@dudousxd/nestjs-agent 1.2.0 → 1.4.0

package/dist/durable/index.d.cts

@@ -1,6 +1,6 @@
 import { AgentStore, AgentRunInput, AgentLoopResult, LlmStepEnvelope, BufferedModelTurnResult, ToolStepEnvelope, AgentRunner, TokenStreamSink, HumanReply } from '@dudousxd/nestjs-agent-core';
 import { RunGateway, WorkflowCtx } from '@dudousxd/nestjs-durable-core';
-import { A as AgentDepsFactory, a as AgentSurface, b as AgentModuleOptions } from '../agent-deps.factory-OjrLyAZo.cjs';
+import { A as AgentDepsFactory, a as AgentSurface, b as AgentModuleOptions } from '../agent-deps.factory-CUyVPsa1.cjs';
 import { WorkflowService } from '@dudousxd/nestjs-durable';
 import { DynamicModule } from '@nestjs/common';
 import '@standard-schema/spec';

package/dist/durable/index.d.ts

@@ -1,6 +1,6 @@
 import { AgentStore, AgentRunInput, AgentLoopResult, LlmStepEnvelope, BufferedModelTurnResult, ToolStepEnvelope, AgentRunner, TokenStreamSink, HumanReply } from '@dudousxd/nestjs-agent-core';
 import { RunGateway, WorkflowCtx } from '@dudousxd/nestjs-durable-core';
-import { A as AgentDepsFactory, a as AgentSurface, b as AgentModuleOptions } from '../agent-deps.factory-OjrLyAZo.js';
+import { A as AgentDepsFactory, a as AgentSurface, b as AgentModuleOptions } from '../agent-deps.factory-CUyVPsa1.js';
 import { WorkflowService } from '@dudousxd/nestjs-durable';
 import { DynamicModule } from '@nestjs/common';
 import '@standard-schema/spec';

package/dist/durable/index.js

@@ -276,7 +276,21 @@ var AgentRunWorkflow = class _AgentRunWorkflow {
       runId: ctx.runId,
       // A child forwards into the top-level sink but must not end/fail it (the top-level run owns it).
       openSink: /* @__PURE__ */ __name(async () => input.sinkRunId !== void 0 ? childSinkWriter(await deps.sink.open(sinkRunId)) : deps.sink.open(ctx.runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`), "awaitApproval"),
+      // A policy's time to live becomes the signal wait's own timeout: the runtime journals the
+      // deadline on the first call (a position of its own, reached only for a call the journal says
+      // has a ttl) and wakes the run when it passes. The lapse comes back as a Decision rather than a
+      // throw, so the loop settles the call `expired` on its ordinary rejection checkpoint.
+      awaitApproval: /* @__PURE__ */ __name((call, _toolCtx, opts) => opts?.timeoutMs === void 0 ? ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`) : ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`, {
+        timeoutMs: opts.timeoutMs
+      }).catch((error) => {
+        if (isSignalTimeout(error)) {
+          return {
+            approved: false,
+            expired: true
+          };
+        }
+        throw error;
+      }), "awaitApproval"),
       // The same wait, on the same signal key, carrying a typed answer instead of a yes/no — so a
       // question set and an approval reach a parked run through one path, and the HTTP surface that
       // settles either one is the same `POST /agent/tool-call/*` family.
@@ -450,6 +464,10 @@ AgentRunWorkflow = _ts_decorate2([
     typeof RunGateway === "undefined" ? Object : RunGateway
   ])
 ], AgentRunWorkflow);
+function isSignalTimeout(error) {
+  return error instanceof Error && error.name === "SignalTimeoutError";
+}
+__name(isSignalTimeout, "isSignalTimeout");
 
 // src/durable/durable-agent-runner.ts
 import { randomUUID } from "crypto";
@@ -880,6 +898,9 @@ var AgentDepsFactory2 = class {
       store: this.store,
       sink: this.sink,
       rolesPolicy: this.rolesPolicy,
+      ...this.options.approvalPolicy !== void 0 ? {
+        approvalPolicy: this.options.approvalPolicy
+      } : {},
       registry: this.registry,
       promptContributors: this.promptContributors,
       systemPrompt: definition?.systemPrompt ?? "You are a helpful assistant.",
@@ -1027,8 +1048,8 @@ AgentDepsFactory2 = _ts_decorate5([
 ], AgentDepsFactory2);
 
 // src/agent.service.ts
-import { AGENT_ATTACHMENT_STAGING, AGENT_DEPS_FACTORY as AGENT_DEPS_FACTORY3, AGENT_QUOTA_STORE as AGENT_QUOTA_STORE2, AGENT_RUNNER, AGENT_STORE as AGENT_STORE4 } from "@dudousxd/nestjs-agent-core";
-import { BadRequestException, ForbiddenException, Inject as Inject5, Injectable as Injectable5, NotFoundException, NotImplementedException, Optional as Optional3 } from "@nestjs/common";
+import { AGENT_ATTACHMENT_STAGING, AGENT_DEPS_FACTORY as AGENT_DEPS_FACTORY3, AGENT_QUOTA_STORE as AGENT_QUOTA_STORE2, AGENT_RUNNER, AGENT_STORE as AGENT_STORE4, REQUESTER_APPROVER, mayDecideApproval, readElicitationQuestions, validateElicitationAnswer } from "@dudousxd/nestjs-agent-core";
+import { BadRequestException, ForbiddenException, GoneException, Inject as Inject5, Injectable as Injectable5, NotFoundException, NotImplementedException, Optional as Optional3 } from "@nestjs/common";
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1163,18 +1184,35 @@ var AgentService = class {
     await this.assertOwnsActiveStream(actor, runId);
     return this.subscribe(runId);
   }
-  async approve(actor, toolCallId2) {
-    await this.assertOwnsToolCall(actor, toolCallId2);
+  /**
+  * Approve a parked action call as `actor`. Who may is the call's recorded approver's business
+  * (see {@link assertMayDecide}); `remember` approves later calls of the same tool in the same
+  * thread, and `via` names the surface the decision came through (`'web'`, `'slack'`, …) — both
+  * persisted with the call.
+  */
+  async approve(actor, toolCallId2, opts = {}) {
+    await this.assertMayDecide(actor, toolCallId2);
     return this.signalToolCall(toolCallId2, {
-      approved: true
+      approved: true,
+      executedByRef: actor.id,
+      ...opts.remember === true ? {
+        remember: true
+      } : {},
+      ...opts.via !== void 0 ? {
+        decidedVia: opts.via
+      } : {}
     });
   }
-  async reject(actor, toolCallId2, reason) {
-    await this.assertOwnsToolCall(actor, toolCallId2);
+  async reject(actor, toolCallId2, reason, opts = {}) {
+    await this.assertMayDecide(actor, toolCallId2);
     return this.signalToolCall(toolCallId2, {
       approved: false,
+      executedByRef: actor.id,
       ...reason !== void 0 ? {
         reason
+      } : {},
+      ...opts.via !== void 0 ? {
+        decidedVia: opts.via
       } : {}
     });
   }
@@ -1186,6 +1224,7 @@ var AgentService = class {
   */
   async answer(actor, toolCallId2, answers2 = {}) {
     await this.assertOwnsToolCall(actor, toolCallId2);
+    await this.assertAnswersFit(toolCallId2, answers2);
     const reply = {
       answers: answers2,
       answeredByRef: actor.id
@@ -1215,6 +1254,7 @@ var AgentService = class {
   * not the thread's own actor).
   */
   async signalToolCall(toolCallId2, reply) {
+    await this.assertNotExpired(toolCallId2);
     const runId = await this.resolveRunForToolCall(toolCallId2);
     return this.runner.signal(runId, toolCallId2, reply);
   }
@@ -1453,6 +1493,68 @@ var AgentService = class {
     }
   }
   /**
+  * Check a reply against the questions it answers before it is signalled: every submitted value a
+  * question's own rules accept (a typed input's type, bounds and pattern; a pick from the offered
+  * options), and every `required` question answered — by the reply, or by the defaults an omitted
+  * question falls back to. A reply the loop would have to drop parts of is refused here instead, so
+  * the person who typed it hears why. Needs the store to hand back the call's recorded questions;
+  * without that seam the loop's own filtering is the only check.
+  */
+  async assertAnswersFit(toolCallId2, answers2) {
+    if (this.store.toolCallInput === void 0) {
+      return;
+    }
+    const questions = readElicitationQuestions(await this.store.toolCallInput(toolCallId2));
+    for (const question of questions) {
+      const submitted = Object.hasOwn(answers2, question.id) ? answers2[question.id] : void 0;
+      const problem = validateElicitationAnswer(question, submitted ?? question.defaults ?? []);
+      if (problem !== null) {
+        throw new BadRequestException(`answers["${question.id}"] ${problem}`);
+      }
+    }
+  }
+  /**
+  * Authorization seam for approve/reject. The call's recorded approver decides who may settle it:
+  * the requester (the default, and every call recorded before approvers existed) is the thread's
+  * own actor — the ownership check this always was; any other approver goes through the policy's
+  * `canDecide`, which by default asks whether the actor holds that role.
+  */
+  async assertMayDecide(actor, toolCallId2) {
+    const approval = await this.store.toolCallApproval?.(toolCallId2);
+    const approver = approval?.approver ?? REQUESTER_APPROVER;
+    if (approver === REQUESTER_APPROVER) {
+      return this.assertOwnsToolCall(actor, toolCallId2);
+    }
+    const requesterRef = await this.store.ownerOfToolCall(toolCallId2);
+    if (requesterRef === null) {
+      throw new NotFoundException(`tool call ${toolCallId2} not found`);
+    }
+    const allowed = await mayDecideApproval(this.deps.forAgent().approvalPolicy, actor, {
+      toolCallId: toolCallId2,
+      approver,
+      requesterRef
+    });
+    if (!allowed) {
+      throw new ForbiddenException(`this approval is for ${approver}`);
+    }
+  }
+  /**
+  * Refuse a decision on a request that has already lapsed — recorded `expired`, or past its
+  * `expiresAt` with the run's own timer about to fire. Signalling it anyway would race the timeout:
+  * a durable runtime buffers a signal nobody is waiting on, and a late approval must not be what a
+  * later replay of the run reads back.
+  */
+  async assertNotExpired(toolCallId2) {
+    const approval = await this.store.toolCallApproval?.(toolCallId2);
+    if (approval === null || approval === void 0) {
+      return;
+    }
+    const lapsed = approval.status === "expired" || approval.status === "pending_approval" && approval.expiresAt !== null && Date.parse(approval.expiresAt) <= Date.now();
+    if (lapsed) {
+      throw new GoneException(`the approval request for tool call ${toolCallId2} has expired`);
+    }
+  }
+  /**
   * Resolve the run awaiting `toolCallId`. Derived server-side from the tool call alone — the client
   * never knows or supplies a runId, and that run is the sub-agent's own child run when the pending
   * call belongs to a delegated agent. The store answers from the CALL'S OWN `runId` where it has
@@ -1530,6 +1632,12 @@ var AgentApprovalPortAdapter = class {
       approved: true,
       ...opts?.executedByRef !== void 0 ? {
         executedByRef: opts.executedByRef
+      } : {},
+      ...opts?.remember === true ? {
+        remember: true
+      } : {},
+      ...opts?.decidedVia !== void 0 ? {
+        decidedVia: opts.decidedVia
       } : {}
     });
   }
@@ -1541,6 +1649,9 @@ var AgentApprovalPortAdapter = class {
       } : {},
       ...opts?.reason !== void 0 ? {
         reason: opts.reason
+      } : {},
+      ...opts?.decidedVia !== void 0 ? {
+        decidedVia: opts.decidedVia
       } : {}
     });
   }
@@ -2460,6 +2571,8 @@ var MAX_ANSWERED_QUESTIONS = 100;
 var MAX_VALUES_PER_QUESTION = 100;
 var MAX_ANSWER_VALUE_LENGTH = 4096;
 var MAX_REJECT_REASON_LENGTH = 4096;
+var MAX_VIA_LENGTH = 64;
+var DEFAULT_VIA = "web";
 function toolCallId(claimed) {
   if (typeof claimed !== "string" || claimed.length === 0) {
     throw new BadRequestException4("toolCallId must be a non-empty string");
@@ -2480,6 +2593,26 @@ function rejectReason(claimed) {
   return claimed;
 }
 __name(rejectReason, "rejectReason");
+function remember(claimed) {
+  if (claimed === void 0) {
+    return false;
+  }
+  if (typeof claimed !== "boolean") {
+    throw new BadRequestException4("remember must be a boolean");
+  }
+  return claimed;
+}
+__name(remember, "remember");
+function via(claimed) {
+  if (claimed === void 0) {
+    return DEFAULT_VIA;
+  }
+  if (typeof claimed !== "string" || claimed.length === 0 || claimed.length > MAX_VIA_LENGTH) {
+    throw new BadRequestException4(`via must be a string of 1-${MAX_VIA_LENGTH} characters`);
+  }
+  return claimed;
+}
+__name(via, "via");
 function answers(claimed) {
   if (claimed === void 0) {
     return void 0;
@@ -2524,14 +2657,19 @@ var ToolCallController = class {
   }
   async approve(req, body) {
     const actor = await this.actorResolver.resolve(req);
-    await this.agent.approve(actor, toolCallId(body.toolCallId));
+    await this.agent.approve(actor, toolCallId(body.toolCallId), {
+      remember: remember(body.remember),
+      via: via(body.via)
+    });
     return {
       ok: true
     };
   }
   async reject(req, body) {
     const actor = await this.actorResolver.resolve(req);
-    await this.agent.reject(actor, toolCallId(body.toolCallId), rejectReason(body.reason));
+    await this.agent.reject(actor, toolCallId(body.toolCallId), rejectReason(body.reason), {
+      via: via(body.via)
+    });
     return {
       ok: true
     };
@@ -2597,7 +2735,7 @@ _ts_decorate15([
   _ts_metadata14("design:type", Function),
   _ts_metadata14("design:paramtypes", [
     typeof Request === "undefined" ? Object : Request,
-    typeof ApproveBody === "undefined" ? Object : ApproveBody
+    Object
   ]),
   _ts_metadata14("design:returntype", Promise)
 ], ToolCallController.prototype, "skip", null);
@@ -3342,6 +3480,36 @@ var InlineAgentRunner = class _InlineAgentRunner {
   * shape it is delivering — the loop asked for one and only ever gets what the caller sent. A
   * cancel settles the wait too, by rejecting it.
   */
+  /**
+  * {@link park} for an approval, bounded by the policy's time to live when it has one: the timer
+  * settles the wait as `expired` — the same Decision the durable runner builds from its signal
+  * timeout — and a decision that arrives first disarms it.
+  */
+  parkApproval(runId, toolCallId2, timeoutMs) {
+    const waiting = this.park(runId, toolCallId2);
+    if (timeoutMs === void 0) {
+      return waiting;
+    }
+    const key = `${runId}:${toolCallId2}`;
+    let timer;
+    const lapse = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        const entry = this.pending.get(key);
+        if (entry !== void 0) {
+          this.pending.delete(key);
+          resolve({
+            approved: false,
+            expired: true
+          });
+        }
+      }, timeoutMs);
+      timer.unref?.();
+    });
+    return Promise.race([
+      waiting,
+      lapse
+    ]).finally(() => clearTimeout(timer));
+  }
   park(runId, toolCallId2) {
     return new Promise((resolve, reject) => {
       this.pending.set(`${runId}:${toolCallId2}`, {
@@ -3355,7 +3523,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
     return {
       runId,
       openSink: /* @__PURE__ */ __name(() => deps.sink.open(runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: settleAll2,
@@ -3406,7 +3574,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
     const hooks = {
       runId,
       openSink: /* @__PURE__ */ __name(() => deps.sink.open(runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: settleAll2,
@@ -3510,7 +3678,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
       runId,
       // Forward into the top-level stream; the top-level run owns end/fail on that shared sink.
       openSink: /* @__PURE__ */ __name(async () => childSinkWriter(await deps.sink.open(sinkRunId)), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: settleAll2,