@happyvertical/smrt-app-shell 0.60.18 → 0.61.0

package/dist/lib/objects/AppDraftVersion.d.ts

@@ -0,0 +1,25 @@
+import { SmrtCollection, SmrtObject } from '@happyvertical/smrt-core';
+/**
+ * One version of a draft's definition (shell.db), the same shape as
+ * `AppVersion` plus the draft it belongs to. The draft's FIRST row is a copy of
+ * the live version it started from (its base): it is not a change the person
+ * made. Never deleted. Written only by `DraftVersionStore`; no generated
+ * surface.
+ */
+export declare class AppDraftVersion extends SmrtObject {
+    draftId: string;
+    version: number;
+    /** Parent version, `-1` for none. */
+    parent: number;
+    author: string;
+    summary: string;
+    /** The whole definition, JSON text. */
+    definition: string;
+    /** `{ steps, purged? }` JSON text, or empty. */
+    migration: string;
+    createdAt: string;
+    purged: boolean;
+}
+export declare class AppDraftVersionCollection extends SmrtCollection<AppDraftVersion> {
+    static readonly _itemClass: typeof AppDraftVersion;
+}

package/dist/lib/objects/AppDraftVersion.js

@@ -0,0 +1,68 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { field, SmrtCollection, SmrtObject, smrt, } from '@happyvertical/smrt-core';
+/**
+ * One version of a draft's definition (shell.db), the same shape as
+ * `AppVersion` plus the draft it belongs to. The draft's FIRST row is a copy of
+ * the live version it started from (its base): it is not a change the person
+ * made. Never deleted. Written only by `DraftVersionStore`; no generated
+ * surface.
+ */
+let AppDraftVersion = class AppDraftVersion extends SmrtObject {
+    draftId = '';
+    version = 0;
+    /** Parent version, `-1` for none. */
+    parent = -1;
+    author = '';
+    summary = '';
+    /** The whole definition, JSON text. */
+    definition = '';
+    /** `{ steps, purged? }` JSON text, or empty. */
+    migration = '';
+    createdAt = '';
+    purged = false;
+};
+__decorate([
+    field({ type: 'text', required: true })
+], AppDraftVersion.prototype, "draftId", void 0);
+__decorate([
+    field({ type: 'integer', required: true })
+], AppDraftVersion.prototype, "version", void 0);
+__decorate([
+    field({ type: 'integer' })
+], AppDraftVersion.prototype, "parent", void 0);
+__decorate([
+    field({ type: 'text' })
+], AppDraftVersion.prototype, "author", void 0);
+__decorate([
+    field({ type: 'text' })
+], AppDraftVersion.prototype, "summary", void 0);
+__decorate([
+    field({ type: 'text' })
+], AppDraftVersion.prototype, "definition", void 0);
+__decorate([
+    field({ type: 'text' })
+], AppDraftVersion.prototype, "migration", void 0);
+__decorate([
+    field({ type: 'text' })
+], AppDraftVersion.prototype, "createdAt", void 0);
+__decorate([
+    field({ type: 'boolean' })
+], AppDraftVersion.prototype, "purged", void 0);
+AppDraftVersion = __decorate([
+    smrt({
+        tableName: 'app_draft_versions',
+        api: false,
+        mcp: false,
+        cli: false,
+        conflictColumns: ['id'],
+    })
+], AppDraftVersion);
+export { AppDraftVersion };
+export class AppDraftVersionCollection extends SmrtCollection {
+    static _itemClass = AppDraftVersion;
+}

package/dist/lib/objects/Approval.d.ts

@@ -1,10 +1,10 @@
 import { SmrtCollection, SmrtObject } from '@happyvertical/smrt-core';
 import { type ApprovalOutcome } from '../server/approvals.ts';
-export type ApprovalStatus = 'pending' | 'approved' | 'denied' | 'failed';
+export type ApprovalStatus = 'pending' | 'approved' | 'denied' | 'failed' | 'accepted' | 'executing' | 'expired';
 /**
- * A risky change waiting for the owner. Created by the shell when a risky
- * builder method, app tool or REST DELETE is attempted; applied only by
- * {@link Approval.decide} (the one place the engine's `approved` flag is set).
+ * Compatibility facade for installed Tricia approval storage and generated
+ * decide/pending operations. The shared OwnerApprovalAuthority owns decisions
+ * and consumption; the shell retains only its action/draft execution policy.
  */
 export declare class Approval extends SmrtObject {
     /** The action to run on approval, JSON (`ApprovalAction`). */

package/dist/lib/objects/Approval.js

@@ -11,9 +11,9 @@ import { assertOwner } from "../server/owner.js";
 // statically) and is repeated on the collection (core applies a collection's
 // @smrt() config to its item class).
 /**
- * A risky change waiting for the owner. Created by the shell when a risky
- * builder method, app tool or REST DELETE is attempted; applied only by
- * {@link Approval.decide} (the one place the engine's `approved` flag is set).
+ * Compatibility facade for installed Tricia approval storage and generated
+ * decide/pending operations. The shared OwnerApprovalAuthority owns decisions
+ * and consumption; the shell retains only its action/draft execution policy.
  */
 let Approval = class Approval extends SmrtObject {
     /** The action to run on approval, JSON (`ApprovalAction`). */

package/dist/lib/objects/index.d.ts

@@ -1,4 +1,6 @@
 export { App, AppCollection } from './App.ts';
+export { AppDraft, AppDraftCollection } from './AppDraft.ts';
+export { AppDraftVersion, AppDraftVersionCollection, } from './AppDraftVersion.ts';
 export { Approval, ApprovalCollection } from './Approval.ts';
 export { AppVersion, AppVersionCollection } from './AppVersion.ts';
 export { AssistantMessage, AssistantMessageCollection, } from './AssistantMessage.ts';

package/dist/lib/objects/index.js

@@ -1,4 +1,6 @@
 export { App, AppCollection } from "./App.js";
+export { AppDraft, AppDraftCollection } from "./AppDraft.js";
+export { AppDraftVersion, AppDraftVersionCollection, } from "./AppDraftVersion.js";
 export { Approval, ApprovalCollection } from "./Approval.js";
 export { AppVersion, AppVersionCollection } from "./AppVersion.js";
 export { AssistantMessage, AssistantMessageCollection, } from "./AssistantMessage.js";

package/dist/lib/server/approval-store.d.ts

@@ -0,0 +1,6 @@
+import { OwnerApprovalAuthority } from '@happyvertical/smrt-app-runtime';
+/** The local product has one tenant. Refuse ambiguous legacy ownership. */
+export declare function shellApprovalAuthority(): Promise<{
+    tenantId: string;
+    authority: OwnerApprovalAuthority;
+}>;

package/dist/lib/server/approval-store.js

@@ -0,0 +1,102 @@
+// Storage compatibility for installed Tricia databases. The shared authority
+// owns decisions/consumption; this adapter keeps the existing ids and history.
+import { OwnerApprovalAuthority, } from '@happyvertical/smrt-app-runtime';
+import { TenantCollection } from '@happyvertical/smrt-users';
+import { ApprovalCollection } from "../objects/Approval.js";
+import { parseJson } from "./approvals.js";
+import { getShellDb } from "./host.js";
+import { isOwner } from "./owner.js";
+/** The local product has one tenant. Refuse ambiguous legacy ownership. */
+export async function shellApprovalAuthority() {
+    const db = await getShellDb();
+    const tenants = await (await TenantCollection.create({ db })).list({
+        limit: 2,
+    });
+    if (tenants.length !== 1 || !tenants[0].id)
+        throw new Error('approval storage requires the single installation tenant');
+    const tenantId = tenants[0].id;
+    const collection = await ApprovalCollection.create({ db });
+    const record = (row) => ({
+        id: row.id,
+        tenantId,
+        requestedBy: row.requestedBy,
+        tool: 'shell.action',
+        callId: row.actionKey,
+        args: { action: row.command },
+        summary: row.summary,
+        context: { preview: row.preview },
+        createdAt: new Date(row.createdAt).getTime(),
+        expiresAt: Number.MAX_SAFE_INTEGER,
+        // Old approved rows without results may have crashed during execution.
+        // Never replay those. New decisions use accepted until consume succeeds.
+        status: row.status === 'accepted'
+            ? 'approved'
+            : row.status === 'approved'
+                ? row.result
+                    ? 'succeeded'
+                    : 'executing'
+                : row.status,
+        decidedBy: row.decidedBy || null,
+        decidedAt: row.decidedAt ? new Date(row.decidedAt).getTime() : null,
+        ...(row.result ? { result: parseJson(row.result) } : {}),
+    });
+    const store = {
+        supportsNonExpiring: true,
+        async insert(value) {
+            if (value.tenantId !== tenantId)
+                throw new Error('foreign approval tenant');
+            const row = await collection.create({
+                id: value.id,
+                command: String(value.args.action),
+                actionKey: value.callId,
+                summary: value.summary,
+                preview: String(value.context.preview),
+                status: 'pending',
+                requestedBy: value.requestedBy,
+                createdAt: new Date(value.createdAt).toISOString(),
+            });
+            await row.save();
+        },
+        async get(tenant, id) {
+            if (tenant !== tenantId)
+                return null;
+            const row = await collection.get(id);
+            return row ? record(row) : null;
+        },
+        async list(tenant) {
+            return tenant === tenantId
+                ? (await collection.list({ limit: 500 })).map(record)
+                : [];
+        },
+        async transition(tenant, id, from, to, now, patch) {
+            if (tenant !== tenantId)
+                return false;
+            const persisted = (state) => state === 'approved'
+                ? 'accepted'
+                : state === 'succeeded'
+                    ? 'approved'
+                    : state;
+            // One conditional statement on the same database is the cross-process
+            // authority, including consumption BEFORE any host effect.
+            const sets = ['status = ?'];
+            const values = [persisted(to)];
+            if (from === 'pending') {
+                sets.push('decided_by = ?', 'decided_at = ?');
+                values.push(patch?.decidedBy ?? '', new Date(now).toISOString());
+            }
+            if (to === 'succeeded' || to === 'failed') {
+                sets.push('result = ?');
+                values.push(JSON.stringify(patch?.result ?? null));
+            }
+            const changed = await db.query(`UPDATE approvals SET ${sets.join(', ')} WHERE id = ? AND status = ? RETURNING id`, ...values, id, persisted(from));
+            return changed.rows.length === 1;
+        },
+    };
+    return {
+        tenantId,
+        authority: new OwnerApprovalAuthority(store, isOwner, Date.now, {
+            nonExpiring: true,
+            maxInputChars: 4_000_000,
+        }),
+    };
+}

package/dist/lib/server/approvals.d.ts

@@ -17,6 +17,19 @@ export type ApprovalAction = {
     kind: 'record-delete';
     model: string;
     id: string;
+}
+/** Publish the open draft; pinned to the digest of the preview the owner reviewed. */
+ | {
+    kind: 'publish-draft';
+    draftId: string;
+    draftName: string;
+    digest: string;
+}
+/** Discard the open draft (a tool asked; the UI discards directly). */
+ | {
+    kind: 'discard-draft';
+    draftId: string;
+    draftName: string;
 };
 /** The answer a refused-until-approved call gives instead of applying. */
 export interface PendingApproval {
@@ -49,6 +62,8 @@ export interface ApprovalOutcome {
     error?: string;
 }
 export declare function actionKey(action: ApprovalAction): string;
+/** Read a legacy JSON column without breaking saved history on malformed text. */
+export declare function parseJson(text: string): unknown;
 /**
  * Record a pending approval for `action`. An identical pending action reuses
  * its row, so retrying a refused call never piles up cards.

package/dist/lib/server/approvals.js

@@ -4,9 +4,13 @@
 // `approved: true`; nothing taken from a request body can set it.
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash } from 'node:crypto';
+import { OwnerApprovalError } from '@happyvertical/smrt-app-runtime';
 import { ApprovalCollection } from "../objects/Approval.js";
+import { shellApprovalAuthority } from "./approval-store.js";
+import { discardNow, publishApproved } from "./drafts.js";
 import { publish } from "./events.js";
 import { getHost, getShellDb } from "./host.js";
+import { publicChangeResult } from "./results.js";
 // Out-of-band record of the approvals a call issued. `requestApproval` is the
 // only writer, so a caller (the assistant's turn loop) can tell "this call
 // became an Approval" from a tool result whose text merely looks like one.
@@ -17,7 +21,6 @@ export async function collectIssuedApprovals(fn) {
     const value = await issuedScope.run(issued, fn);
     return { value, issued };
 }
-const MAX_RESULT_CHARS = 64_000;
 function canonical(value) {
     if (Array.isArray(value))
         return `[${value.map(canonical).join(',')}]`;
@@ -34,7 +37,8 @@ function canonical(value) {
 export function actionKey(action) {
     return createHash('sha256').update(canonical(action)).digest('hex');
 }
-function parseJson(text) {
+/** Read a legacy JSON column without breaking saved history on malformed text. */
+export function parseJson(text) {
     if (!text)
         return null;
     try {
@@ -51,14 +55,19 @@ function iso(value) {
 function view(row) {
     return {
         id: row.id,
-        status: row.status,
+        status: row.status === 'accepted' || row.status === 'executing'
+            ? 'approved'
+            : row.status,
         summary: row.summary,
         preview: parseJson(row.preview),
         action: parseJson(row.command),
         requestedBy: row.requestedBy,
         decidedBy: row.decidedBy,
         decidedAt: iso(row.decidedAt),
-        result: parseJson(row.result),
+        result: parseJson(row.command) &&
+            parseJson(row.command).kind === 'command'
+            ? publicChangeResult(parseJson(row.result))
+            : parseJson(row.result),
         createdAt: iso(row.createdAt),
     };
 }
@@ -75,25 +84,29 @@ export async function requestApproval(action, plan, requestedBy) {
     const existing = (await coll.list({ where: { actionKey: key, status: 'pending' }, limit: 1 }))[0];
     const row = existing ??
         (await (async () => {
-            const created = await coll.create({
-                command: JSON.stringify(action),
-                actionKey: key,
-                summary: plan.summary,
-                // Flat: the Approval card reads `preview.model`, `preview.code`, ...
-                preview: JSON.stringify({
-                    ...(plan.preview ?? {}),
-                    ...(plan.affectedMethods
-                        ? { affectedMethods: plan.affectedMethods }
-                        : {}),
-                }),
-                status: 'pending',
+            const { authority, tenantId } = await shellApprovalAuthority();
+            const saved = await authority.request({
+                tenantId,
                 requestedBy,
-                createdAt: new Date().toISOString(),
+                tool: 'shell.action',
+                callId: key,
+                // Definitions may nest more deeply than a tool argument envelope.
+                // Keep their already-validated JSON as inert data, as the legacy table does.
+                args: { action: JSON.stringify(action) },
+                summary: plan.summary,
+                context: {
+                    preview: JSON.stringify({
+                        ...(plan.preview ?? {}),
+                        ...(plan.affectedMethods
+                            ? { affectedMethods: plan.affectedMethods }
+                            : {}),
+                    }),
+                },
             });
-            await created.save();
+            const created = (await coll.get(saved.id));
             publish({
                 type: 'approval',
-                id: created.id,
+                id: saved.id,
                 status: 'pending',
                 summary: plan.summary,
             });
@@ -125,7 +138,6 @@ export async function listApprovalViews(filter = {}) {
 export async function pendingApprovalCount() {
     return (await listApprovalViews({ status: 'pending' })).length;
 }
-const inFlight = new Set();
 function isAction(v) {
     const a = v;
     if (!a || typeof a !== 'object')
@@ -138,6 +150,12 @@ function isAction(v) {
         return typeof a.method === 'string' && typeof a.url === 'string';
     if (a.kind === 'record-delete')
         return typeof a.model === 'string' && typeof a.id === 'string';
+    if (a.kind === 'publish-draft')
+        return (typeof a.draftId === 'string' &&
+            typeof a.digest === 'string' &&
+            typeof a.draftName === 'string');
+    if (a.kind === 'discard-draft')
+        return typeof a.draftId === 'string' && typeof a.draftName === 'string';
     return false;
 }
 /**
@@ -165,16 +183,12 @@ export async function decideApproval(id, approve, decidedBy) {
     const row = await coll.get(id);
     if (!row)
         throw new Error('approval not found');
-    if (row.status !== 'pending' || inFlight.has(id))
+    if (row.status !== 'pending')
         throw new Error(`approval is already ${row.status}`);
-    inFlight.add(id);
+    const { authority, tenantId } = await shellApprovalAuthority();
     try {
-        const decidedAt = new Date().toISOString();
         if (!approve) {
-            row.status = 'denied';
-            row.decidedBy = decidedBy;
-            row.decidedAt = decidedAt;
-            await row.save();
+            await authority.decide({ id: decidedBy, tenantId }, id, false);
             publish({
                 type: 'approval',
                 id,
@@ -186,20 +200,28 @@ export async function decideApproval(id, approve, decidedBy) {
         const action = parseJson(row.command);
         if (!isAction(action))
             throw new Error('the stored action is invalid');
-        // Mark it taken before running anything: a second decide sees "approved".
-        row.status = 'approved';
-        row.decidedBy = decidedBy;
-        row.decidedAt = decidedAt;
-        await row.save();
+        await authority.decide({ id: decidedBy, tenantId }, id, true);
+        await authority.consume(tenantId, id);
         let result;
         let error;
         try {
+            // Approvals only ever run against the LIVE host: the draft host
+            // approves its own risky changes (autoApprove), so none is ever asked.
             const host = await getHost();
-            if (action.kind === 'command')
-                result = await host.execute(action.command, {
+            if (action.kind === 'publish-draft')
+                result = await publishApproved(action, (live, draft, o) => live.publishDraft(draft, {
                     author: row.requestedBy || decidedBy,
                     approved: true,
-                });
+                    expect: o.expect,
+                    draftName: o.draftName,
+                }));
+            else if (action.kind === 'discard-draft')
+                result = await discardNow(action.draftId);
+            else if (action.kind === 'command')
+                result = publicChangeResult(await host.execute(action.command, {
+                    author: row.requestedBy || decidedBy,
+                    approved: true,
+                }));
             else if (action.kind === 'tool')
                 result = await host.callAppTool(action.name, action.args, {
                     approved: true,
@@ -217,12 +239,7 @@ export async function decideApproval(id, approve, decidedBy) {
             error = e instanceof Error ? e.message : String(e);
         }
         row.status = error === undefined ? 'approved' : 'failed';
-        const text = JSON.stringify(error === undefined ? result : { error });
-        row.result =
-            text.length > MAX_RESULT_CHARS
-                ? JSON.stringify({ truncated: true })
-                : (text ?? '');
-        await row.save();
+        await authority.complete(tenantId, id, error === undefined, error === undefined ? result : { error });
         publish({
             type: 'approval',
             id,
@@ -233,7 +250,9 @@ export async function decideApproval(id, approve, decidedBy) {
             ? { id, status: 'approved', result }
             : { id, status: 'failed', error };
     }
-    finally {
-        inFlight.delete(id);
+    catch (error) {
+        if (error instanceof OwnerApprovalError && error.code === 'conflict')
+            throw new Error('approval is already decided');
+        throw error;
     }
 }

package/dist/lib/server/builder.d.ts

@@ -1,16 +1,24 @@
-import { type Command, type ExecuteResult } from '../../engine/index.ts';
+import { type Command } from '../../engine/index.ts';
 import { type PendingApproval } from './approvals.ts';
-export type BuilderResult = ExecuteResult | PendingApproval;
-/** Run a command for `author`. Never passes `approved` (see approvals.ts). */
-export declare function runCommand(command: Command, author: string): Promise<BuilderResult>;
-/** Run an app tool; a risky one (`<model>_delete`) becomes an approval. */
-export declare function runAppTool(name: string, args: Record<string, unknown>, author: string): Promise<import("../../engine/host.ts").ToolResult | PendingApproval>;
-/** Pass a request to the app's generated REST; a DELETE becomes an approval. */
+import { type PublicExecuteResult } from './results.ts';
+import type { Target } from './target.ts';
+export type BuilderResult = PublicExecuteResult | PendingApproval;
+/** Run a command for `author` on `target`. Never passes `approved` (see approvals.ts). */
+export declare function runCommand(command: Command, author: string, target: Target): Promise<BuilderResult>;
+/** Run an app tool on `target`; a risky one (`<model>_delete`) on live becomes an approval. */
+export declare function runAppTool(name: string, args: Record<string, unknown>, author: string, target: Target): Promise<import("../../engine/host.ts").ToolResult | PendingApproval>;
+/** Pass a request to the app's generated REST on `target`; a live DELETE becomes an approval. */
 export declare function runRest(req: {
     method: string;
     url: string;
     body?: string;
-}, author: string): Promise<import("../../engine/host.ts").RestResult | PendingApproval>;
+}, author: string, target: Target): Promise<import("../../engine/host.ts").RestResult | PendingApproval>;
 export declare function isPending(x: unknown): x is PendingApproval;
-/** Delete a record: always an approval (nothing is deleted until decided). */
-export declare function requestRecordDelete(model: string, id: string, author: string): Promise<PendingApproval>;
+/**
+ * Delete a record. On live: always an approval (nothing is deleted until
+ * decided). On the draft: deleted at once (a draft's records are throw-away
+ * test data and its host approves its own risky changes).
+ */
+export declare function requestRecordDelete(model: string, id: string, author: string, target: Target): Promise<PendingApproval | {
+    deleted: string;
+}>;

package/dist/lib/server/builder.js

@@ -1,31 +1,53 @@
 // Builder operations: run an engine command, or, if it is risky, turn it into
 // an Approval and return `pending_approval` without changing anything.
-import { ApprovalRequiredError, } from "../../engine/index.js";
+//
+// Every function takes the copy it acts on (`target`), named by the caller from
+// the request. There is no default. On the LIVE copy a risky change becomes an
+// Approval; on the DRAFT copy the draft host approves its own risky changes
+// (`autoApprove`, engine-enforced to draft hosts only), so none is asked.
+import { ApprovalRequiredError, EngineError, isStructuralCommand, } from "../../engine/index.js";
 import { requestApproval, } from "./approvals.js";
-import { getHost } from "./host.js";
-/** Run a command for `author`. Never passes `approved` (see approvals.ts). */
-export async function runCommand(command, author) {
-    const host = await getHost();
+import { getDraftSlot, hostFor } from "./host.js";
+import { publicChangeResult } from "./results.js";
+/** The refusal for a structural request that names the live copy while a draft is open. */
+async function refuseLiveStructure() {
+    const slot = await getDraftSlot();
+    throw new EngineError(slot
+        ? `The draft "${slot.name}" is open, so the live app's structure is frozen. Make this change in the draft (target=draft), or publish or discard the draft first.`
+        : 'The live app is frozen.', 'refused');
+}
+/** Run a command for `author` on `target`. Never passes `approved` (see approvals.ts). */
+export async function runCommand(command, author, target) {
+    const host = await hostFor(target);
+    if (target === 'live' && host.frozen && isStructuralCommand(command))
+        await refuseLiveStructure();
     try {
-        return await host.execute(command, { author });
+        return publicChangeResult(await host.execute(command, { author }));
     }
     catch (e) {
         if (e instanceof ApprovalRequiredError) {
+            // Only the live host asks (the draft's autoApprove never throws this).
             // An undo is approved for the version it was planned against: if the app
             // moves on first, approving it must not undo something else.
             const version = e.plan.preview
                 ?.version;
-            const pinned = command.type === 'undo' && typeof version === 'number'
-                ? { type: 'undo', version }
-                : command;
+            let pinned = command;
+            if (command.type === 'undo' && typeof version === 'number')
+                pinned = { type: 'undo', version };
+            else if (command.type === 'undoTo')
+                pinned = {
+                    type: 'undoTo',
+                    version: command.version,
+                    from: host.version,
+                };
             return requestApproval({ kind: 'command', command: pinned }, e.plan, author);
         }
         throw e;
     }
 }
-/** Run an app tool; a risky one (`<model>_delete`) becomes an approval. */
-export async function runAppTool(name, args, author) {
-    const host = await getHost();
+/** Run an app tool on `target`; a risky one (`<model>_delete`) on live becomes an approval. */
+export async function runAppTool(name, args, author, target) {
+    const host = await hostFor(target);
     try {
         return await host.callAppTool(name, args);
     }
@@ -35,9 +57,9 @@ export async function runAppTool(name, args, author) {
         throw e;
     }
 }
-/** Pass a request to the app's generated REST; a DELETE becomes an approval. */
-export async function runRest(req, author) {
-    const host = await getHost();
+/** Pass a request to the app's generated REST on `target`; a live DELETE becomes an approval. */
+export async function runRest(req, author, target) {
+    const host = await hostFor(target);
     try {
         return await host.rest(req);
     }
@@ -59,10 +81,16 @@ export function isPending(x) {
         typeof x === 'object' &&
         x.status === 'pending_approval');
 }
-/** Delete a record: always an approval (nothing is deleted until decided). */
-export async function requestRecordDelete(model, id, author) {
-    const host = await getHost();
+/**
+ * Delete a record. On live: always an approval (nothing is deleted until
+ * decided). On the draft: deleted at once (a draft's records are throw-away
+ * test data and its host approves its own risky changes).
+ */
+export async function requestRecordDelete(model, id, author, target) {
+    const host = await hostFor(target);
     const record = await host.get(model, id); // 404s for a missing record
+    if (target === 'draft')
+        return host.remove(model, id);
     return requestApproval({ kind: 'record-delete', model, id }, {
         summary: `Delete ${model} record ${id}`,
         risky: true,