@lmzhen/dsh-evolution-approval 0.26.26 → 0.27.1

package/lib/index.js

@@ -1,93 +1,82 @@
 import { Service } from "@deepseek-ai/cordis";
 import { randomUUID } from "node:crypto";
-import { clampOnce, elapsedSince, isLoopbackRequest, readJsonObject, textDiffFacts, writeJson } from "@lmzhen/dsh-evolution-core";
+import { clampOnce, elapsedSince, textDiffFacts } from "@lmzhen/dsh-evolution-core";
 import z from "@deepseek-ai/schemastery";
 import { PENDING_STATUSES } from "@lmzhen/dsh-evolution-state-storage";
+import { HOST_ROUTES, json, methodNotAllowed, readJsonObject, registerHostRoutes } from "@lmzhen/dsh-evolution-core/http-routes";
 //#region lib/types/routes.js
 /**
-* The approval HTTP surface: four loopback routes over the write gate's pending window.
+* The approval HTTP surface: four exact Fetch routes over the write gate's pending window.
+*
+* W6/G4: the carrier is the platform's Host connection data plane (`connection.fetch`) — the trust
+* fence, browser auth and owner-only admission are applied by the platform BEFORE `fetch(request)`
+* runs, so this module has no fence and no 403/401 branch. It still answers the same JSON envelope
+* the browser half reads; the loopback f-string that used to live here was a SECOND admission path
+* (the S2 spike showed it could diverge from the platform's).
 *
 * Layering: this module maps a route to a USE CASE and does nothing else. The pending window itself
 * (ids, statuses, claim/resolve rules, the replay runners) lives in this package's service and in
 * `evolution-state-storage`; the routes only read the window and forward the two decisions, so the
 * console command face (`/evolution pending`, `approve <id>`) and this one cannot drift — both call
 * the same methods.
-*
-* The browser half never touches the state medium: it lists, it approves, it rejects.
 * @module @lmzhen/dsh-evolution-approval/routes
 */
-/** Route paths. The browser half mirrors these literals; a spec asserts the two sides agree. */
-const APPROVAL_ROUTES = {
-	pending: "/api/dsh-evolution/approval/pending",
-	approve: "/api/dsh-evolution/approval/approve",
-	reject: "/api/dsh-evolution/approval/reject",
-	preview: "/api/dsh-evolution/approval/preview"
-};
+/** Route paths: the ONE declaration lives in core (W1) and the browser half is generated from it. */
+const APPROVAL_ROUTES = HOST_ROUTES.approval;
+/**
+* Run one decision against the service.
+*
+* A refusal is a BUSINESS answer, not a transport failure: the body carries the service's own
+* sentence — the same one the console command prints — so the two faces cannot drift. A throw is
+* reported the same way rather than escaping as an empty 500, because the operator's next step
+* ("reject it", "retry") is only actionable if the reason is visible.
+*/
+async function decide(run, id) {
+	try {
+		const result = await run(id);
+		return json(200, result.ok ? {
+			ok: true,
+			data: result
+		} : {
+			ok: false,
+			code: "approval-refused",
+			message: result.message
+		});
+	} catch (error) {
+		return json(200, {
+			ok: false,
+			code: "approval-failed",
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+}
+/** The one shape a decision route accepts: a non-empty string id. */
+function idOf(payload) {
+	return typeof payload?.id === "string" ? payload.id.trim() : "";
+}
 /**
-* Build the four routes over the approval service.
+* Build the four exact Fetch routes over the approval service.
 * @param approval - the host's approval face (the service instance, or a spec fixture).
-* @returns the route list for `ctx.webServer.register`.
+* @param audit - the DecisionAudit captured where the connection service is known (registration).
+* @returns the route list for `registerHostRoutes`.
 */
-function makeApprovalRoutes(approval) {
-	/** Guard: trust fence, then method. Every refusal is a JSON body, never an empty response. */
-	const guard = (req, res, method) => {
-		if (!isLoopbackRequest(req)) {
-			writeJson(res, 403, { error: "禁止访问：仅限回环地址" });
-			return false;
-		}
-		if (req.method !== method) {
-			writeJson(res, 405, { error: "方法不允许：" + method });
-			return false;
-		}
-		return true;
-	};
-	/**
-	* Run one decision against the service.
-	*
-	* A refusal is a BUSINESS answer, not a transport failure: the body carries the service's own
-	* sentence — the same one the console command prints — so the two faces cannot drift. A throw is
-	* reported the same way rather than escaping as an empty 500, because the operator's next step
-	* ("reject it", "retry") is only actionable if the reason is visible.
-	*/
-	const decide = async (res, run, id) => {
-		try {
-			const result = await run(id);
-			writeJson(res, 200, result.ok ? {
-				ok: true,
-				data: result
-			} : {
-				ok: false,
-				code: "approval-refused",
-				message: result.message
-			});
-		} catch (error) {
-			writeJson(res, 200, {
-				ok: false,
-				code: "approval-failed",
-				message: error instanceof Error ? error.message : String(error)
-			});
-		}
-	};
-	/** The one shape a decision route accepts: a non-empty string id. */
-	const idOf = (payload) => typeof payload?.id === "string" ? payload.id.trim() : "";
+function makeApprovalRoutes(approval, audit) {
 	return [
 		{
-			kind: "exact",
 			path: APPROVAL_ROUTES.pending,
-			handler: async (req, res) => {
-				if (!guard(req, res, "GET")) return;
-				const raw = new URL(req.url ?? "/", "http://loopback").searchParams.get("status")?.trim() ?? "";
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				if (request.method !== "GET") return methodNotAllowed(["GET"]);
+				const raw = new URL(request.url).searchParams.get("status")?.trim() ?? "";
 				const status = raw === "" ? "pending" : raw;
-				if (!PENDING_STATUSES.includes(status)) {
-					writeJson(res, 400, {
-						ok: false,
-						code: "bad-request",
-						message: "status 必须是以下之一：" + PENDING_STATUSES.join(", ")
-					});
-					return;
-				}
+				if (!PENDING_STATUSES.includes(status)) return json(400, {
+					ok: false,
+					code: "bad-request",
+					message: "status 必须是以下之一：" + PENDING_STATUSES.join(", ")
+				});
 				try {
-					writeJson(res, 200, {
+					return json(200, {
 						ok: true,
 						data: (await approval.list(status)).map((record) => ({
 							id: record.id,
@@ -100,7 +89,7 @@ function makeApprovalRoutes(approval) {
 						}))
 					});
 				} catch (error) {
-					writeJson(res, 200, {
+					return json(200, {
 						ok: false,
 						code: "approval-failed",
 						message: error instanceof Error ? error.message : String(error)
@@ -109,53 +98,42 @@ function makeApprovalRoutes(approval) {
 			}
 		},
 		{
-			kind: "exact",
 			path: APPROVAL_ROUTES.preview,
-			handler: async (req, res) => {
-				if (!guard(req, res, "GET")) return;
-				const id = new URL(req.url ?? "/", "http://loopback").searchParams.get("id")?.trim() ?? "";
-				if (id === "") {
-					writeJson(res, 400, {
-						ok: false,
-						code: "bad-request",
-						message: "缺少 id"
-					});
-					return;
-				}
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				if (request.method !== "GET") return methodNotAllowed(["GET"]);
+				const id = new URL(request.url).searchParams.get("id")?.trim() ?? "";
+				if (id === "") return json(400, {
+					ok: false,
+					code: "bad-request",
+					message: "缺少 id"
+				});
 				try {
 					const record = [...await approval.list("pending"), ...await approval.list("executing")].find((candidate) => candidate.id === id);
-					if (record === void 0) {
-						writeJson(res, 200, {
-							ok: false,
-							code: "not-found",
-							message: "没有 id 为「" + id + "」的待批准写入"
-						});
-						return;
-					}
+					if (record === void 0) return json(200, {
+						ok: false,
+						code: "not-found",
+						message: "没有 id 为「" + id + "」的待批准写入"
+					});
 					const preview = approval.previewOf(record.kind);
-					if (preview === void 0) {
-						writeJson(res, 200, {
-							ok: true,
-							data: {
-								available: false,
-								reason: "类型 \"" + record.kind + "\" 的写入没有可预览内容"
-							}
-						});
-						return;
-					}
+					if (preview === void 0) return json(200, {
+						ok: true,
+						data: {
+							available: false,
+							reason: "类型 \"" + record.kind + "\" 的写入没有可预览内容"
+						}
+					});
 					const answer = await preview(record.args);
-					if (!answer.available) {
-						writeJson(res, 200, {
-							ok: true,
-							data: {
-								available: false,
-								reason: answer.reason
-							}
-						});
-						return;
-					}
+					if (!answer.available) return json(200, {
+						ok: true,
+						data: {
+							available: false,
+							reason: answer.reason
+						}
+					});
 					const facts = textDiffFacts(answer.before ?? "", answer.after ?? "", answer.path);
-					writeJson(res, 200, {
+					return json(200, {
 						ok: true,
 						data: {
 							available: true,
@@ -164,7 +142,7 @@ function makeApprovalRoutes(approval) {
 						}
 					});
 				} catch (error) {
-					writeJson(res, 200, {
+					return json(200, {
 						ok: false,
 						code: "approval-failed",
 						message: error instanceof Error ? error.message : String(error)
@@ -173,37 +151,33 @@ function makeApprovalRoutes(approval) {
 			}
 		},
 		{
-			kind: "exact",
 			path: APPROVAL_ROUTES.approve,
-			handler: async (req, res) => {
-				if (!guard(req, res, "POST")) return;
-				const id = idOf(await readJsonObject(req));
-				if (id === "") {
-					writeJson(res, 400, {
-						ok: false,
-						code: "bad-request",
-						message: "缺少 id"
-					});
-					return;
-				}
-				await decide(res, (current) => approval.approve(current), id);
+			methods: ["POST"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				if (request.method !== "POST") return methodNotAllowed(["POST"]);
+				const id = idOf(await readJsonObject(request));
+				if (id === "") return json(400, {
+					ok: false,
+					code: "bad-request",
+					message: "缺少 id"
+				});
+				return await decide((current) => approval.approve(current, audit), id);
 			}
 		},
 		{
-			kind: "exact",
 			path: APPROVAL_ROUTES.reject,
-			handler: async (req, res) => {
-				if (!guard(req, res, "POST")) return;
-				const id = idOf(await readJsonObject(req));
-				if (id === "") {
-					writeJson(res, 400, {
-						ok: false,
-						code: "bad-request",
-						message: "缺少 id"
-					});
-					return;
-				}
-				await decide(res, (current) => approval.reject(current), id);
+			methods: ["POST"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				if (request.method !== "POST") return methodNotAllowed(["POST"]);
+				const id = idOf(await readJsonObject(request));
+				if (id === "") return json(400, {
+					ok: false,
+					code: "bad-request",
+					message: "缺少 id"
+				});
+				return await decide((current) => approval.reject(current, audit), id);
 			}
 		}
 	];
@@ -300,14 +274,7 @@ var EvolutionApproval = class extends Service {
 			const disposer = settings.configure({ auto: false }, this.ctx.fiber);
 			if (typeof disposer === "function") this.ctx.effect(() => disposer, "evolution-approval: settings presentation");
 		});
-		this.ctx.inject(["webServer"], (scope) => {
-			scope.effect(() => {
-				const disposers = makeApprovalRoutes(this).map((route) => scope.webServer.register(route));
-				return () => {
-					for (const dispose of disposers) dispose();
-				};
-			}, "evolution-approval: routes");
-		});
+		registerHostRoutes(this.ctx, (audit) => makeApprovalRoutes(this, audit));
 	}
 	state() {
 		return this.ctx.evolutionState;
@@ -446,8 +413,8 @@ var EvolutionApproval = class extends Service {
 		await this.expireStale();
 		return await this.state().listPending(status);
 	}
-	async approve(id) {
-		return await this.dedupe(`approve:${id}`, () => this.doApprove(id));
+	async approve(id, audit) {
+		return await this.dedupe(`approve:${id}`, () => this.doApprove(id, audit));
 	}
 	/** S2-P2-22 (0.3.80): return an ORPHANED executing record to the pending
 	* window. "Orphaned" is DECIDED here, never assumed: the older rationale
@@ -513,7 +480,7 @@ var EvolutionApproval = class extends Service {
 			message: `已把「${id}」放回待批准窗口。${holderPid === null ? " Its claim carries no pid, so liveness could NOT be verified: another process may still be running this approve." : ""} 批准前请先核验效果：批准会重跑该写入，非幂等的重放会造成效果重复；改为拒绝则可关闭该记录。`
 		};
 	}
-	async reject(id) {
+	async reject(id, audit) {
 		return await this.dedupe(`reject:${id}`, async () => {
 			const claimId = this.newClaimId();
 			if (!await this.state().claimPending(id, claimId)) {
@@ -537,6 +504,7 @@ var EvolutionApproval = class extends Service {
 					message: `待批准写入「${id}」已不在待批准状态（已了结或不存在）。`
 				};
 			}
+			await this.recordDecision(resolution.record, audit);
 			return {
 				ok: true,
 				message: `已拒绝 ${resolution.record.kind} 写入「${id}」。`
@@ -577,7 +545,20 @@ var EvolutionApproval = class extends Service {
 		this.inFlight.set(id, run);
 		return run;
 	}
-	async doApprove(id) {
+	/** W6: attach the platform's admission decision to a resolved record (read-tolerant; absent on
+	* records resolved by expiry or before 0.2.1). */
+	async recordDecision(record, audit) {
+		if (record === null) return;
+		try {
+			await this.state().savePending({
+				...record,
+				decidedBy: audit
+			});
+		} catch (error) {
+			this.ctx.logger.warn("evolution-approval: could not attach decidedBy audit: " + (error instanceof Error ? error.message : String(error)));
+		}
+	}
+	async doApprove(id, audit) {
 		const claimId = this.newClaimId();
 		const record = await this.state().claimPending(id, claimId);
 		if (!record) {
@@ -593,7 +574,8 @@ var EvolutionApproval = class extends Service {
 		const runner = this.runners.get(record.kind);
 		if (!runner) {
 			if (record.kind === "capability") {
-				if (!(await this.state().tryResolvePending(id, "approved", claimId)).applied) {
+				const resolution = await this.state().tryResolvePending(id, "approved", claimId);
+				if (!resolution.applied) {
 					if ((await this.state().listPending("rejected")).find((item) => item.id === id)) return {
 						ok: false,
 						message: `能力「${id}」已获批准，但记录被并发地了结为「rejected」：没有代码运行，也无需重放；重新提交前请先核验。`
@@ -603,6 +585,7 @@ var EvolutionApproval = class extends Service {
 						message: `待批准写入「${id}」已被另一个写入方了结。`
 					};
 				}
+				await this.recordDecision(resolution.record, audit);
 				return {
 					ok: true,
 					message: "能力已批准，可在 Creator 模式下手动激活（未执行任何代码）。"
@@ -649,6 +632,7 @@ var EvolutionApproval = class extends Service {
 				message: `待批准写入「${id}」已被另一个写入方了结。`
 			};
 		}
+		await this.recordDecision(resolution.record, audit);
 		return {
 			ok: true,
 			message: `已批准 ${record.kind} 写入「${id}」（${record.summary}）。`

package/lib/types/index.d.ts

@@ -21,6 +21,7 @@ import type { Volatile } from '@deepseek-ai/cordis';
 import { type WriteConfirmMode } from '@lmzhen/dsh-evolution-core';
 import z from '@deepseek-ai/schemastery';
 import type { PendingKind, PendingRecord, PendingStatus } from '@lmzhen/dsh-evolution-state-storage';
+import type { DecisionAudit } from '@lmzhen/dsh-evolution-core/http-routes';
 export type { PendingKind, PendingRecord, PendingStatus };
 export type WriteRunner = (args: unknown) => Promise<{
     ok: boolean;
@@ -262,7 +263,7 @@ export declare class EvolutionApproval extends Service {
      */
     expireStale(): Promise<string[]>;
     list(status?: PendingStatus): Promise<PendingRecord[]>;
-    approve(id: string): Promise<{
+    approve(id: string, audit: DecisionAudit): Promise<{
         ok: boolean;
         message: string;
     }>;
@@ -290,7 +291,7 @@ export declare class EvolutionApproval extends Service {
         ok: boolean;
         message: string;
     }>;
-    reject(id: string): Promise<{
+    reject(id: string, audit: DecisionAudit): Promise<{
         ok: boolean;
         message: string;
     }>;
@@ -311,6 +312,9 @@ export declare class EvolutionApproval extends Service {
      * claim-id grammar accepts). */
     private newClaimId;
     private dedupe;
+    /** W6: attach the platform's admission decision to a resolved record (read-tolerant; absent on
+     * records resolved by expiry or before 0.2.1). */
+    private recordDecision;
     private doApprove;
 }
 export default EvolutionApproval;

package/lib/types/routes.d.ts

@@ -1,25 +1,29 @@
 /**
- * The approval HTTP surface: four loopback routes over the write gate's pending window.
+ * The approval HTTP surface: four exact Fetch routes over the write gate's pending window.
+ *
+ * W6/G4: the carrier is the platform's Host connection data plane (`connection.fetch`) — the trust
+ * fence, browser auth and owner-only admission are applied by the platform BEFORE `fetch(request)`
+ * runs, so this module has no fence and no 403/401 branch. It still answers the same JSON envelope
+ * the browser half reads; the loopback f-string that used to live here was a SECOND admission path
+ * (the S2 spike showed it could diverge from the platform's).
  *
  * Layering: this module maps a route to a USE CASE and does nothing else. The pending window itself
  * (ids, statuses, claim/resolve rules, the replay runners) lives in this package's service and in
  * `evolution-state-storage`; the routes only read the window and forward the two decisions, so the
  * console command face (`/evolution pending`, `approve <id>`) and this one cannot drift — both call
  * the same methods.
- *
- * The browser half never touches the state medium: it lists, it approves, it rejects.
  * @module @lmzhen/dsh-evolution-approval/routes
  */
-import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
 import type { PendingKind, PendingRecord, PendingStatus } from '@lmzhen/dsh-evolution-state-storage';
 import { elapsedSince } from '@lmzhen/dsh-evolution-core';
+import type { ConnectionFetchRouteLike, DecisionAudit } from '@lmzhen/dsh-evolution-core/http-routes';
 import type { WritePreview } from './index.ts';
-/** Route paths. The browser half mirrors these literals; a spec asserts the two sides agree. */
+/** Route paths: the ONE declaration lives in core (W1) and the browser half is generated from it. */
 export declare const APPROVAL_ROUTES: {
     readonly pending: "/api/dsh-evolution/approval/pending";
+    readonly preview: "/api/dsh-evolution/approval/preview";
     readonly approve: "/api/dsh-evolution/approval/approve";
     readonly reject: "/api/dsh-evolution/approval/reject";
-    readonly preview: "/api/dsh-evolution/approval/preview";
 };
 /** What one row of the pending list carries to the browser half. */
 export interface PendingRow {
@@ -36,26 +40,30 @@ export interface PendingRow {
 /**
  * The slice of the approval service these routes read.
  *
- * Structural on purpose: a spec fixture implements it without constructing the service, and the
- * routes stay usable from any host that exposes the same three methods.
+ * W6: approve/reject take the DecisionAudit captured at registration (channel/principal/
+ * deploymentAllowsRemote). The audit rides the service call so the ledger records the ONE admission
+ * decision the platform already made — the route never re-derives it.
  */
 export interface ApprovalFace {
     list(status?: PendingStatus): Promise<PendingRecord[]>;
-    approve(id: string): Promise<{
+    approve(id: string, audit: DecisionAudit): Promise<{
         ok: boolean;
         message: string;
     }>;
-    reject(id: string): Promise<{
+    reject(id: string, audit: DecisionAudit): Promise<{
         ok: boolean;
         message: string;
     }>;
     /** The preview the replayer of that kind registered, when it registered one. */
     previewOf(kind: PendingKind): WritePreview | undefined;
 }
+/** The one shape a decision route accepts: a non-empty string id. */
+export declare function idOf(payload: Record<string, unknown> | null): string;
 /**
- * Build the four routes over the approval service.
+ * Build the four exact Fetch routes over the approval service.
  * @param approval - the host's approval face (the service instance, or a spec fixture).
- * @returns the route list for `ctx.webServer.register`.
+ * @param audit - the DecisionAudit captured where the connection service is known (registration).
+ * @returns the route list for `registerHostRoutes`.
  */
-export declare function makeApprovalRoutes(approval: ApprovalFace): WebRoute[];
+export declare function makeApprovalRoutes(approval: ApprovalFace, audit: DecisionAudit): ConnectionFetchRouteLike[];
 //# sourceMappingURL=routes.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-approval",
   "description": "Stage/pending approval service for Hermes-style self-evolution writes (community build)",
-  "version": "0.26.26",
+  "version": "0.27.1",
   "publishConfig": {
     "access": "public"
   },
@@ -26,19 +26,21 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.4",
-    "@lmzhen/dsh-evolution-core": "^0.26.26"
+    "@deepseek-ai/schemastery": "^3.18.5",
+    "@lmzhen/dsh-evolution-core": "^0.27.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-state-storage": "^0.26.26",
-    "@lmzhen/dsh-evolution-state": "^0.26.26"
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@lmzhen/dsh-evolution-core": "^0.27.1",
+    "@lmzhen/dsh-evolution-state": "^0.27.1",
+    "@lmzhen/dsh-evolution-state-storage": "^0.27.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-core": "^0.26.26",
-    "@lmzhen/dsh-evolution-state-storage": "^0.26.26",
-    "@lmzhen/dsh-evolution-state": "^0.26.26"
+    "@lmzhen/dsh-evolution-core": "^0.27.1",
+    "@lmzhen/dsh-evolution-state": "^0.27.1",
+    "@lmzhen/dsh-evolution-state-storage": "^0.27.1"
+  },
+  "engines": {
+    "dsh": ">=0.2.1-rc.1 <0.2.2-0"
   }
 }