@endora-commerce/mod-prompt-actions 0.0.0-stage → 0.100.0

package/dist/backend/services/tool-registry.js

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+/**
+ * PromptActionToolRegistry — the module-facing port of feature 043
+ * (data-model §4, contracts/prompt-actions-api.md "Tool-contribution
+ * contract").
+ *
+ * Owning modules contribute tools at composition time (the same pattern as
+ * the payment/shipping adapter registries), so `prompt_actions` never
+ * imports another module's internals. The registry is the ONLY catalogue the
+ * interpreter may draw operations from: anything the LLM proposes that is
+ * not registered here is rejected (FR-002 / FR-014).
+ *
+ * Contribution rules (enforced at registration where statically checkable):
+ *   1. `id` is '<moduleId>.<snake_case_name>' and unique.
+ *   2. `requiredPermission` mirrors the permission guarding the equivalent
+ *      manual admin route.
+ *   3. `paramsSchema` (Zod) is the single source for validating LLM
+ *      arguments and for the provider-facing JSON Schema.
+ *   4. Mutations are inert at interpretation time and MUST implement
+ *      `preview()` returning server-computed facts.
+ *   5. Resolvers are side-effect-free and cap their result size.
+ *
+ * **The contribution shape is published** (feature 075, D-75):
+ * `PromptActionTool`, `ToolContext`, `ToolAuditContext`, `LlmToolDefinition`,
+ * `ToolVisibilityContext` and `PromptActionToolRegistryPort` all live in
+ * `@endora-commerce/contracts`, so a contributor names the interface and this module keeps
+ * the class. What made that possible was deleting `ToolContext.em`: it carried
+ * a MikroORM type that may not appear in a browser-bundled package, and — more
+ * to the point — it carried nothing anybody used. Every contributor read it in
+ * `preview()` only, only for reads, only of its own tables.
+ */
+const TOOL_ID_RE = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+export class PromptActionToolRegistry {
+    tools = new Map();
+    register(tool) {
+        if (!TOOL_ID_RE.test(tool.id)) {
+            throw new Error(`Prompt-action tool id "${tool.id}" must match '<moduleId>.<snake_case_name>'.`);
+        }
+        const [prefix] = tool.id.split('.', 1);
+        if (prefix !== tool.moduleId) {
+            throw new Error(`Prompt-action tool "${tool.id}" must be prefixed with its owning moduleId "${tool.moduleId}".`);
+        }
+        if (tool.kind === 'mutation' && typeof tool.preview !== 'function') {
+            throw new Error(`Prompt-action mutation "${tool.id}" must implement preview() — plans render server-computed facts only.`);
+        }
+        if (this.tools.has(tool.id)) {
+            throw new Error(`Duplicate prompt-action tool id "${tool.id}".`);
+        }
+        this.tools.set(tool.id, tool);
+    }
+    get(id) {
+        return this.tools.get(id);
+    }
+    list() {
+        return [...this.tools.values()];
+    }
+    /**
+     * The catalogue sent to the LLM for one operator: tools whose owning
+     * module is installed AND whose permission the operator holds. Filtering
+     * happens here (before the model ever sees a tool) and again at execution
+     * time in the plan executor (defense in depth, FR-007).
+     */
+    async visibleFor(ctx) {
+        const out = [];
+        const moduleStates = new Map();
+        for (const tool of this.tools.values()) {
+            let installed = moduleStates.get(tool.moduleId);
+            if (installed === undefined) {
+                installed = await ctx.isModuleInstalled(tool.moduleId);
+                moduleStates.set(tool.moduleId, installed);
+            }
+            if (!installed)
+                continue;
+            if (!(await ctx.hasPermission(tool.requiredPermission)))
+                continue;
+            out.push(tool);
+        }
+        return out;
+    }
+    /** Provider-facing definition: same Zod schema, serialized as JSON Schema. */
+    toLlmToolDefinition(tool) {
+        return {
+            name: tool.id,
+            description: tool.description,
+            inputSchema: z.toJSONSchema(tool.paramsSchema, { io: 'input' }),
+        };
+    }
+}
+//# sourceMappingURL=tool-registry.js.map

package/dist/backend/services/tool-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.js","sourceRoot":"","sources":["../../../src/backend/services/tool-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,MAAM,OAAO,wBAAwB;IAClB,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,QAAQ,CAAI,IAAyB;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,EAAE,8CAA8C,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,EAAE,gDAAgD,IAAI,CAAC,QAAQ,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,EAAE,uEAAuE,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAwB,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAA0B;QACzC,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,SAAS,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAAE,SAAS;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAsB;QACxC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAA4B;SAC3F,CAAC;IACJ,CAAC;CACF"}

package/dist/manifest.d.ts

@@ -0,0 +1,252 @@
+/**
+ * Prompt Actions module — feature 043.
+ *
+ * Natural-language prompt mode for the admin command palette: the operator
+ * types an instruction (PL/EN), the backend interprets it with an LLM via
+ * tool use / function calling against a curated, module-contributed tool
+ * catalogue, presents a confirmable plan, and executes it through existing
+ * module services under the operator's own permissions.
+ *
+ * Settings (research §R4; provider credentials via feature 058):
+ *   - prompt_actions.enabled          — platform-wide kill switch (FR-015).
+ *   - prompt_actions.llm_credentials  — reference to a reusable `llm` credential
+ *                                       configuration (provider + model + API
+ *                                       key). The single credential source.
+ *   - prompt_actions.bulk_limit       — max affected records per prompt (FR-010).
+ *
+ * No palette `actions:` entry: feature 020 actions are navigation-only, and
+ * the prompt mode has no standalone route — its entry point is the
+ * capability-gated "Ask the assistant" row the admin shell pins inside the
+ * palette itself.
+ */
+export declare const PROMPT_ACTIONS_SETTING_CODES: {
+    /**
+     * Feature 074 — the operator-activation control, and a **different switch**
+     * from `ENABLED` below. The two answer different questions and neither can
+     * stand in for the other:
+     *
+     *  - `ENABLED` is the assistant's own kill switch, default `false`. Off, the
+     *    module is *present*: the capability endpoint answers `200 {status:
+     *    'disabled'}` and a submission answers `409 ASSISTANT_DISABLED`, which is
+     *    what the palette reads to learn it should not offer prompt mode.
+     *  - `ACTIVATION` is the Constitution XVII axis, default `true`. Off, the
+     *    module is *absent*: `ctx.routes` 503s the whole surface, including the
+     *    probe above.
+     *
+     * Adopting `ENABLED` as the activation control — which D-44 §6 proposed —
+     * would have done two things at once: taken the probe away from the palette,
+     * and switched the module off in every existing deployment, because the row
+     * resolves `false` by default. FR-012 forbids the second outright.
+     */
+    readonly ACTIVATION: "prompt_actions.activation";
+    readonly ENABLED: "prompt_actions.enabled";
+    readonly LLM_CREDENTIALS: "prompt_actions.llm_credentials";
+    readonly BULK_LIMIT: "prompt_actions.bulk_limit";
+};
+export declare const PROMPT_ACTIONS_USE_PERMISSION = "prompt_actions:use";
+/** Settings-only export consumed by the boot-time ManifestReconciler lists. */
+export declare const promptActionsSettingsManifest: {
+    moduleCode: string;
+    groups: {
+        code: string;
+        name: string;
+        salesChannelCodes?: string[] | undefined;
+        isSystemProtected?: boolean | undefined;
+    }[];
+    settings: {
+        code: string;
+        name: string;
+        valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+        defaultValue: unknown;
+        description?: string | undefined;
+        groupCode?: string | undefined;
+        previousDefaultValues?: unknown[] | undefined;
+        salesChannelCodes?: string[] | undefined;
+        enumOptions?: string[] | undefined;
+        configurationType?: string | undefined;
+        hidden?: boolean | undefined;
+    }[];
+};
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+/**
+ * What this module offers the admin home dashboard's Recent Activity card —
+ * feature 080, T042j / D-163.1.
+ *
+ * **This entry is the drift D-163 named.** `prompt_action.execute` was in the
+ * host's server-side allow-list and in its action-to-module prefix map, and
+ * absent from the route's three-member `module` enum and from the admin's
+ * `ACTIVITY_RENDERING` — so a prompt-assistant row was fetched, classified
+ * `prompt_actions`, and then rendered with the unknown-verb fallback, while the
+ * response schema described a `module` value the server could emit and the
+ * contract did not list. Four hand-maintained tables in two languages, and they
+ * were not kept true. It is repaired here by the derivation rather than by a
+ * fifth hand-written entry, which is the difference between fixing an instance
+ * and fixing the class.
+ */
+export declare const recentActivity: {
+    entries: {
+        action: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        labelKey: string;
+    }[];
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,4BAA4B;IACvC;;;;;;;;;;;;;;;;;OAiBG;;;;;CAOK,CAAC;AAEX,eAAO,MAAM,6BAA6B,uBAAuB,CAAC;AAiDlE,+EAA+E;AAC/E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;CAAW,CAAC;AAEtD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFnB,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;CAQzB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,199 @@
+import { defineModuleManifest, defineModuleRecentActivity, defineModuleSettingsManifest, } from '@endora-commerce/contracts';
+/**
+ * Prompt Actions module — feature 043.
+ *
+ * Natural-language prompt mode for the admin command palette: the operator
+ * types an instruction (PL/EN), the backend interprets it with an LLM via
+ * tool use / function calling against a curated, module-contributed tool
+ * catalogue, presents a confirmable plan, and executes it through existing
+ * module services under the operator's own permissions.
+ *
+ * Settings (research §R4; provider credentials via feature 058):
+ *   - prompt_actions.enabled          — platform-wide kill switch (FR-015).
+ *   - prompt_actions.llm_credentials  — reference to a reusable `llm` credential
+ *                                       configuration (provider + model + API
+ *                                       key). The single credential source.
+ *   - prompt_actions.bulk_limit       — max affected records per prompt (FR-010).
+ *
+ * No palette `actions:` entry: feature 020 actions are navigation-only, and
+ * the prompt mode has no standalone route — its entry point is the
+ * capability-gated "Ask the assistant" row the admin shell pins inside the
+ * palette itself.
+ */
+export const PROMPT_ACTIONS_SETTING_CODES = {
+    /**
+     * Feature 074 — the operator-activation control, and a **different switch**
+     * from `ENABLED` below. The two answer different questions and neither can
+     * stand in for the other:
+     *
+     *  - `ENABLED` is the assistant's own kill switch, default `false`. Off, the
+     *    module is *present*: the capability endpoint answers `200 {status:
+     *    'disabled'}` and a submission answers `409 ASSISTANT_DISABLED`, which is
+     *    what the palette reads to learn it should not offer prompt mode.
+     *  - `ACTIVATION` is the Constitution XVII axis, default `true`. Off, the
+     *    module is *absent*: `ctx.routes` 503s the whole surface, including the
+     *    probe above.
+     *
+     * Adopting `ENABLED` as the activation control — which D-44 §6 proposed —
+     * would have done two things at once: taken the probe away from the palette,
+     * and switched the module off in every existing deployment, because the row
+     * resolves `false` by default. FR-012 forbids the second outright.
+     */
+    ACTIVATION: 'prompt_actions.activation',
+    ENABLED: 'prompt_actions.enabled',
+    // Feature 058 — the single credential source: a reusable `llm` credential
+    // configuration supplying provider + model + API key.
+    LLM_CREDENTIALS: 'prompt_actions.llm_credentials',
+    BULK_LIMIT: 'prompt_actions.bulk_limit',
+};
+export const PROMPT_ACTIONS_USE_PERMISSION = 'prompt_actions:use';
+const settings = defineModuleSettingsManifest({
+    moduleCode: 'prompt_actions',
+    groups: [{ code: 'prompt_actions', name: 'Prompt actions (AI assistant)' }],
+    settings: [
+        {
+            // Feature 074 — the operator's activation control. Platform-wide, and
+            // never channel-scoped: activation stops at `global_value` →
+            // `default_value` by construction.
+            code: PROMPT_ACTIONS_SETTING_CODES.ACTIVATION,
+            name: 'Prompt actions enabled',
+            description: 'Switches the whole module on or off: the prompt API, the plan preview and execution path, and the tools other modules contribute to it. This is the module switch; the assistant\'s own on/off, which leaves the palette able to say "not available", is the setting below. Nothing is dropped — every recorded plan, its audit trail and the LLM credential reference stay in the database.',
+            groupCode: 'prompt_actions',
+            valueType: 'boolean',
+            defaultValue: true,
+        },
+        {
+            code: PROMPT_ACTIONS_SETTING_CODES.ENABLED,
+            name: 'Assistant enabled',
+            description: 'Platform-wide switch for the natural-language prompt mode in the admin command palette. When off, the palette behaves exactly as without the module.',
+            groupCode: 'prompt_actions',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: PROMPT_ACTIONS_SETTING_CODES.LLM_CREDENTIALS,
+            name: 'LLM credentials',
+            description: 'Reference a reusable LLM credential configuration (Credentials screen) providing the provider, model and API key. Required to enable the assistant.',
+            groupCode: 'prompt_actions',
+            valueType: 'credential_ref',
+            configurationType: 'llm',
+            defaultValue: '',
+        },
+        {
+            code: PROMPT_ACTIONS_SETTING_CODES.BULK_LIMIT,
+            name: 'Bulk operation limit',
+            description: 'Maximum number of records a single prompt may affect. Plans whose preview exceeds the limit are blocked before execution.',
+            groupCode: 'prompt_actions',
+            valueType: 'number',
+            defaultValue: 500,
+        },
+    ],
+});
+/** Settings-only export consumed by the boot-time ManifestReconciler lists. */
+export const promptActionsSettingsManifest = settings;
+export const manifest = defineModuleManifest({
+    id: 'prompt_actions',
+    name: 'Prompt Actions',
+    description: 'Natural-language prompt mode for the admin command palette: interpret an operator instruction with an LLM, preview the plan, execute it through existing module services after explicit confirmation.',
+    version: '1.0.0',
+    // `auth` owns the `requireAdmin` port and `admin_roles` owns
+    // `permissionService`; both are resolved from the container, so both are
+    // real dependencies of this module rather than of its composition root.
+    dependencies: ['_i18n', '_lifecycle', 'admin_roles', 'auth', 'credentials', 'settings'],
+    settings,
+    // Feature 074 (Constitution XVII) — a control this module never had, so the
+    // module was governed by the platform axis alone. `backend.ts` explains why
+    // it was withheld: adopting `prompt_actions.enabled` would 503 the capability
+    // probe the palette needs in order to *learn* the assistant is off. That
+    // argument is answered by giving the module its own activation code rather
+    // than by leaving it without a control — the two switches now sit side by
+    // side and mean different things.
+    //
+    // Default `true`, superseding D-44 §6's `default: false`. The ground is
+    // general and not a judgement about the assistant: merging must not change
+    // the state of any existing deployment, and a module with no activation
+    // declaration resolves as activated today. A client who does not want it
+    // switches it off, like every other operator-controlled module — and the
+    // assistant's own kill switch below still defaults to `false`, so nothing
+    // starts talking to an LLM because of this.
+    activation: { settingCode: PROMPT_ACTIONS_SETTING_CODES.ACTIVATION, default: true },
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    /**
+     * The `ASSISTANT_*` and `PROMPT_*` codes — D-129's remaining sweep, Tier A
+     * (`specs/090-module-owned-error-codes/d129-sweep.md` §5.2, Appendix A;
+     * MR 3).
+     *
+     * All six were declared by `_i18n` until this merge request, not because
+     * anybody judged them the platform's but because the deleted prefix chain
+     * had no rule for them and its last line was `return 'core'`. **D-121 T1
+     * puts them here**: the noun in each is either the prompt assistant — the
+     * LLM capability this module configures, gates and calls — or a prompt
+     * action request, the `PromptActionRequest` row this module owns and whose
+     * whole state machine it runs. This module is also the only one that raises
+     * them, so T1 and the raise-site count agree.
+     *
+     * **`ASSISTANT_*` is not `MODULE_DISABLED`, and the distinction is the
+     * reason it is a code of its own.** `ASSISTANT_DISABLED` refuses a
+     * submission while this module is *present and switched on* and its own
+     * `prompt_actions.assistant_enabled` kill switch is off; a switched-off
+     * module answers `MODULE_DISABLED`, which is the platform's vocabulary and
+     * stays with it (Constitution XVII, `d129-sweep.md` §2.5).
+     *
+     * **No sentence moves with them.** None of the six has a sentence in either
+     * language anywhere in the tree; all six were already on
+     * `UNTRANSLATED_ERROR_CODES` under `_i18n` and move to this module's group
+     * there, so the bundle this module already ships gains no key. The admin's
+     * prompt panel maps four of them to its own copy
+     * (`admin/src/components/prompt-actions/PromptModePanel.tsx`), which is a
+     * surface string and not the envelope's sentence — that mapping is untouched
+     * and unaffected by which bundle the envelope reads.
+     *
+     * **`tokens` is derived from the raise sites, not from the bundle**
+     * (runbook §5), and there are none to declare: every raise is a bare
+     * `HttpError(status, code, message)` or a `readonly code =` on an `Error`
+     * subclass in `services/llm/provider-factory.ts` and
+     * `services/plan-executor.service.ts`, and no site puts a `details.code` on
+     * the wire.
+     */
+    errorCodes: [
+        { code: 'ASSISTANT_DISABLED' },
+        { code: 'ASSISTANT_NOT_CONFIGURED' },
+        { code: 'PROMPT_PERMISSION_REVOKED' },
+        { code: 'PROMPT_PLAN_EXPIRED' },
+        { code: 'PROMPT_REQUEST_INVALID_STATE' },
+        { code: 'PROMPT_REQUEST_IN_FLIGHT' },
+    ],
+    permissions: [
+        {
+            code: PROMPT_ACTIONS_USE_PERMISSION,
+            label: 'Use the prompt assistant',
+            description: 'Allows the operator to open the prompt mode in the admin command palette and execute confirmed plans (each planned operation is additionally re-checked against the permission of its underlying action).',
+        },
+    ],
+});
+/**
+ * What this module offers the admin home dashboard's Recent Activity card —
+ * feature 080, T042j / D-163.1.
+ *
+ * **This entry is the drift D-163 named.** `prompt_action.execute` was in the
+ * host's server-side allow-list and in its action-to-module prefix map, and
+ * absent from the route's three-member `module` enum and from the admin's
+ * `ACTIVITY_RENDERING` — so a prompt-assistant row was fetched, classified
+ * `prompt_actions`, and then rendered with the unknown-verb fallback, while the
+ * response schema described a `module` value the server could emit and the
+ * contract did not list. Four hand-maintained tables in two languages, and they
+ * were not kept true. It is repaired here by the derivation rather than by a
+ * fifth hand-written entry, which is the difference between fixing an instance
+ * and fixing the class.
+ */
+export const recentActivity = defineModuleRecentActivity({
+    entries: [
+        {
+            action: 'prompt_action.execute',
+            icon: 'Sparkles',
+            labelKey: 'activity.verb.prompt_action.execute',
+        },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,EAAE,2BAA2B;IACvC,OAAO,EAAE,wBAAwB;IACjC,0EAA0E;IAC1E,sDAAsD;IACtD,eAAe,EAAE,gCAAgC;IACjD,UAAU,EAAE,2BAA2B;CAC/B,CAAC;AAEX,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAElE,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAC5C,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;IAC3E,QAAQ,EAAE;QACR;YACE,sEAAsE;YACtE,6DAA6D;YAC7D,mCAAmC;YACnC,IAAI,EAAE,4BAA4B,CAAC,UAAU;YAC7C,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,8XAA8X;YAChY,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,IAAI;SACnB;QACD;YACE,IAAI,EAAE,4BAA4B,CAAC,OAAO;YAC1C,IAAI,EAAE,mBAAmB;YACzB,WAAW,EACT,sJAAsJ;YACxJ,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,4BAA4B,CAAC,eAAe;YAClD,IAAI,EAAE,iBAAiB;YACvB,WAAW,EACT,qJAAqJ;YACvJ,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,gBAAgB;YAC3B,iBAAiB,EAAE,KAAK;YACxB,YAAY,EAAE,EAAE;SACjB;QACD;YACE,IAAI,EAAE,4BAA4B,CAAC,UAAU;YAC7C,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EACT,2HAA2H;YAC7H,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,GAAG;SAClB;KACF;CACF,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAEtD,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACT,uMAAuM;IACzM,OAAO,EAAE,OAAO;IAChB,6DAA6D;IAC7D,yEAAyE;IACzE,wEAAwE;IACxE,YAAY,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC;IACvF,QAAQ;IACR,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,kCAAkC;IAClC,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,4CAA4C;IAC5C,UAAU,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;IACnF,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC9B,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,2BAA2B,EAAE;QACrC,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC/B,EAAE,IAAI,EAAE,8BAA8B,EAAE;QACxC,EAAE,IAAI,EAAE,0BAA0B,EAAE;KACrC;IACD,WAAW,EAAE;QACX;YACE,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,0BAA0B;YACjC,WAAW,EACT,2MAA2M;SAC9M;KACF;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;IACvD,OAAO,EAAE;QACP;YACE,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,qCAAqC;SAChD;KACF;CACF,CAAC,CAAC"}

package/dist/migrations/20260611T140410_prompt_actions_init.d.ts

@@ -0,0 +1,17 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Prompt Actions module init (feature 043).
+ *
+ * Creates `prompt_action_requests` — one row per operator-submitted
+ * natural-language instruction, carrying the full lifecycle: interpretation
+ * output (plan / clarification), confirmation, execution result, and the
+ * `seen_at` marker that drives the "finished while you were away" notice.
+ *
+ * No FK on `admin_user_id` (matches the `module_actions` precedent: admin
+ * users are platform-owned; the lifecycle orchestrator owns cleanup).
+ */
+export declare class Migration20260611T140410PromptActionsInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260611T140410_prompt_actions_init.d.ts.map

package/dist/migrations/20260611T140410_prompt_actions_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140410_prompt_actions_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260611T140410_prompt_actions_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,qBAAa,yCAA0C,SAAQ,SAAS;IACvD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260611T140410_prompt_actions_init.js

@@ -0,0 +1,47 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Prompt Actions module init (feature 043).
+ *
+ * Creates `prompt_action_requests` — one row per operator-submitted
+ * natural-language instruction, carrying the full lifecycle: interpretation
+ * output (plan / clarification), confirmation, execution result, and the
+ * `seen_at` marker that drives the "finished while you were away" notice.
+ *
+ * No FK on `admin_user_id` (matches the `module_actions` precedent: admin
+ * users are platform-owned; the lifecycle orchestrator owns cleanup).
+ */
+export class Migration20260611T140410PromptActionsInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "prompt_action_requests" (
+        "id" uuid not null,
+        "admin_user_id" uuid not null,
+        "prompt" text not null,
+        "language" varchar(12) null,
+        "status" varchar(32) not null,
+        "provider" varchar(32) null,
+        "model" varchar(120) null,
+        "plan" jsonb null,
+        "clarification" jsonb null,
+        "conversation" jsonb null,
+        "result" jsonb null,
+        "error" text null,
+        "bulk_operation_id" uuid null,
+        "seen_at" timestamptz null,
+        "confirmed_at" timestamptz null,
+        "finished_at" timestamptz null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "prompt_action_requests_pkey" primary key ("id")
+      );
+    `);
+        this.addSql(`
+      create index "prompt_action_requests_admin_user_id_created_at_index"
+        on "prompt_action_requests" ("admin_user_id", "created_at" desc);
+    `);
+    }
+    async down() {
+        this.addSql(`drop table if exists "prompt_action_requests" cascade;`);
+    }
+}
+//# sourceMappingURL=20260611T140410_prompt_actions_init.js.map

package/dist/migrations/20260611T140410_prompt_actions_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140410_prompt_actions_init.js","sourceRoot":"","sources":["../../src/migrations/20260611T140410_prompt_actions_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yCAA0C,SAAQ,SAAS;IAC7D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;KAsBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;KAGX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260611T140410PromptActionsInit } from './20260611T140410_prompt_actions_init.js';
+export declare const migrations: (typeof Migration20260611T140410PromptActionsInit)[];
+export { Migration20260611T140410PromptActionsInit, };
+//# sourceMappingURL=index.d.ts.map