHash:
           type: string
           description: Hash of the reviewed merged result; required when editor changes are merged.

package/docs/errors.md

@@ -14,6 +14,7 @@ GET-link `401` responses include a `WWW-Authenticate: Bearer …` header.
 | Code | HTTP | Meaning | Hint / next step | Channels |
 | --- | --- | --- | --- | --- |
 | `approve_queue_timeout` | 504 | Approval exceeded its queue-wait deadline (default 60 seconds); no deployment was started for this request | Check the live flow and retry approval | admin |
+| `deploy_outcome_unknown` | 409 | A past-cap deployment can still change live flows | All approvals require settlement, confirm live checked with the matching attempt, restart, or an audited override; rejection is allowed with a warning | admin |
 | `deploy_timeout` | 504 | Deployment exceeded its deadline (default 60 seconds); approvals wait for settlement or the hard cap (default 5 minutes) | Before the cap, late settlement updates the proposal; after the cap, deployPending.queueReleased is true and the outcome stays unknown. Check the live flow before approving again; approval always re-reads live | admin |
 | `proposal_conflict` | 409 | Editor and proposal changes conflict (conflicts contains field names only) | Read the current flow and resolve the proposal before approval | GET, REST, MCP, admin |
 | `rebase_ack_required` | 409 | The merged result needs review (mergedHash included) | Review the diff and approve with its mergedHash | admin |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@com55/node-red-ai-access",
-  "version": "0.2.0-beta.8",
+  "version": "0.2.0-beta.9",
   "description": "Node-RED plugin that gives AI agents temporary, owner-approved access via REST and MCP",
   "main": "dist/plugin.cjs",
   "types": "dist/plugin.d.cts",
@@ -24,6 +24,7 @@
   "files": [
     "dist",
     "!dist/**/*.map",
+    "!dist/.production-build-hash",
     "docs",
     "ai-access.cjs",
     "ai-access.html",