@endora-commerce/mod-prompt-actions 0.0.0-stage → 0.100.0

package/dist/backend/services/plan-executor.service.js

@@ -0,0 +1,132 @@
+/**
+ * PlanExecutorService — feature 043 US1/US2 (research §R6).
+ *
+ * Walks a confirmed plan with defense-in-depth re-validation: catalogue
+ * membership, Zod params, and the operator's LIVE permission are all checked
+ * again at execution time (a plan may be minutes old — FR-007). Execution
+ * delegates to the owning module's service through the tool handler; this
+ * module owns zero domain logic.
+ *
+ * Partial-failure semantics (FR-011): independent operations keep their
+ * outcome; one failure never rolls back a previously succeeded operation.
+ */
+export class PermissionRevoked extends Error {
+    toolId;
+    permission;
+    name = 'PermissionRevoked';
+    code = 'PROMPT_PERMISSION_REVOKED';
+    constructor(toolId, permission) {
+        super(`Permission "${permission}" required by "${toolId}" is no longer held by the operator.`);
+        this.toolId = toolId;
+        this.permission = permission;
+    }
+}
+export function isDelegatedExecution(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.delegated === true &&
+        typeof value.bulkOperationId === 'string');
+}
+function extractSummary(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const summary = value.summary;
+    if (typeof summary !== 'object' || summary === null)
+        return null;
+    const s = summary;
+    if (typeof s.total !== 'number' ||
+        typeof s.succeeded !== 'number' ||
+        typeof s.failed !== 'number') {
+        return null;
+    }
+    return summary;
+}
+export class PlanExecutorService {
+    registry;
+    constructor(registry) {
+        this.registry = registry;
+    }
+    /**
+     * Executes every operation in the plan. Throws {@link PermissionRevoked}
+     * (the whole request becomes `refused`) when a live permission check
+     * fails BEFORE any operation has run; revocation discovered mid-plan is
+     * reported as a per-operation failure instead (already-applied work must
+     * stay applied — FR-011).
+     */
+    async execute(plan, toolCtx, visibility) {
+        // Up-front live permission sweep: refuse before side effects.
+        for (const op of plan.operations) {
+            const tool = this.registry.get(op.toolId);
+            if (tool && !(await visibility.hasPermission(tool.requiredPermission))) {
+                throw new PermissionRevoked(op.toolId, tool.requiredPermission);
+            }
+        }
+        const operations = [];
+        let bulkOperationId = null;
+        for (const op of plan.operations) {
+            const tool = this.registry.get(op.toolId);
+            if (!tool || tool.kind !== 'mutation') {
+                operations.push({
+                    toolId: op.toolId,
+                    status: 'failed',
+                    message: 'Operation is no longer available on this platform.',
+                });
+                continue;
+            }
+            if (!(await visibility.isModuleInstalled(tool.moduleId))) {
+                operations.push({
+                    toolId: op.toolId,
+                    status: 'failed',
+                    message: 'The owning module is disabled.',
+                });
+                continue;
+            }
+            const params = tool.paramsSchema.safeParse(op.params);
+            if (!params.success) {
+                operations.push({
+                    toolId: op.toolId,
+                    status: 'failed',
+                    message: 'Stored plan parameters failed re-validation.',
+                });
+                continue;
+            }
+            try {
+                const value = await tool.execute(params.data, toolCtx);
+                if (isDelegatedExecution(value)) {
+                    bulkOperationId = value.bulkOperationId;
+                    operations.push({
+                        toolId: op.toolId,
+                        status: 'delegated',
+                        bulkOperationId: value.bulkOperationId,
+                    });
+                }
+                else {
+                    // Bulk handlers report per-item outcomes (FR-011) via a `summary`
+                    // payload; single-record handlers return plain data.
+                    const summary = extractSummary(value);
+                    operations.push({
+                        toolId: op.toolId,
+                        status: 'succeeded',
+                        ...(summary ? { summary } : {}),
+                    });
+                }
+            }
+            catch (err) {
+                operations.push({
+                    toolId: op.toolId,
+                    status: 'failed',
+                    message: err.message ?? 'Execution failed.',
+                });
+            }
+        }
+        const failedOps = operations.filter((o) => o.status === 'failed').length;
+        const partialFailures = operations.reduce((n, o) => n + (o.summary?.failed ?? 0), 0);
+        const outcome = failedOps === operations.length && operations.length > 0
+            ? 'failed'
+            : failedOps === 0 && partialFailures === 0
+                ? 'completed'
+                : 'completed_with_errors';
+        return { result: { outcome, operations }, bulkOperationId };
+    }
+}
+//# sourceMappingURL=plan-executor.service.js.map

package/dist/backend/services/plan-executor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-executor.service.js","sourceRoot":"","sources":["../../../src/backend/services/plan-executor.service.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;GAWG;AAEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGd;IAAgC;IAF1C,IAAI,GAAG,mBAAmB,CAAC;IACpC,IAAI,GAAG,2BAAoC,CAAC;IACrD,YAA4B,MAAc,EAAkB,UAAkB;QAC5E,KAAK,CAAC,eAAe,UAAU,kBAAkB,MAAM,sCAAsC,CAAC,CAAC;QADrE,WAAM,GAAN,MAAM,CAAQ;QAAkB,eAAU,GAAV,UAAU,CAAQ;IAE9E,CAAC;CACF;AAaD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,SAAS,KAAK,IAAI;QACrD,OAAQ,KAAuC,CAAC,eAAe,KAAK,QAAQ,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,GAAG,OAAqE,CAAC;IAChF,IACE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAqC,CAAC;AAC/C,CAAC;AAQD,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,QAAkC;QAAlC,aAAQ,GAAR,QAAQ,CAA0B;IAAG,CAAC;IAEnE;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,IAAsB,EACtB,OAAoB,EACpB,UAA8B;QAE9B,8DAA8D;QAC9D,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,IAAI,eAAe,GAAkB,IAAI,CAAC;QAE1C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,oDAAoD;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACvD,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;oBACxC,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,MAAM,EAAE,WAAW;wBACnB,eAAe,EAAE,KAAK,CAAC,eAAe;qBACvC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,kEAAkE;oBAClE,qDAAqD;oBACrD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACtC,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,MAAM,EAAE,WAAW;wBACnB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAG,GAAa,CAAC,OAAO,IAAI,mBAAmB;iBACvD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,OAAO,GACX,SAAS,KAAK,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACtD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC;gBACxC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,uBAAuB,CAAC;QAEhC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC;IAC9D,CAAC;CACF"}

package/dist/backend/services/prompt-request.service.d.ts

@@ -0,0 +1,84 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type BulkProgressSnapshot, type ToolAuditContext } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import { PromptActionRequest } from '../entities/prompt-action-request.entity.js';
+import type { InterpreterService } from './interpreter.service.js';
+import { type PlanExecutorService } from './plan-executor.service.js';
+/**
+ * PromptRequestService — feature 043 lifecycle (data-model §2).
+ *
+ * Owns the `prompt_action_requests` state machine: submit (interpretation in
+ * the request path), idempotent confirm with lazy 10-minute expiry, cancel,
+ * the single clarify round-trip, owner-scoped reads, and the seen-marker
+ * queries behind the FR-018 completion notice. All state-changing audit rows
+ * (`prompt_action.execute`, `prompt_action.refused`) are recorded here.
+ */
+export interface OperatorVisibilityFactory {
+    (adminUserId: string): {
+        hasPermission(permission: string): Promise<boolean>;
+        isModuleInstalled(moduleId: string): Promise<boolean>;
+    };
+}
+export interface PromptRequestServiceDeps {
+    emFactory: () => EntityManager;
+    interpreter: InterpreterService;
+    executor: PlanExecutorService;
+    auditLogService?: AuditPort;
+    visibilityFor: OperatorVisibilityFactory;
+    /**
+     * US2: reads live progress for a delegated bulk operation from whichever
+     * module started it.
+     *
+     * Data in, data out (D-76). It used to be handed the request row and the
+     * `EntityManager` and left to mutate both, which put this module's state
+     * machine in a contributor's hands; the fold and the terminal-status decision
+     * live in {@link foldBulkProgress} now.
+     */
+    bulkProgressReader?: (bulkOperationId: string) => Promise<BulkProgressSnapshot | null>;
+    ttlMinutes?: number;
+    now?: () => Date;
+}
+export interface OperatorContext {
+    adminUserId: string;
+    language?: string | null;
+    auditCtx: ToolAuditContext;
+}
+export declare class PromptRequestService {
+    private readonly deps;
+    constructor(deps: PromptRequestServiceDeps);
+    private now;
+    private ttlMs;
+    expiresAt(row: PromptActionRequest): Date | null;
+    submit(op: OperatorContext, prompt: string): Promise<PromptActionRequest>;
+    clarify(op: OperatorContext, id: string, answer: {
+        selectedCandidateId?: string;
+        text?: string;
+    }): Promise<PromptActionRequest>;
+    private runInterpretation;
+    confirm(op: OperatorContext, id: string): Promise<PromptActionRequest>;
+    cancel(op: OperatorContext, id: string): Promise<PromptActionRequest>;
+    get(op: OperatorContext, id: string): Promise<PromptActionRequest>;
+    /**
+     * Fold one contributor's snapshot into the request, and rule on the request's
+     * own terminal status (D-76, FR-011/FR-018).
+     *
+     * Both halves used to live in `catalog/prompt-tools.ts`, which meant a
+     * contributing module decided whether *this* module's request was
+     * `completed`, `failed` or `completed_with_errors`. The mapping is unchanged
+     * — it is moved, not rewritten: a run that ended with no failures completed,
+     * one with no successes failed, and anything between is
+     * `completed_with_errors`.
+     *
+     * `snapshot.terminal` says only that the bulk run ended. What it ended *as*
+     * for the request is read from the counts, which is what the previous
+     * implementation did too — it tested `op.status` for "ended" and then ignored
+     * it.
+     */
+    private foldBulkProgress;
+    listUnseenFinished(op: OperatorContext, limit: number): Promise<PromptActionRequest[]>;
+    markSeen(op: OperatorContext, id: string): Promise<void>;
+    private loadOwned;
+    private auditExecution;
+    private auditRefusal;
+}
+//# sourceMappingURL=prompt-request.service.d.ts.map

package/dist/backend/services/prompt-request.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-request.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/prompt-request.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAEtB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEzF;;;;;;;;GAQG;AAEH,MAAM,WAAW,yBAAyB;IACxC,CAAC,WAAW,EAAE,MAAM,GAAG;QACrB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACvD,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,aAAa,EAAE,yBAAyB,CAAC;IACzC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAID,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,wBAAwB;IAE3D,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,KAAK;IAIb,SAAS,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAS1C,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiCzE,OAAO,CACX,EAAE,EAAE,eAAe,EACnB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACtD,OAAO,CAAC,mBAAmB,CAAC;YAmCjB,iBAAiB;IAwEzB,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA0FtE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAkBrE,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAexE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,gBAAgB;IA2BlB,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAatF,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAehD,SAAS;YAaT,cAAc;YAyBd,YAAY;CAe3B"}

package/dist/backend/services/prompt-request.service.js

@@ -0,0 +1,338 @@
+import { ERROR_CODES, PROMPT_ACTION_PLAN_TTL_MINUTES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { PromptActionRequest } from '../entities/prompt-action-request.entity.js';
+import { PermissionRevoked } from './plan-executor.service.js';
+const IN_FLIGHT_STATUSES = ['interpreting', 'executing'];
+export class PromptRequestService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    now() {
+        return this.deps.now ? this.deps.now() : new Date();
+    }
+    ttlMs() {
+        return (this.deps.ttlMinutes ?? PROMPT_ACTION_PLAN_TTL_MINUTES) * 60_000;
+    }
+    expiresAt(row) {
+        if (row.status !== 'awaiting_confirmation')
+            return null;
+        return new Date(row.updatedAt.getTime() + this.ttlMs());
+    }
+    // --------------------------------------------------------------------
+    // Submit (interpretation)
+    // --------------------------------------------------------------------
+    async submit(op, prompt) {
+        // command-coverage-ignore: prompt-action request-queue lifecycle — the executed
+        // admin action is audited by its target service; this is queue state.
+        const em = this.deps.emFactory();
+        const inFlight = await em.count(PromptActionRequest, {
+            adminUserId: op.adminUserId,
+            status: { $in: [...IN_FLIGHT_STATUSES] },
+        });
+        if (inFlight > 0) {
+            throw new HttpError(429, ERROR_CODES.PROMPT_REQUEST_IN_FLIGHT, 'Another prompt is still being processed for this operator.');
+        }
+        const row = em.create(PromptActionRequest, {
+            adminUserId: op.adminUserId,
+            prompt,
+            language: op.language ?? null,
+            status: 'interpreting',
+        });
+        await em.flush();
+        await this.runInterpretation(em, row, op, { resume: false });
+        return row;
+    }
+    // --------------------------------------------------------------------
+    // Clarify (single round-trip, US3)
+    // --------------------------------------------------------------------
+    async clarify(op, id, answer) {
+        // command-coverage-ignore: prompt-action request-queue lifecycle — the executed
+        // admin action is audited by its target service; this is queue state.
+        const em = this.deps.emFactory();
+        const row = await this.loadOwned(em, id, op.adminUserId);
+        if (row.status !== 'needs_clarification') {
+            throw new HttpError(409, ERROR_CODES.PROMPT_REQUEST_INVALID_STATE, `Request is "${row.status}", not awaiting clarification.`);
+        }
+        const candidate = answer.selectedCandidateId
+            ? row.clarification?.candidates?.find((c) => c.id === answer.selectedCandidateId)
+            : undefined;
+        if (answer.selectedCandidateId && !candidate) {
+            throw new HttpError(400, ERROR_CODES.VALIDATION_FAILED, 'selectedCandidateId does not match any offered candidate.');
+        }
+        const answerText = candidate
+            ? `The operator chose: ${candidate.label} (id: ${candidate.id}).`
+            : (answer.text ?? '');
+        row.status = 'interpreting';
+        row.clarification = null;
+        await em.flush();
+        await this.runInterpretation(em, row, op, { resume: true, answerText });
+        return row;
+    }
+    async runInterpretation(em, row, op, opts) {
+        const toolCtx = {
+            adminUserId: op.adminUserId,
+            requestId: row.id,
+            auditCtx: op.auditCtx,
+        };
+        const outcome = await this.deps.interpreter.interpret({
+            prompt: row.prompt,
+            toolCtx,
+            visibility: this.deps.visibilityFor(op.adminUserId),
+            resumeConversation: opts.resume ? row.conversation : null,
+            clarificationAnswer: opts.answerText ?? null,
+        });
+        switch (outcome.kind) {
+            case 'plan':
+                row.status = 'awaiting_confirmation';
+                row.plan = outcome.plan;
+                row.conversation = outcome.conversation;
+                row.provider = outcome.provider;
+                row.model = outcome.model;
+                break;
+            case 'clarification':
+                if (opts.resume) {
+                    // Second clarification round → unsupported (data-model §2).
+                    row.status = 'unsupported';
+                    row.error =
+                        'The instruction stayed ambiguous after one clarification — please rephrase it.';
+                    row.finishedAt = this.now();
+                    break;
+                }
+                row.status = 'needs_clarification';
+                row.clarification = outcome.clarification;
+                row.conversation = outcome.conversation;
+                row.provider = outcome.provider;
+                row.model = outcome.model;
+                break;
+            case 'unsupported':
+                row.status = 'unsupported';
+                row.error = outcome.detail;
+                row.finishedAt = this.now();
+                break;
+            case 'refused':
+                row.status = 'refused';
+                row.error = outcome.detail;
+                row.finishedAt = this.now();
+                await this.auditRefusal(row, op, 'interpretation');
+                break;
+            case 'blocked_bulk_limit':
+                row.status = 'unsupported';
+                row.error = `The prompt would affect ${outcome.affectedCount} records — the configured limit is ${outcome.limit}. Narrow the instruction.`;
+                row.finishedAt = this.now();
+                break;
+            case 'failed':
+                row.status = 'failed';
+                row.error = outcome.detail;
+                row.finishedAt = this.now();
+                break;
+        }
+        await em.flush();
+    }
+    // --------------------------------------------------------------------
+    // Confirm → execute
+    // --------------------------------------------------------------------
+    async confirm(op, id) {
+        const em = this.deps.emFactory();
+        const row = await this.loadOwned(em, id, op.adminUserId);
+        // Idempotency (FR-006): a repeat confirm returns the current state.
+        if (row.status === 'executing' ||
+            row.status === 'completed' ||
+            row.status === 'completed_with_errors') {
+            return row;
+        }
+        if (row.status !== 'awaiting_confirmation') {
+            throw new HttpError(409, ERROR_CODES.PROMPT_REQUEST_INVALID_STATE, `Request is "${row.status}" and cannot be confirmed.`);
+        }
+        // Lazy expiry (research §R5): no sweeper — checked exactly here.
+        const expiresAt = this.expiresAt(row);
+        if (expiresAt && this.now().getTime() > expiresAt.getTime()) {
+            row.status = 'expired';
+            row.finishedAt = this.now();
+            await em.flush();
+            throw new HttpError(409, ERROR_CODES.PROMPT_PLAN_EXPIRED, 'The plan expired before confirmation — submit the prompt again.');
+        }
+        // Atomic claim: only one confirm transitions to `executing`.
+        const claimed = await em.nativeUpdate(PromptActionRequest, { id: row.id, status: 'awaiting_confirmation' }, { status: 'executing', confirmedAt: this.now(), updatedAt: this.now() });
+        if (claimed === 0) {
+            em.clear();
+            return this.loadOwned(this.deps.emFactory(), id, op.adminUserId);
+        }
+        row.status = 'executing';
+        row.confirmedAt = this.now();
+        const toolCtx = {
+            adminUserId: op.adminUserId,
+            requestId: row.id,
+            auditCtx: op.auditCtx,
+        };
+        try {
+            const { result, bulkOperationId } = await this.deps.executor.execute(row.plan, toolCtx, this.deps.visibilityFor(op.adminUserId));
+            row.result = result;
+            if (bulkOperationId) {
+                // Delegated bulk work: stays `executing`; GET folds live progress in.
+                row.bulkOperationId = bulkOperationId;
+            }
+            else {
+                row.status = result.outcome;
+                row.finishedAt = this.now();
+            }
+            await em.flush();
+            await this.auditExecution(row, op);
+            return row;
+        }
+        catch (err) {
+            if (err instanceof PermissionRevoked) {
+                row.status = 'refused';
+                row.error = err.message;
+                row.finishedAt = this.now();
+                await em.flush();
+                await this.auditRefusal(row, op, 'execution');
+                throw new HttpError(403, ERROR_CODES.PROMPT_PERMISSION_REVOKED, err.message);
+            }
+            row.status = 'failed';
+            row.error = err.message ?? 'Execution failed.';
+            row.finishedAt = this.now();
+            await em.flush();
+            throw err;
+        }
+    }
+    // --------------------------------------------------------------------
+    // Cancel / read / seen
+    // --------------------------------------------------------------------
+    async cancel(op, id) {
+        // command-coverage-ignore: prompt-action request-queue lifecycle — the executed
+        // admin action is audited by its target service; this is queue state.
+        const em = this.deps.emFactory();
+        const row = await this.loadOwned(em, id, op.adminUserId);
+        if (row.status !== 'awaiting_confirmation' && row.status !== 'needs_clarification') {
+            throw new HttpError(409, ERROR_CODES.PROMPT_REQUEST_INVALID_STATE, `Request is "${row.status}" and cannot be cancelled.`);
+        }
+        row.status = 'cancelled';
+        row.finishedAt = this.now();
+        await em.flush();
+        return row;
+    }
+    async get(op, id) {
+        const em = this.deps.emFactory();
+        const row = await this.loadOwned(em, id, op.adminUserId);
+        if (row.status === 'executing' && row.bulkOperationId && this.deps.bulkProgressReader) {
+            const snapshot = await this.deps.bulkProgressReader(row.bulkOperationId);
+            if (snapshot)
+                this.foldBulkProgress(row, snapshot);
+            if (row.status !== 'executing') {
+                row.finishedAt = row.finishedAt ?? this.now();
+                await em.flush();
+                await this.auditExecution(row, op);
+            }
+        }
+        return row;
+    }
+    /**
+     * Fold one contributor's snapshot into the request, and rule on the request's
+     * own terminal status (D-76, FR-011/FR-018).
+     *
+     * Both halves used to live in `catalog/prompt-tools.ts`, which meant a
+     * contributing module decided whether *this* module's request was
+     * `completed`, `failed` or `completed_with_errors`. The mapping is unchanged
+     * — it is moved, not rewritten: a run that ended with no failures completed,
+     * one with no successes failed, and anything between is
+     * `completed_with_errors`.
+     *
+     * `snapshot.terminal` says only that the bulk run ended. What it ended *as*
+     * for the request is read from the counts, which is what the previous
+     * implementation did too — it tested `op.status` for "ended" and then ignored
+     * it.
+     */
+    foldBulkProgress(row, snapshot) {
+        if (!row.result || !row.bulkOperationId)
+            return;
+        const summary = {
+            total: snapshot.total,
+            succeeded: snapshot.succeeded,
+            failed: snapshot.failed,
+            failures: snapshot.failures,
+        };
+        row.result = {
+            ...row.result,
+            operations: row.result.operations.map((operation) => operation.bulkOperationId === row.bulkOperationId ? { ...operation, summary } : operation),
+        };
+        if (snapshot.terminal === null)
+            return;
+        const outcome = snapshot.failed === 0
+            ? 'completed'
+            : snapshot.succeeded === 0
+                ? 'failed'
+                : 'completed_with_errors';
+        row.result = { ...row.result, outcome };
+        row.status = outcome;
+        if (snapshot.error)
+            row.error = snapshot.error;
+    }
+    async listUnseenFinished(op, limit) {
+        const em = this.deps.emFactory();
+        return em.find(PromptActionRequest, {
+            adminUserId: op.adminUserId,
+            status: { $in: ['completed', 'completed_with_errors', 'failed'] },
+            seenAt: null,
+        }, { orderBy: { createdAt: 'desc' }, limit });
+    }
+    async markSeen(op, id) {
+        // command-coverage-ignore: prompt-action request-queue lifecycle — the executed
+        // admin action is audited by its target service; this is queue state.
+        const em = this.deps.emFactory();
+        const row = await this.loadOwned(em, id, op.adminUserId);
+        if (!row.seenAt) {
+            row.seenAt = this.now();
+            await em.flush();
+        }
+    }
+    // --------------------------------------------------------------------
+    // Internals
+    // --------------------------------------------------------------------
+    async loadOwned(em, id, adminUserId) {
+        const row = await em.findOne(PromptActionRequest, { id });
+        // Foreign requests 404 (not 403) to avoid existence leaks (contract §1).
+        if (!row || row.adminUserId !== adminUserId) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Prompt request not found.');
+        }
+        return row;
+    }
+    async auditExecution(row, op) {
+        if (!this.deps.auditLogService)
+            return;
+        await this.deps.auditLogService.record({
+            actorAdminUserId: op.adminUserId,
+            action: 'prompt_action.execute',
+            objectType: 'prompt_action_request',
+            objectId: row.id,
+            stateAfter: {
+                prompt: row.prompt,
+                provider: row.provider,
+                model: row.model,
+                operations: row.plan?.operations.map((o) => ({
+                    toolId: o.toolId,
+                    params: o.params,
+                    headline: o.preview.headline,
+                })),
+                outcome: row.result?.outcome ?? row.status,
+                bulkOperationId: row.bulkOperationId,
+            },
+            ...(op.auditCtx.ipAddress !== undefined ? { ipAddress: op.auditCtx.ipAddress } : {}),
+            ...(op.auditCtx.userAgent !== undefined ? { userAgent: op.auditCtx.userAgent } : {}),
+            ...(op.auditCtx.requestId !== undefined ? { requestId: op.auditCtx.requestId } : {}),
+        });
+    }
+    async auditRefusal(row, op, phase) {
+        if (!this.deps.auditLogService)
+            return;
+        await this.deps.auditLogService.record({
+            actorAdminUserId: op.adminUserId,
+            action: 'prompt_action.refused',
+            objectType: 'prompt_action_request',
+            objectId: row.id,
+            stateAfter: { prompt: row.prompt, phase, detail: row.error },
+            ...(op.auditCtx.requestId !== undefined ? { requestId: op.auditCtx.requestId } : {}),
+        });
+    }
+}
+//# sourceMappingURL=prompt-request.service.js.map

package/dist/backend/services/prompt-request.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-request.service.js","sourceRoot":"","sources":["../../../src/backend/services/prompt-request.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,8BAA8B,GAI/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAA4B,MAAM,4BAA4B,CAAC;AA6CzF,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,WAAW,CAAU,CAAC;AAElE,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,IAA8B;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAEvD,GAAG;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACtD,CAAC;IAEO,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,8BAA8B,CAAC,GAAG,MAAM,CAAC;IAC3E,CAAC;IAED,SAAS,CAAC,GAAwB;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,uEAAuE;IACvE,0BAA0B;IAC1B,uEAAuE;IAEvE,KAAK,CAAC,MAAM,CAAC,EAAmB,EAAE,MAAc;QAC9C,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACnD,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACzC,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,MAAM;YACN,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI;YAC7B,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uEAAuE;IACvE,mCAAmC;IACnC,uEAAuE;IAEvE,KAAK,CAAC,OAAO,CACX,EAAmB,EACnB,EAAU,EACV,MAAuD;QAEvD,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,4BAA4B,EACxC,eAAe,GAAG,CAAC,MAAM,gCAAgC,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB;YAC1C,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,mBAAmB,CAAC;YACjF,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,SAAS;YAC1B,CAAC,CAAC,uBAAuB,SAAS,CAAC,KAAK,SAAS,SAAS,CAAC,EAAE,IAAI;YACjE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAExB,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC;QAC5B,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,EAAiB,EACjB,GAAwB,EACxB,EAAmB,EACnB,IAA8C;QAE9C,MAAM,OAAO,GAAgB;YAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,QAAQ,EAAE,EAAE,CAAC,QAAQ;SACtB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,CAAC,YAA0C,CAAC,CAAC,CAAC,IAAI;YACxF,mBAAmB,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;SAC7C,CAAC,CAAC;QAEH,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,GAAG,CAAC,MAAM,GAAG,uBAAuB,CAAC;gBACrC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBACxB,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;gBACxC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAChC,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC1B,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,4DAA4D;oBAC5D,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC;oBAC3B,GAAG,CAAC,KAAK;wBACP,gFAAgF,CAAC;oBACnF,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC5B,MAAM;gBACR,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,qBAAqB,CAAC;gBACnC,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;gBAC1C,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;gBACxC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAChC,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC1B,MAAM;YACR,KAAK,aAAa;gBAChB,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC;gBAC3B,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,SAAS;gBACZ,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,oBAAoB;gBACvB,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC;gBAC3B,GAAG,CAAC,KAAK,GAAG,2BAA2B,OAAO,CAAC,aAAa,sCAAsC,OAAO,CAAC,KAAK,2BAA2B,CAAC;gBAC3I,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;gBACtB,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM;QACV,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,uEAAuE;IACvE,oBAAoB;IACpB,uEAAuE;IAEvE,KAAK,CAAC,OAAO,CAAC,EAAmB,EAAE,EAAU;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QAEzD,oEAAoE;QACpE,IACE,GAAG,CAAC,MAAM,KAAK,WAAW;YAC1B,GAAG,CAAC,MAAM,KAAK,WAAW;YAC1B,GAAG,CAAC,MAAM,KAAK,uBAAuB,EACtC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,4BAA4B,EACxC,eAAe,GAAG,CAAC,MAAM,4BAA4B,CACtD,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,mBAAmB,EAC/B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CACnC,mBAAmB,EACnB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAC/C,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CACxE,CAAC;QACF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;QACzB,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,OAAO,GAAgB;YAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,QAAQ,EAAE,EAAE,CAAC,QAAQ;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAClE,GAAG,CAAC,IAAK,EACT,OAAO,EACP,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,CAAC,CACxC,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,IAAI,eAAe,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,GAAG,CAAC,eAAe,GAAG,eAAe,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC5B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;gBACvB,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;gBACxB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;YACtB,GAAG,CAAC,KAAK,GAAI,GAAa,CAAC,OAAO,IAAI,mBAAmB,CAAC;YAC1D,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uBAAuB;IACvB,uEAAuE;IAEvE,KAAK,CAAC,MAAM,CAAC,EAAmB,EAAE,EAAU;QAC1C,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,uBAAuB,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACnF,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,4BAA4B,EACxC,eAAe,GAAG,CAAC,MAAM,4BAA4B,CACtD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;QACzB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAmB,EAAE,EAAU;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACzE,IAAI,QAAQ;gBAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,gBAAgB,CAAC,GAAwB,EAAE,QAA8B;QAC/E,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe;YAAE,OAAO;QAChD,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;QACF,GAAG,CAAC,MAAM,GAAG;YACX,GAAG,GAAG,CAAC,MAAM;YACb,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAClD,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1F;SACF,CAAC;QAEF,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACvC,MAAM,OAAO,GACX,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,CAAC;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,uBAAuB,CAAC;QAChC,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;QACrB,IAAI,QAAQ,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAmB,EAAE,KAAa;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,IAAI,CACZ,mBAAmB,EACnB;YACE,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,EAAE,QAAQ,CAAC,EAAE;YACjE,MAAM,EAAE,IAAI;SACb,EACD,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAmB,EAAE,EAAU;QAC5C,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,YAAY;IACZ,uEAAuE;IAE/D,KAAK,CAAC,SAAS,CACrB,EAAiB,EACjB,EAAU,EACV,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,yEAAyE;QACzE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAwB,EAAE,EAAmB;QACxE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACrC,gBAAgB,EAAE,EAAE,CAAC,WAAW;YAChC,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;iBAC7B,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM;gBAC1C,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC;YACD,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAwB,EACxB,EAAmB,EACnB,KAAqC;QAErC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACrC,gBAAgB,EAAE,EAAE,CAAC,WAAW;YAChC,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE;YAC5D,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/backend/services/tool-registry.d.ts

@@ -0,0 +1,17 @@
+import type { LlmToolDefinition, PromptActionTool, PromptActionToolRegistryPort, ToolVisibilityContext } from '@endora-commerce/contracts';
+export declare class PromptActionToolRegistry implements PromptActionToolRegistryPort {
+    private readonly tools;
+    register<P>(tool: PromptActionTool<P>): void;
+    get(id: string): PromptActionTool | undefined;
+    list(): PromptActionTool[];
+    /**
+     * The catalogue sent to the LLM for one operator: tools whose owning
+     * module is installed AND whose permission the operator holds. Filtering
+     * happens here (before the model ever sees a tool) and again at execution
+     * time in the plan executor (defense in depth, FR-007).
+     */
+    visibleFor(ctx: ToolVisibilityContext): Promise<PromptActionTool[]>;
+    /** Provider-facing definition: same Zod schema, serialized as JSON Schema. */
+    toLlmToolDefinition(tool: PromptActionTool): LlmToolDefinition;
+}
+//# sourceMappingURL=tool-registry.d.ts.map

package/dist/backend/services/tool-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../../src/backend/services/tool-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAmCpC,qBAAa,wBAAyB,YAAW,4BAA4B;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAE7D,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI;IAuB5C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI7C,IAAI,IAAI,gBAAgB,EAAE;IAI1B;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAgBzE,8EAA8E;IAC9E,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB;CAO/D"}